Administration Guide for Pano Virtual Desktop Solution v2.0.4

Document Revision 204-3

Copyright © 2008 Pano Logic, Inc.

Table of Contents

About This Book................................................................................... 6

Document Feedback.................................................................................................... 6

Chapter 1 – Introduction and System Requirements...................... 7

Pano Virtual Desktop Solution Overview.................................................................... 7

Pano Device Overview............................................................................................. 7

Pano Manager Overview.......................................................................................... 8

Pano Desktop Service Overview............................................................................. 8

System Requirements................................................................................................... 9

Hardware Requirements........................................................................................... 9

Prerequisites........................................................................................................... 10

Supported Desktop Operating Systems.............................................................. 11

Supported Directory Services............................................................................... 11

Compatibility of Pano Components by Version................................................... 11

Chapter 2 – Concepts........................................................................ 12

Desktop Virtual Machine............................................................................................ 12

Desktop Virtual Machine Collections........................................................................ 12

Types of Collections................................................................................................ 12

User Assigned Collections..................................................................................... 13

Device Assigned Collections................................................................................. 14

Organize Collections Using Folders in VirtualCenter.......................................... 15

Automated Deployment.......................................................................................... 15

DVM Power Management...................................................................................... 16

Automated Provisioning............................................................................................. 17

Chapter 3 – Installation Overview.................................................... 18

Chapter 4 – Setting Up Virtual Infrastructure................................ 20

VMware Virtual Infrastructure 3.................................................................................. 20

Chapter 5 – Installing and Configuring the Pano Manager Virtual Machine 21

Installing Pano Manager on VMware VI3 ................................................................. 21

Configuring Pano Manager Virtual Machine ........................................................... 22

Set Superuser Password....................................................................................... 23

Set Web Admin Password..................................................................................... 23

Updating VMware Tools......................................................................................... 23

Reserving Resources for the Pano Manager VM................................................ 24

Chapter 6 – Pano Manager One-Time Setup.................................. 26

Prerequisites............................................................................................................... 26

Pano Management Console Login........................................................................... 26

Setup Directory Service Integration.......................................................................... 27

Virtualization Configuration........................................................................................ 31

Setup Pano Device Discovery................................................................................... 32

Enable Local Broadcast......................................................................................... 32

Remote Broadcast Networks................................................................................. 33

Probe Address Ranges.......................................................................................... 33

DHCP Assisted Discovery..................................................................................... 33

Chapter 7 – Prerequisites for Automated Provisioning................ 34

Recommended Windows Patches........................................................................ 34

Install VMware Tools............................................................................................... 34

Firewall Settings...................................................................................................... 34

Enable Remote Desktop and Set Remote Desktop Users................................ 35

Install Pano Desktop Service................................................................................. 36

Create a DVM Template and Customization Specification............................... 39

Test Deployment and Remote Desktop Connection........................................... 39

Chapter 8 - Configuring a DVM Collection....................................... 40

How to Setup a DVM Collection................................................................................ 40

Deployment Resources.......................................................................................... 42

Log Messages Related to Deployment Resources............................................ 43

Editing a DVM Collection....................................................................................... 43

Removing a DVM Collection.................................................................................. 43

Working with Single User / Device Collections........................................................ 43

Setting up Single User / Device Collection.......................................................... 43

Assigning Devices via Pano Management Console........................................... 44

Working with User Group / Device Collections........................................................ 44

Setting up User Group / Device Collection........................................................... 44

Assigning Devices via Pano Management Console........................................... 45

Assigning Devices by Logging in from the Device.............................................. 45

Working with Shared User / Device Collections...................................................... 46

Setting up User Group / Device Collection........................................................... 46

Assigning Devices via Pano Management Console........................................... 46

Assigning Devices by Logging in from the Device.............................................. 47

Working with Device Restrictions.............................................................................. 47

Device Restrictions and User Assigned Collections.......................................... 47

Device Restrictions and Device Assigned Collections...................................... 48

Setting up the Collection with Device Restrictions.............................................. 48

Chapter 9 - Monitoring DVM Status................................................. 49

Monitoring Status of Individual DVMs....................................................................... 50

Managing Assignments.............................................................................................. 50

Understanding User Assignment........................................................................... 50

Manually Assigning a User to a DVM................................................................... 51

Unassigning a User from a DVM........................................................................... 51

Understanding Device Assignment....................................................................... 51

Manually Assigning a Device to a DVM............................................................... 51

Unassigning a Device from a DVM....................................................................... 51

Choosing a DVM Collection Type............................................................................. 52

Pooled Collection.................................................................................................... 52

Cloned Collection.................................................................................................... 52

Custom Collection................................................................................................... 52

Single User / Device............................................................................................... 52

User Group / Device............................................................................................... 53

Shared User / Device............................................................................................. 53

User Controlled DVM Operations............................................................................. 54

Move to Trash.......................................................................................................... 54

Chapter 10 - Managing Pano Devices and Desktop Preferences 56

Managing Pano Devices............................................................................................ 57

Setting the Pano login image................................................................................. 57

Configuring Pano devices for Dual-Monitor Use................................................. 58

Manually Adding Pano Devices............................................................................. 58

Editing Pano Device Information........................................................................... 59

Removing Pano Devices........................................................................................ 59

Default Preferences ................................................................................................... 60

Display Preferences............................................................................................... 60

Audio Preferences.................................................................................................. 61

Keyboard Preferences........................................................................................... 61

Mouse Preferences................................................................................................. 61

Locale....................................................................................................................... 61

Chapter 11 – Best Practices............................................................. 62

Organizing Folders in VirtualCenter...................................................................... 62

Refreshing a Pooled Collection............................................................................. 63

Chapter 12 – Using Pano VDS with VMware Virtual Desktop Manager 64

Install the Pano Desktop Service............................................................................... 64

Install the Pano Manager Virtual Machine................................................................ 64

One-Time Setup of Pano Manager........................................................................... 64

Directory Service Configuration............................................................................ 65

VMware VDM Configuration.................................................................................. 65

Discovery Configuration......................................................................................... 65

Create VMware VDM Collection............................................................................... 66

Validate the Configuration.......................................................................................... 66

Appendix A – Understanding Pano Device Discovery................... 67

Configuring DHCP Assisted Discovery.................................................................... 67

Instructions for Configuring Windows DHCP Server........................................... 68

Appendix B – Configuring DVM Firewall.......................................... 76

Appendix C – Pano Manager Network Port Usage........................ 80

Inbound ports used...................................................................................................... 80

Outbound ports used................................................................................................... 80

Appendix D – Installing USB Peripheral Support........................... 81

Support for USB Peripherals..................................................................................... 81

Composite USB Devices....................................................................................... 81

Known Issues and Limitations............................................................................... 82

Install USBD.SYS from Windows XP disk............................................................ 82

Safely Removing / Ejecting USB Mass Storage Devices...................................... 83

Restricting/Allowing Use of USB Devices................................................................ 83

Adding and Setting the USB Filter String............................................................. 83

USB Filter String Values........................................................................................ 85

Appendix E – Configuring DVMs for 24-bit Color............................ 86

Appendix F – Updating the Pano Manager..................................... 93

Appendix G - Reading Log Files....................................................... 97

Filtering System Messages................................................................................... 97

Viewing Message Detail........................................................................................ 97

Downloading Log Files........................................................................................... 97

Appendix H: Enabling Auto Recovery for the Pano DAS Windows Service 98

Appendix I: Updating the SSL Certificate.................................... 102

Disabling the HTTP port ...................................................................................... 102

Appendix J: Enabling SSH Access to the ESX Service Console 103

# About This Book

This book, the Pano Administration Guide, provides information about installing and using the Pano Virtual Desktop Solution.

## Document Feedback

Pano Logic welcomes your suggestions for improving our documentation. If you have comments, send your feedback to:

docfeedback@panologic.com

# Chapter 1 – Introduction and System Requirements

This book describes the installation and administration of the Pano™ Virtual Desktop Solution. The Pano Virtual Desktop Solution leverages the power of server-based virtualization and Pano Logic’s unique zero client device to deliver desktop computing services that are superior to traditional desktop PCs. The Pano Virtual Desktop Solution comprises physical client devices, centralized management software, software services running within each virtual machine and an underlying virtualization infrastructure.

## Pano Virtual Desktop Solution Overview

The Pano™ device is a zero client: it has no CPU, no memory, no operating system, no drivers, no software and no moving parts. The Pano device connects keyboard, mouse, display, audio and USB peripherals over an existing IP network to an instance of Windows XP or Vista running on a virtualized server. A Pano device is eco friendly, consuming only 3% of the energy consumed by a traditional desktop computer and contains no moving parts or computer components that would require frequent upgrades or replacement.

The Pano Manager – Pano Logic's centralized service and web-based management interface enables administrators to manage the entire virtual desktop installation by integrating with existing directory services and virtual infrastructure managers.

The Pano Desktop Service – A lightweight service residing within each desktop virtual machine links peripherals attached to the Pano device to the unmodified Windows drivers residing in the virtual machine. This design guarantees that all existing Windows drivers will work without modification.

A virtualization layer – Pano Logic’s system leverages server-based virtualization software such as VMware Virtual Infrastructure 3 to abstract processor, memory, storage and networking resources into multiple virtual machines, to give you greater hardware utilization and flexibility.

### Pano Device Overview

The Pano device is purpose-built for server-based desktop virtualization. Because the Pano device is 100% hardware, all software can now run in the data center or network closet, where it can be easily centrally managed and effectively protected. The Pano device connects to your standard PC peripherals including keyboard, mouse, video monitor, Ethernet network, audio speakers/headphones and a wide variety of USB devices such as thumb drives, CD/DVD drives and additional peripherals. The Pano device is stateless – it contains no intelligence or software memory – and is controlled by centralized services such as the Pano Manager and DHCP. The Pano device includes a single button—the Pano Button™—that initiates out-of-band management of a user’s virtual desktop. For example, the user can receive a fresh virtual machine, cloned from a golden image, simply by pushing the Pano Button.

### Pano Manager Overview

The Pano Manager is a centrally hosted server that is delivered in the form of a virtual appliance. The Pano Manager typically runs as a virtual machine located on the same host servers as your virtual desktops. The Pano Manager is the central point of control for all of your Pano devices; it integrates with your directory service and VMware VirtualCenter to manage, deploy and connect virtual desktops to end users. The Pano Manager provides secure access to virtual desktops by leveraging Microsoft Active Directory, Novell eDirectory or OpenLDAP for authentication and login. The Pano Manager also provides a web-based interface that enables users to connect to their virtual desktops from traditional PCs or laptops for those times when users are not in front of a Pano device.

### Pano Desktop Service Overview

In addition to the Pano Manager, there is a lightweight Pano Desktop Service that runs within the Windows desktop operating system(s) and allows the desktop session and peripherals to be transmitted securely over your standard IP network. The Pano Control Panel, which is part of the Pano Desktop Service, allows individual users to set their personal preferences for keyboard, mouse, display and audio settings.

The following diagram shows a high-level view of the Pano Virtual Desktop Solution and its main components. These components are described in greater detail later in this book.

## System Requirements

The following sections describe the hardware and software requirements for the Pano Virtual Desktop Solution.

### Hardware Requirements

The Pano Virtual Desktop Solution requires server hardware to run the virtual infrastructure. For a deployment based on VMware Virtual Infrastructure 3 (VI3) the server hardware needs to be capable of running VMware ESX 3.x. You can find compatible hardware by consulting VMware’s compatibility guides available at http://www.vmware.com/resources/guides.html.

The information listed here is intended to provide you an estimate of resource requirements; the resources required to support your environment may differ—due to workload requirements, network topology, and other variables of your deployment—from the estimates provided here. Please work with your Pano Logic representative or partner for more assistance sizing your environment.

Resource (e.g. CPU, memory, disk, network) sizing is dependent on the number of virtual desktops that you will run in your environment. To estimate your basic requirements, allocate an appropriate amount of CPU and memory to each virtual desktop. Multiply that amount by the number of desktops that you expect to run. For disk, allocate an appropriate amount of space for each virtual desktop. Also keep in mind disk I/O rates and do not place too many virtual desktops on a single physical drive. Finally, ensure that you have sufficient network bandwidth between your server and workgroup switches. You should have 1 Gbps links between your server and workgroup switches. From workgroup switches to Pano devices, 100Mbps links are sufficient. Contact Pano Logic Professional Services for help sizing your specific configuration.

In addition to provisioning for virtual desktops, you need to consider the resource requirements for VMware VirtualCenter and the Pano Manager virtual machine.

Consult the VMware VI3 documentation for complete VirtualCenter requirements. If you choose to run your VirtualCenter as a virtual machine, make sure that you factor VirtualCenter’s resource requirements into that host’s overall capabilities. VirtualCenter is a critical component of the Pano Virtual Desktop Solution and should be allocated sufficient resources. The minimum recommended configuration for running VirtualCenter with the Pano Virtual Desktop Solution is as follows:

- As a minimum, a Pentium IV 2.0 Ghz processor.
- As a minimum 2 GB RAM.

The Pano Manager runs as a virtual machine. You can safely run the Pano Manager on the same host as virtual desktops; however, you should ensure that the Pano Manager’s virtual machine has sufficient resources reserved:

- As a minimum, a Pentium IV 2.0 Ghz processor.
- As a minimum, 1 GB RAM. 2 GB RAM is recommended for deployments of 25 or more desktops.

### Prerequisites

Pano Virtual Desktop Solution requires the following prerequisites:

o For a deployment based on VMware Virtual Infrastructure 3, the following environment must be installed and operational:

- VMware ESX (version 3.5.0, 3.0.2 or 3.0.1)

- VMware patch ESX-1002424 (for ESX 3.0.2) is recommended
- VMware patch ESX-1002093 (for ESX 3.0.1) is recommended

- VMware VirtualCenter (version 2.5, 2.0.2 or 2.0.1)

o The Pano Manager automatically provisions desktops. To utilize these features Microsoft Sysprep tools are required.

- Microsoft Sysprep tools installed on your VirtualCenter server
- A Customization Specification that permits cloned virtual machines to join your AD domain

o Valid licenses for Microsoft desktop operating systems

o Account that has read and write permission in VMware VirtualCenter

o Account that has read permission to your directory service

o Security groups in Active Directory that represent the set of users of the desktop virtual machines (see Chapter 8, Configuring a DVM Collection, for details)

### Supported Desktop Operating Systems

The following section describes the desktop operating systems that are supported by the Pano Virtual Desktop Solution. More specifically, these are the operating systems on which you can install the Pano Desktop Service.

- Windows XP Professional, SP2/SP3 (32-bit)
- Windows Vista Business Edition (32-bit), GA/SP1 - Experimental
- Windows Vista Ultimate Edition (32-bit), GA/SP1 - Experimental

### Supported Directory Services

The following section describes the directory services that are supported by Pano Virtual Desktop Solution.

- Microsoft Active Directory 2003 or higher
- Novell eDirectory
- OpenLDAP

### Compatibility of Pano Components by Version

The following section indicates which versions of Pano components are compatible with each other.

The Pano Manager needs to be the same version or later than the Pano Desktop Services it manages.

Pano Manager v2.0.4 supports the following versions of Pano Desktop Service (Pano DAS):

- Pano DAS v2.0.x
- Pano DAS v1.5.x
- Pano DAS v1.1

The Pano software services (Pano Manager and Pano DAS) are compatible with all released versions of the Pano hardware device.

# Chapter 2 – Concepts

This chapter describes concepts that are central to the Pano Virtual Desktop Solution.

## Desktop Virtual Machine

A desktop virtual machine (DVM) is a virtual machine that runs a desktop operating system such as Windows XP or Vista. DVMs run on top of a virtualized infrastructure hosted on one or more servers. Users connect to DVMs through Pano devices or software-based remote desktop connection clients.

From the perspective of VMware products (ESX and VirtualCenter) there is no distinction or difference between a DVM and a standard virtual machine. The same types of operations that can be performed on a standard virtual machine as can be performed on a DVM. Pano Logic uses the term DVM to specifically refer to virtual machines that are being used as virtual desktops.

## Desktop Virtual Machine Collections

The Pano system introduces the concept of a collection of virtual machines. Rather than manage each DVM individually, you can manage a set of virtual machines as a single logical entity. Such a set of DVMs is called a collection.

Once defined, a collection can be managed as a logical unit. Users of the collection are specified by associating directory objects (groups and users) to the collection via the Pano Management Console. Collections can also be set to grow dynamically as user demand grows.

### Types of Collections

A key characteristic of a collection is the method by which DVMs are assigned. There are two basic methods by which assignments are determined: by user and by device. In user assigned collections, the DVM assignments are based upon the user accessing the system. On the other hand, assignments in device assigned collections are based upon the device that is being used to access the system. In general, user assigned collections are most appropriate when you want users to be able to access their DVMs regardless of location. For instance, if you want your users to be able to roam freely throughout your environment and always have access to their DVM, use one of the user assigned collections. On the other hand, if you want a Pano device to always connect to a specific DVM, select one of the device assigned collections. Details of each collection type are covered in the following two sections.

In addition, a special type of collection is used when Pano VDS is used in conjunction with VMware Virtual Desktop Manager (VDM). Use of VMware VDM with Pano VDS is optional. Refer to Chapter 12, Using Pano VDS with VMware Virtual Desktop Manager for details.

### User Assigned Collections

With user assigned collections, Pano devices display the Pano client login screen whenever the device is not connected to a DVM. Users can enter their credentials at the login screen and be connected to their DVMs. Details of each user assigned collection type follow.

- Pooled Collection

- DVMs are automatically created from a specified template and assigned to users by the Pano Manager. The set of users that are entitled to use the collection is specified in the Users field of the collection properties. Assignment of DVMs is on a per session basis; i.e. as soon as the user’s Windows session ends (by logging out of Windows), the DVM becomes available for another user. Users of a pooled collection will typically run the same set of applications as all other users. Windows roaming profiles and folder redirection can be used to give users a more personalized experience.

- Cloned Collection

- DVMs are automatically created from a specified template and assigned to users by the Pano Manager. The set of users that are entitled to use the collection is specified in the Users field of the collection properties. Once a user is assigned to an available DVM, the user is given the same dedicated DVM every time he/she signs in. Assignment of the user to the DVM is automatically established the first time the user logs in. Alternatively, the administrator can assign a particular DVM to the user through the web interface of the Pano Manager. Cloned collections allow you to leverage automated provisioning, while providing users a dedicated DVM which they can customize and personalize.

- Custom Collection

- DVMs that are part of the VirtualCenter inventory can be manually assigned to users by the Administrator. The set of users that are entitled to use the collection is specified in the Users field of the collection properties. Custom collections are appropriate when you want to establish a dedicated mapping between a user and a pre-existing or special DVM. A single custom collection should contain only one DVM, but you can create multiple Custom Collections.

### Device Assigned Collections

Device assigned collections allow you to assign Pano devices, rather than users, to specified DVMs. This model is useful if you want to implement special usage scenarios, such as a kiosk or shared computer.

A kiosk is commonly defined as a limited purpose computer that supports multiple users. Kiosks are often placed in open locations where users can simply walk up and start using the device, perhaps without providing any credentials. Access without user-supplied credentials is implemented by having the system automatically log into Windows using credentials that are specified in the collection properties. The user experience is such that the user only sees the Windows desktop—they do not see the Pano client login screen or the Windows login screen. The operating system in a kiosk is generally locked down so that users cannot gain access to applications or networks that are restricted. You may find kiosks in public places such as libraries, company break rooms or corporate lobbies.

Creating a device assigned collection is similar to creating a user assigned collection. Device assigned collections take advantage of the automated provisioning features of the Pano Manager, allowing you to create and specify a template, while automating the cloning of new DVMs. Once DVMs have been created, the next step is to assign a device. Device assignment can be performed through the Pano Management Console or by logging in for the first time from a device through the Pano client login. Once assigned, a device will be allowed to connect only to the designated DVM. If you later want to use that device with a user assigned collection, you first will need to unassign the device from the designated DVM.

The three types of device assigned collections are very similar, and only differ in their process of logging into Windows.

If the Pano Device should only connect to a Windows DVM, and not log into the actual DVM (i.e. display the Windows Login prompt), then the Shared User / Device collection type is most appropriate.

However, if automated logon onto the DVMs is desired using the same credentials throughout the collection, the Single User / Device should be used. If the credentials for each automated login are to be unique, the User Group / Device collection should be used.

Additional details for each collection type follow.

- Single User / Device

- DVMs are automatically created from a specified template. Pano devices are assigned to specific DVMs either through the Management Console or by logging in through the device for the first time. As soon as the Pano device comes up on the network and connects with the Pano Manager, the device will automatically connect and log into the assigned DVM. The login credentials for the automatic logon into Windows are identical for each and every DVM in the collection. The account can be a local account or a domain account.

- User Group / Device

- DVMs are automatically created from a specified template. Pano devices are assigned to specific DVMs either through the Management Console or by logging in through the device for the first time. As soon as the Pano device comes up on the network and connects with the Pano Manager, the device will automatically connect and log into the assigned DVM. When automatically logging into Windows, a unique account name and password will be used for each DVM in the collection. The accounts must be domain accounts and they must be members of the same security group.

- Shared User / Device

- DVMs are automatically created from a specified template. Pano devices are assigned to specific DVMs either through the Management Console or by logging in through the device for the first time. As soon as the Pano device comes up on the network and connects with the Pano Manager, the device will automatically connect to the assigned DVM. The user must authenticate in order to log into Windows. Note that Windows allows a Windows login screen to be displayed for only 2 minutes. If a user has not signed into Windows within 2 minutes, the Pano Manager will re-establish a connection with the DVM. This cycle will repeat until a user logs in. Once logged in, the session will remain active until the user logs out or disconnects.

### Organize Collections Using Folders in VirtualCenter

VirtualCenter provides the Virtual Machines & Templates view to organize and manage virtual machines. Collections rely on this organization of folders. For instance, when configuring a collection you specify a folder to contain the virtual machines. Virtual machines that reside in the specified folder will be managed by the Pano Manager. Refer to Chapter 11 Best Practices for tips on how to best organize your folders.

### Automated Deployment

All collection types, except Custom, support automated deployment of virtual machines. The conditions under which new DVMs are automatically deployed are based on user demand and the values that are specified by the administrator when the collection is created or updated. Because deploying a new DVM from a template can take several minutes or more (depending on the size of the template being copied and the storage sub-system), the Pano system can automatically deploy extra DVMs but not assign them to users right away. When a new user signs into the collection he will be automatically assigned to one of the extra DVMs, and the Pano system may then deploy a new DVM to replenish the extra DVMs so future users will not have to wait for a new DVM to be deployed.

The administrator can specify a certain number of extra DVMs that are pre-provisioned. Within this set of extra DVMs, some can be kept powered on for instant access, while others can be powered off to reduce resource utilization, but still provide fast access. The “Extra Powered On” and “Extra Powered Off” values in the collection properties dialog determines how many extra DVMs you want the Pano Manager to maintain for the collection, and whether they should be powered on or off.

If you specify a total of two extra DVMs, the Pano Manager will start deploying a new DVM whenever there are less than two DVMs not assigned to users. If you specify zero extra DVMs, new DVMs will be automatically deployed, but only when a new user logs in. In this case, the user will log into the Pano login screen and will be asked to wait while a new DVM is deployed for them. Once the DVM is ready, the user will be able to complete the login process. Similarly, if you specify and total of two extra DVMs, but have three new users who sign in at the same time, one of the users will have to wait for a new DVM to be deployed.

Automated deployment for a collection can be turned off completely by un-checking the “Deploy Enabled” option in the collections properties.

### DVM Power Management

The Pano Manager has the ability to power DVMs on and off based on policies. By default, the Pano Manager enforces only the policies that turn DVMs on. If you want the Pano Manager to also enforce the policies that turn DVMs off, you will need to check the “Power Off Enabled” option in the collection properties screen.

For the purposes of power management a DVM can be in one of three categories: active, extra or surplus. An active DVM is one that is in use (i.e. a Windows session is in progress) or the DVM has been assigned to a user. Extra DVMs correspond to the “Extra Powered On” and “Extra Powered Off” values specified in the collection properties. Surplus DVMs are DVMs that are over and above Active DVMs plus Extra DVMs. Surplus DVMs are automatically powered off, unless the Power Off option is disabled.

The power management policies are different for each type of DVM collection.

- Pooled, Single User / Device, Shared User / Device and User Group / Device Collections

- Active DVMs are automatically powered on.
- Extra DVMs are automatically managed based on the values specified in “Extra Powered On” and “Extra Powered Off”.
- Surplus DVMs are automatically powered off, unless the Power Off option is disabled.

- Cloned Collection

- The power states of active DVMs (DVMs that have been assigned to users) are not managed by the Pano Manager. The power state of a DVM is controlled by the end user and/or by VirtualCenter. The user of the DVM has the ability to control the power state of the DVM through the Pano Options screen when logging into the system via the Pano Device. Once logged into the DVM, the user can also use the Windows Security dialog box to control the power state of the DVM. A DVM’s power state can also be controlled through VirtualCenter.
- Extra DVMs are automatically managed based on the values specified in “Extra Powered On” and “Extra Powered Off”.
- Surplus DVMs are automatically powered off, unless the Power Off option is disabled.

- Custom Collection

- The power states of DVMs in a custom collection are not managed by the Pano Manager. The power state of a DVM is controlled by the end user and/or by VirtualCenter. The user has the ability to control the power state of the DVM through the Pano Options screen when logging into the system via the Pano Device. Once logged into the DVM, the user can also use the Windows Security dialog box to control the power state of the DVM.

## Automated Provisioning

The Pano Manager leverages VirtualCenter’s ability to clone virtual machines from a template. DVM templates are created within VirtualCenter using the standard VMware procedures. If you are already familiar with how to create templates within VMware, you can continue to use your established procedures. If you are not familiar with how to create templates, you should consult the appropriate VMware documentation http://www.vmware.com/support/pubs/vi_pubs.html. Information about creating templates is available in the chapter titled “Working with Templates and Clones” in the VMware VI3 Basic System Administration guide.

In addition to creating a template, you also need to create a Customization Specification within VirtualCenter. A Customization Specification allows the Windows Sysprep process to be automated as part of the cloning process. Information on Customization Specifications is available in the chapter titled “Customizing Guest Operating Systems” in the VMware VI3 Basic Administration guide.

#

# Chapter 3 – Installation Overview

This chapter provides an outline of the steps required to install the Pano Virtual Desktop Solution. You can use this chapter to organize your overall deployment and refer to additional chapters for details on how to perform each task.

o Review system requirements and prerequisites (Chapter 1, System Requirements)

o Understand Pano concepts (Chapter 2)

o Setup virtual infrastructure (Chapter 4)

o VMware ESX 3.5 & VirtualCenter 2.5

o Install Pano Manager (Chapter 5)

o Install Pano Manager virtual machine

o Configure Pano Manager virtual machine

o Change superuser password

o Change web admin password

o Perform one-time setup of Pano Manager (Chapter 6)

o Setup virtualization integration

o Setup directory integration

o Setup Pano device discovery (Appendix A)

o Reserve resources for Pano Manager virtual machine

o Prepare for Automated Provisioning (Chapter 7)

o Create virtual machine

o Install Windows desktop operating system

o Configure Windows for remote desktop connections

o Install Pano Desktop Service

o Install Pano Generic USB Support (Appendix D)

o Configure video display for 24-bit color depth (Appendix E)

o Configure firewall (Appendix B)

o Install application software

o Convert to template

o Create customization specification

o Deploy from template

o Validate desktop virtual machine setup

o Setup DVM Collections (Chapter 8)

o Create DVM collection

o Using and Managing Desktop Virtual Machines

o Connect Pano devices to network

o Monitor DVM status (Chapter 9)

o Login to DVM via Pano device

o Login to DVM via Pano web client

o Set user preferences (Chapter 10)

o Best Practices (Chapter 11)

o Organizing Folders in VirtualCenter

o Refreshing a Pooled Collection

# Chapter 4 – Setting Up Virtual Infrastructure

## VMware Virtual Infrastructure 3

To run the Pano Virtual Desktop Solution on top of VMware VI3, follow the installation instructions provided by VMware at http://www.vmware.com/support/pubs/vi_pubs.html.

Once you have performed a basic installation of VMware ESX 3.5 and VirtualCenter 2.5, you can proceed with installing the Pano Manager virtual machine described in the next chapter.

# Chapter 5 – Installing and Configuring the Pano Manager Virtual Machine

The Pano Manager is delivered as a virtual appliance. This means that the Pano Manager runs within a virtual machine hosted on your virtual infrastructure. The Pano Manager virtual machine can run on the same host as desktop virtual machines; it can also run on the same host as VMware VirtualCenter. Use VMware resource pools and reservations to ensure that the Pano Manager virtual machine is allocated sufficient resources.

- As a minimum, a Pentium IV 2.0 Ghz processor.
- As a minimum 1 GB RAM. 2 GB RAM is recommended for deployments of 25 or more desktops.

## Installing Pano Manager on VMware VI3

Install the Pano Manager virtual machine by following these steps:

1. From a Windows computer, copy the file named PanoManagementServer-2.0.4.tar.gz from the Pano media disk or download package to a local file system.

2. Use the VMware console or ssh to the ESX host that will host the Pano Manager. (If using ssh, the ESX must first be configured to allow ssh access to the service console. See Appendix J for instructions on how to enable this feature.)

3. Create a working directory into which the compressed file can be copied. For example:

mkdir /vmfs/volumes/storage1/PanoMS-tgz/

4. Use scp to copy the PanoManagementServer-2.0.4.tar.gz supplied by Pano Logic locally onto the host. The Pano Manager files will be extracted from this location to the vmfs that will contain the Pano Manager. For example:

scp PanoManagementServer-2.0.4.tar.gz

root@esxhost:/vmfs/volumes/storage1/PanoMS-tgz/

5. Extract the contents the above tarball to the desired directory using:

tar -xzvf PanoManagementServer-2.0.4.tar.gz

The extraction process typically takes 5-10 minutes and the resulting files total about 15GB.

6. Use the Virtual Infrastructure client to connect to the ESX host.

7. Select the host by clicking on it on the left browse pane.

8. Click the Configuration Tab and select Storage on the left pane to navigate to the datastore that contains the copied files.

9. Right click on the datastore and select Browse.

10. Browse to the directory containing MS files.

11. Right click on the PanoMangementServer.vmx and select "Add to inventory". Follow the onscreen prompts.

12. To power on the Pano Manager, right click on the VM in the left pane of VirtualCenter and select "Power On".

## Configuring Pano Manager Virtual Machine

The Pano Manager includes a simple text-based user interface that allows you to perform the limited set of configuration options for the Pano Manager. With this text-based UI you can:

§ Configure network settings

§ Set the superuser (root) password

§ Set the web admin password

### Set Superuser Password

This option allows you to change the password for the superuser (root) account, which is the default account to use when first logging into the Pano Manager virtual machine’s console. The default password for the “root” account is “password”.

Note: You should change this password to a secure value as soon as possible. Also, you should refrain from logging into the Pano Management Console with the root account; rather, you should use the “admin” account.

### Set Web Admin Password

This option allows you to change the password for the “admin” account, which is the default account to use when logging into the Pano Management Console. The default password for the “admin” account is “zerotouch.”

Note: You should change this password to a secure value as soon as possible.

### Updating VMware Tools

The Pano Manager virtual machine ships with a version of VMware Tools installed. You should keep VMware Tools up to date on this virtual machine.

To check the status of VMware Tools on the Pano Manager virtual machine perform the following steps:

1. Log into VirtualCenter
2. Select View | Inventory | Hosts & Clusters
3. Click on the Pano Manager virtual machine
4. The Summary tab will display the current status VMware Tools

To install or update VMware Tools on the Pano Manager virtual machine, perform the following steps:

1. Ensure that the Pano Manager virtual machine has a DVD/CDROM device. Consult the section titled “Adding Hardware” in the VMware Basic System Administration guide for instructions on adding hardware devices.
2. Using the Virtual Infrastructure Client, connect to VirtualCenter or the ESX host to access the Pano Manager virtual machine.
3. Right-click the Pano Manager virtual machine and choose Install VMware tools.

The remaining steps take place inside the virtual machine.

4. Open a console to the virtual machine
5. Log in as root (default root password is “password”, but should be changed as soon as possible. See Set Superuser Password.)
6. At the Pano Manager main menu, select option 4 – Drop to bash shell (Power Users)
7. As root, mount the VMware Tools virtual CD-ROM image and change to a working directory (for example, /tmp), as follows.

mount /dev/cdrom /mnt/cdrom

cd /tmp

8. Uncompress the installer and unmount the CD-ROM image.

tar -zxf /mnt/cdrom/VMwareTools-x.x.x-<xxxx>.tar.gz

umount /dev/cdrom

Where x.x.x-<xxxx> is the build/revision number of the VMware Tools release.

9. Run the VMware Tools tar installer for the appropriate version of ESX.

For ESX 3.5 execute:

cd vmware-tools-distrib

./vmware-install.pl

For ESX 3.0.x execute:

cd vmware-tools-distrib

./vmware-config-tools.pl

Respond to the configuration questions on the screen by pressing Enter to accept each default value.

10. Log off the root account.

exit

### Reserving Resources for the Pano Manager VM

The Pano Manager virtual machine must have sufficient CPU and memory resources available to run effectively. It is recommended that you set reservations for both CPU and memory to ensure that the Pano Manager VM always has a minimum amount of resources available. The amount of resources consumed by the Pano Manager virtual machine will likely vary throughout the day based on your usage patterns. The Pano Manager virtual machine consumes the most resources when Pano devices are displaying the Pano login screen. Once users have connected to their desktop virtual machine, the Pano Manager incurs practically no load for that device or DVM.

The following recommendations should be sufficient for deployments of up to 100 Pano devices:

1. Reserve at least 512MHz of CPU
2. Reserve at least 1024MB of memory
3. Do not set a maximum limit for CPU or memory. This will allow the Pano Manager to use additional available resources as needed when the number of Pano login screens being displayed spikes.

The following recommendations are appropriate for deployments greater than 100 Pano devices:

1. Estimate the number of Pano devices that will be displaying the Pano login screen at any one time during business operating hours.
2. Reserve 5MHz of CPU for the number of Pano devices determined in Step 1. At a minimum reserve 512MHz.
3. Reserve 5MB of memory for the number of Pano devices determined in Step 1. At a minimum, reserve 1024MB.
4. Do not set a maximum limit for CPU or memory. This will allow the Pano Manager to use additional available resources as needed when the number of Pano login screens being displayed spikes.

# Chapter 6 – Pano Manager One-Time Setup

Once the Pano Manager virtual machine has been installed and configured, you can perform the following one-time setup tasks using the Pano Management Console:

- Connect the Pano Manager to your directory service.
- Connect the Pano Manager to your virtual infrastructure manager.
- (Optional) Connect the Pano Manager to VMware Virtual Desktop Manager.
- Select the method for discovering Pano devices on your network.

## Prerequisites

Before you begin setup of the Pano Manager, you need to satisfy the following prerequisites:

- Identify an account for the Pano Manager to use to query your directory service. The account needs to be able to read the portions of the directory that contain the directory objects (users and groups) for the users of the Pano system.
- Identify an account for the Pano Manager to use to integrate with the VirtualCenter that manages the virtual infrastructure underlying your Pano system. This account needs to have Administrator permissions in VirtualCenter.

## Pano Management Console Login

Go to the following URL to launch the Pano Management Console:

http://<hostname or ipaddress>/admin.jsp, where <hostname or ipaddress> is the hostname or IP address of the Pano Manager virtual machine.

Note: The default user name for the Pano administrator account is “admin” and the default password is “zerotouch”. You should change this account’s password through the Pano Manager virtual machine console. See the section titled “Configuring Pano Manager Virtual Machine” for details.

## Setup Directory Service Integration

You need to setup the Pano Manager to read your directory service. When connecting to your directory service, you have the ability to specify a specific server or, if you are using Active Directory, you can let DNS determine the domain controller.

To specify the specific domain controller or LDAP server, enter a URL of the form:

ldaps://<server_name_or_IP_address>

Example:

ldaps://dirserver1.yourdomain.com

Recommended method when using Active Directory: If you are using Active Directory you will get the best performance by specifying a domain controller that is a global catalog server. By default the Global Catalog runs on port 3268 in unencrypted mode and on 3269 in encrypted mode. Therefore the URL is ldaps://dirserver1.yourdomain.com:3269 for encrypted mode and ldap://dirserver1.yourdomain.com:3268 for unencrypted mode. Please consult your Active Directory administrator if the Global Catalog runs on a different server or if it is configured to run on a different port.

If you are using Active Directory and want to have DNS determine the domain controller, enter a URL of the form:

ldaps:///<distinguished_name_of_the_domain>

Example:

ldaps:///dc=yourdomain,dc=com

On the Setup tab enter the following information in the Directory Configuration area.

1. Enter the URL for the directory service:

a. A list of URLs can be supplied (separated by spaces) and they will be tried in order. The first successful connection will be used.

b. While connecting via ldaps is recommended for security, connections via ldap are also supported. Example:

ldap://dirserver1.yourdomain.com

c. The directory server is queried for the default naming context that will be used for queries. If you need to use a different naming context then it can be specified after the host name in the URL. Example: ldaps://dc1.yourdomain.com/dc=yourdomain,dc=com

2. Enter the user principal name (UPN) of the account to be used to connect to the directory server. The UPN is an internet-style login name for the user. The account needs to have read access to all portions of the directory used to authenticate users of the DVMs. Example: panomansvr@yourdomain.com
3. Enter the above account’s password.

Here is an example of a typical Directory Configuration:

Here is an example of a Directory Configuration when using Novell eDirectory:

4. Click Configure.
5. When connected, you can browse the virtualization hierarchy to confirm that the account has the proper access privileges by clicking the Browse button for the Directory Configuration area. In case of connection errors, details can be found under the Log tab or by hovering over the connection status field on the Setup tab.
6. NOTE: If using Active Directory and the directory hierarchy does not get displayed, check under the log tab to see if there is any error. An exception message like the following might be present:

2007-12-21T21:39:28.501Z SEVERE Unexpected Exception: javax.naming.PartialResultException: {1}.

javax.naming.PartialResultException [Root exception is javax.naming.CommunicationException: ds.local:389 [Root exception is java.net.UnknownHostException: ds.local]] ………..

This error normally happens if the Pano Manager cannot reach the domain that is configured or the domain controller cannot communicate to another domain controller it was referred to during the communication over LDAP.

The solution is to specify the Global Catalog in the URL field. By default the Global Catalog runs on port 3268 in unencrypted mode and on 3269 in encrypted mode. Therefore the URL is ldaps://dirserver1.yourdomain.com:3269 for encrypted mode and ldap://dirserver1.yourdomain.com:3268 for unencrypted mode.

Please consult your Active Directory administrator if the Global Catalog runs on a different server or if it is configured to run on a different port.

Tip: When using directory services other than Microsoft Active Directory the following apply:

§ Security group membership is tested using the persons ‘groupMembership’ attribute. If this attribute is not present then group membership will be tested using the groups ‘member’ attribute.

§ The persons ‘uid’ attribute is used for authentication.

Tip: To help troubleshoot configuration issues, the host URL and the following Root DSE attributes are written to the log after connecting:

§ supportedLDAPVersion

§ namingContexts

§ defaultNamingContext

§ configurationNamingContext

§ supportedCapabilities

§ supportedControl

For additional information on using the Pano Manager logs, see Appendix G.

## Virtualization Configuration

You need to setup the Pano Manager to communicate with VMware VirtualCenter in order to use the Pano Manager’s connection brokering and automated deployment features. On the Setup tab enter the following information in the Virtualization Configuration area.

1. Enter the URL for the VirtualCenter interface:

§ For VirtualCenter 2.x, enter a URL of the form: http[s]://host/sdk

o Example: https://vcserver/sdk

2. Enter the user name of the account in VirtualCenter. This account will be used to communicate to VirtualCenter. It is recommended that this account be different from the console account to ease the reading of the the logs in VirtualCenter.
3. Enter the above account’s password.

4. Click Configure.
5. When connected, you can browse the virtualization hierarchy to confirm that the account has the proper access privileges by clicking the Browse button in the Virtualization Configuration area.

Note: For the Pano Manager to communicate with Virtual Center, it is necessary that the VirtualCenter web service be installed and running.

## Setup Pano Device Discovery

Pano devices need to be discovered before they can be controlled by the Pano Manager. There are multiple ways that discovery can happen. In a small deployment or during a trial, one of the broadcast or probe methods may be best. For larger scale production deployments, DHCP assisted discovery may be best.

Steps for configuring DHCP to assist in discovery are covered in Appendix A.

If you decide to implement one of the broadcast or probe based methods, you will need to enter discovery parameters in the Discovery Configuration area on the Pano Devices page.

Note: If you decide to rely on DHCP for discovery, you do not need to enter any information in the Discovery Configuration area. Refer to Appendix A for details.

### Enable Local Broadcast

Select the check box for this option if your Pano Manager and Pano devices are located on the same subnet. When you enable this option, the Pano Manager periodically broadcasts packets on the local subnet to discover new Pano devices.

### Remote Broadcast Networks

Use this option when your Pano devices are located on multiple subnets of your network. Enter a space-separated list of subnets. For example:

192.168.1.255 191.255.255.255

Note: Subnet IP addresses must end with a value of 255.

Note: Avoid entering an overly broad range of addresses as that will cause additional unnecessary broadcasts on your network.

### Probe Address Ranges

Use this option when you want to specify a range of IP addresses in which the Pano Manager can probe for Pano devices. Enter a dash-separated range of addresses. For example:

10.0.32.100-10.0.32.199

To specify more than one range of addresses to probe, separate the entries with a space. For example:

10.0.32.100-10.0.32.199 10.0.45.1-10.0.45.99

You can use any IP address in this option.

Note: Avoid entering an overly broad range of addresses as that will cause additional unnecessary broadcasts on your network.

### DHCP Assisted Discovery

Besides the above options, you can configure DHCP to provide the IP address of the Pano Manager virtual machine. Instructions for configuring this method are described in Appendix A.

# Chapter 7 – Prerequisites for Automated Provisioning

Before creating a Cloned or Pooled Collection, you need to prepare for automated provisioning. Where operations in VirtualCenter are required, refer to the VMware documentation for specific steps.

Identify the base desktop virtual machine you want to deploy to users, and make sure that the following prerequisites are in place on that virtual machine:

- Install the latest operating systems and application Service Packs and patches.
- Install the latest VMware Tools (provided with VI3)
- Make sure that network settings (firewalls, proxies, etc.) are properly configured in the desktop virtual machine.
- Make sure that the desktop virtual machine is enabled for Remote Desktop.
- Make sure that the user(s) of the desktop virtual machine are added to the Remote Desktop Users Group for that computer.
- Install the Pano Desktop Service.
- If you want users to use USB devices beyond keyboards and mice (e.g. USB Mass Storage devices), install the Pano Dynamic USB Bus Enumerator as described in Appendix D.

### Recommended Windows Patches

The hot fix described in Microsoft knowledge base item KB886199 is needed to play audio reliably from a desktop virtual machine.

### Install VMware Tools

For instructions on installing VMware Tools, see the chapter titled “Installing and Upgrading VMware Tools” in the VMware Basic System Administration guide.

Note: VMware recommends that VMware Tools Time Synchronization be deselected.

### Firewall Settings

The Pano Desktop Service communicates with the Pano Manager and Pano devices over certain network ports. If there is a firewall on the DVM, it needs to be configured to allow communication over certain ports. Detailed instructions on how to use Group Policy to configure the Windows firewall for use with Pano are included in Appendix B.

### Enable Remote Desktop and Set Remote Desktop Users

1. Log into the Desktop Virtual Machine.
2. Open the System Properties dialog by right-clicking on My Computer and selecting Properties.
3. Select the Remote tab.
4. Select the check box labeled Allow users to connect remotely to this computer.
5. Click the button labeled Select Remote Users…
6. Click Add… to select the desired set of users. Any user who will connect to a DVM in this template’s collection needs to be added.
7. Once all users have been specified, close the Remote Desktop Users dialog by clicking OK.
8. On the System Properties dialog click Apply.
9. Click OK.

### Install Pano Desktop Service

Note: If you plan to allow redirection of advanced USB devices such as printers, scanners or mass storage, you first need to ensure that the Windows USB driver (usbd.sys) is installed on your virtual machine or template. The usbd.sys driver is not typically installed when a virtual machine is built. Follow the steps outlined in Appendix D, Installing USB Peripheral Support for assistance on locating and installing the USBD.SYS file.

1. Copy the Pano Desktop Service installer file (PanoDAS.msi) from the Pano media disk or download package to the DVM’s local drive.

2. Make sure you have administrative rights to the desktop virtual machine.

3. Run PanoDAS.msi.

4. The Pano Desktop Additions Wizard opens.

5. Click Next.

6. Read the End User License Agreement. Select the checkbox if you agree to abide by the terms of the agreement.

7. Click Next.

8. Choose the setup type. A Typical setup includes support for using USB devices such as printers, scanners and mass storage. If you wish to exclude support for such USB devices, select a Custom setup and deselect the “Drivers” component.

9. Click Install.

10. Click Finish.

### Create a DVM Template and Customization Specification

You must create a DVM template to user cloned or pooled collections.

1. In VirtualCenter, convert the desktop virtual machine into a template.
2. In VirtualCenter, create a guest customization specification.

1. The specification should use DHCP and the computer name should be set to the virtual machine name. Cloned virtual machines should also be able to join domains.

### Test Deployment and Remote Desktop Connection

As a test, deploy a DVM from the template to validate that customization is successful. Make sure that the DVM joins the domain successfully and that you can successfully connect to the DVM remotely through the Windows Remote Desktop Connection client.

# Chapter 8 - Configuring a DVM Collection

After you have performed the one-time setup of the Pano Manager and you have completed the prerequisites for automated deployment, your next step is to set up your DVM collections.

## How to Setup a DVM Collection

1. In the Pano management console, click the DVM Collections tab.

2. Click Add.

3. The “Add DVM Collection” screen appears.

4. Type: Select the type for the DVM collection (different options are subsequently displayed depending on the type you select; see Chapter 2, Desktop Virtual Machine Collections for details on each type):

§ Pool

§ Cloned

§ Custom

§ Shared User / Device

§ Single User / Device

§ User Group / Device

§ VMware VDM

5. Name: Enter a name for the DVM collection. For all collections except Custom, this name is used to generate the name for DVMs that are automatically provisioned. An alphanumeric ID is appended to the root to generate a unique name for each DVM.

6. Users: Click the browse button (…) to find the directory objects to which you want to give access to the DVM collection. You can select security groups, users and organizational units. Select the object(s), and then click OK. You may want to type in the name directly in the Users: field, especially if you have a large number of directory objects.

7. Password: This field is used only with the Single User / Device collection type to specify the password of the account used to automatically log into Windows.

8. Device Restriction: This field is used with any collection type to specify the set of devices that are allowed to access this collection. Leave this field blank if you want to allow a user to access the collection from any Pano device. If you want to restrict access, enter a search string (e.g. PanoFirstFloor*) that matches the names of the Pano devices that must be used to access this collection. See Working with Device Restrictions for details.

9. DVMs Folder: Browse to find the VirtualCenter folder that contains the DVMs for this collection. Select the folder, and then click OK. NOTE: Any virtual machine that resides n this folder will have its power state managed by the Pano Manager. For this reason, do not place the Pano Manager virtual machine into the folder specified by this field. See Organizing Folders in VirtualCenter for best practices in creating a folder structure.

10. DVM Template: (Pool or Cloned) Browse to find the DVM template you want to use to configure new DVMs that are added to the collection. Select the template, and then click OK.

11. DVM Customization: (Pool or Cloned) Browse to find the DVM customization script you want to use to customize new DVMs that are added to the collection.

12. Resource Pool: Optionally select the resource pool(s) from which CPU and memory resources should be allocated for new DVMs. See the section titled “Deployment Resources” below for additional information.

13. Datastore: Optionally select the datastores on which you want DVMs to be created. See the section titled “Deployment Resources” below for additional information.

14. Extra Powered On: Enter the number of unassigned DVMs that should be pre-provisioned and powered on. As DVMs are assigned, the system powers on or creates another to take its place in order to maintain this number of extras.

15. Extra Powered Off: Enter the number of unassigned DVMs that should be pre-provisioned and powered off. As DVMs are assigned, the system creates another to take its place in order to maintain this number of extras.

16. Power Off Enabled: When checked, the Pano Manager will automatically power off DVMs that are not needed. For details on how the Pano Manager manages power states, see DVM Power Management.

17. Deploy Enabled: When checked, automated provisioning of new DVMs is enabled. When unchecked, new DVMs will not be deployed by the Pano Manager.

18. Trash Enabled: When checked, users are able to have their DVM moved to a trash folder and can then be assigned a new DVM. This feature is only applicable to cloned collections.

19. Login Enabled: When checked, users that are entitled to the collection are allowed to log in. When unchecked, new logins will not be possible from a Pano device or the Pano web client.

20. Click Add DVM Collection to create the new collection.

### Deployment Resources

You can optionally constrain the resource pools and datastores that will be used for deploying DVMs. These features are only supported when using VirtualCenter 2.x.

If you do not specify a set of resource pools to use, then all root resource pools will be used. If you do not specify a set of datastores to use, then all datastores will be used. When there are multiple resource pools, the Pano Manager will select the resource pool with the most unreserved CPU.

When there are multiple datastores accessible from the selected resource pool, the Pano Manager will select the datastore with the most free space.

Note that VirtualCenter requires a datastore to be specified even when using a resource pool that is part of a cluster. In that case you should specify the SAN/NAS datastore that should be used. If you do not, then the Pano Manager will choose the largest datastore in the cluster. If that datastore is local to a single host, then only that host within the cluster will be used.

Always specify the correct resource requirements for templates. If you do not, hosts can be over-provisioned and your DVMs will perform poorly.

The Pano Manager will keep at least 512MB of memory free in a resource pool. This avoids problems with VirtualCenter where it may complete deployment, but not have enough memory to power on the DVM.

Example 1: Single Host Dedicated to Pano - do not specify resource pools or datastores.

Example 2: Multiple Hosts Dedicated to Pano - do not specify resource pools or datastores. The Pano Manager will automatically distribute the DVMs across all hosts.

Example 3: Multiple Hosts shared with Pano and other applications - create a resource pool within a cluster for Pano use. Specify the Pano resource pool and the appropriate SAN/NAS datastore.

### Log Messages Related to Deployment Resources

When deployment fails due to unavailable resources a message is written to the Pano Manager log indicating the resources that should be checked for each resource pool. You can find the log by logging in the Pano Manager web login, and checking the Log tab.

### Editing a DVM Collection

To edit an existing DVM Collection:

1. Select the collection in the list, then click Edit.

2. Edit the information you provided when you added the collection. When you have finished your changes, click Update DVM Collection.

### Removing a DVM Collection

To remove a DVM Collection:

Select the collection in the list, and then click Remove. Removing a DVM collection does not delete the virtual machines from the virtual infrastructure.

## Working with Single User / Device Collections

The following section outlines the steps to follow when setting up Pano devices to work with Single User / Device collections.

### Setting up Single User / Device Collection

The first task is to set up a collection. When you create the collection, you must specify the user account and password that will be used when automatically logging into the collection.

1. Navigate to the DVM Collections tab in the Pano Management Console.

2. Click the Add button.

3. In the Type field, select Single User / Device.

4. In the Name field, enter the name for the new collection.

5. In the Users field, specify the account to use for automatic logon. If you are using a local account, type the name of the account into the field (e.g. localuser01). If you are using a domain account, type the name of the account into the field or use the browser to select a user (e.g. kioskuser01@domain.com).

6. In the Password field, type the password for the account specified in the above Users field.

7. The Device Restriction field should be left blank.

8. The rest of the fields relate to automated provisioning and can be configured as described in How to Setup a DVM Collection.

9. Click the Add DVM Collection button to create the collection.

The next task is to assign Pano devices to specific DVMs. You can do this only via the Pano Management Console.

### Assigning Devices via Pano Management Console

To assign a Pano device to a DVM from a Single User / Device collection using the Pano Manager, perform the following steps for each device:

1. Navigate to the DVMs tab in the Pano Management Console

2. Highlight the desired DVM in the list

3. Click the Assign button

4. Select the desired Pano device from the list

5. Click OK

The assigned device will be displayed in the Device column on the same row as the DVM. An icon in the shape of a padlock will be displayed next to the device name when the device is assigned.

## Working with User Group / Device Collections

The following section outlines the steps to follow when setting up Pano devices to work with User Group / Device collections.

### Setting up User Group / Device Collection

The first task is to set up a collection. When you create the collection, you must specify the user group that will be used when automatically logging into the collection.

1. Navigate to the DVM Collections tab in the Pano Management Console

2. Click the Add button.

3. In the Type field, select User Group / Device.

4. In the Name field, enter the name for the new collection.

5. In the Users field, specify the user group that contains the accounts to be used for automatic logon. You can type the name of the group (e.g. kioskgroup@domain.com) or you can use the browser and select the group from the directory hierarchy.

6. The Password field and the Device Restriction fields should be left blank.

7. The rest of the fields relate to automated provisioning and can be configured as described in How to Setup a DVM Collection.

8. Click the Add DVM Collection button to create the collection.

The next task is to assign Pano devices to specific DVMs. You can do this via the Pano Management Console or by logging in from the device.

### Assigning Devices via Pano Management Console

To assign a Pano device to a DVM from a User Group / Device collection using the Pano Manager, perform the following steps for each device:

1. Navigate to the DVMs tab in the Pano Management Console.

2. Highlight the desired DVM in the list.

3. Click the Assign button.

4. Select the desired Pano device from the list.

5. In the User field, specify the user account to be used for automatic login. The user account must be a member of the user group that was specified when the collection was created.

6. In the Password field, type the password for the user account.

7. Click OK.

The assigned device will be displayed in the Device column on the same row as the DVM. An icon in the shape of a padlock will be displayed next to the device name when the device is assigned.

### Assigning Devices by Logging in from the Device

An alternative to using the Pano Management Console to assign devices, you can log into the device at the Pano client login screen and create the assignment automatically. To do this, perform the following steps for each device:

1. Connect the Pano device to the network.

2. At the Pano client login screen enter the credentials for one of the user accounts within the user group that was specified when the collection was created.

3. The Pano Manager will select an available DVM from the collection and assign the current Pano device to that DVM.

4. Log out of the DVM and confirm that the device now automatically logs into the same DVM.

## Working with Shared User / Device Collections

The following section outlines the steps to follow when setting up Pano devices to work with Shared User / Device collections.

### Setting up User Group / Device Collection

The first task is to set up a collection. When you create the collection, you must specify the user group that will be used when automatically logging into the collection.

1. Navigate to the DVM Collections tab in the Pano Management Console.

2. Click the Add button.

3. In the Type field, select Shared User / Device.

4. In the Name field, enter the name for the new collection.

5. In the Users field, specify a user account. This user account is needed to help set up assignments. The account must be a domain account, but it does not need to map to real (human) user. Setting up a new user account just for this purpose is recommended.

6. In the Password field, enter the password for the account specified in the Users field.

7. The Device Restriction field should be left blank.

8. The rest of the fields relate to automated provisioning and can be configured as described in How to Setup a DVM Collection.

9. Click the Add DVM Collection button to create the collection.

The next task is to assign Pano devices to specific DVMs. You can do this via the Pano Management Console or by logging in from the device.

### Assigning Devices via Pano Management Console

To assign a Pano device to a DVM from a User Group / Device collection using the Pano Manager, perform the following steps for each device:

1. Navigate to the DVMs tab in the Pano Management Console.

2. Highlight the desired DVM in the list.

3. Click the Assign button.

4. Select the desired Pano device from the list.

5. Click OK.

The assigned device will be displayed in the Device column on the same row as the DVM. An icon in the shape of a padlock will be displayed next to the device name when the device is assigned.

### Assigning Devices by Logging in from the Device

As an alternative to using the Pano Management Console to assign devices, you can log into the device at the Pano client login screen and create the assignment automatically. To do this, perform the following steps for each device:

1. Connect the Pano device to the network.

2. At the Pano client login screen enter the credentials of the user account you specified when the collection was created.

3. The Pano Manager will select an available DVM from the collection and assign the current Pano device to that DVM.

4. Disconnect from the DVM and confirm that the device now automatically connects to the same DVM.

## Working with Device Restrictions

Device restrictions can be used with any type of collection; however, the use cases are slightly different when comparing user assigned collection types from device assigned collection types.

### Device Restrictions and User Assigned Collections

You may find that combining a user assigned model (i.e. pooled, cloned or custom) with device restrictions is useful, particularly if you want to allow users to roam only within a subset of your overall environment. A good example of such a use case is within a hospital that must restrict access to patient records based on the physical location of the user (a nurse) and the patient. In a simple scenario, a hospital may wish to implement a policy that allows nurses to access only records from patients on the same floor as the nurse. Within that floor, the nurse should be free to roam among multiple Pano devices; but if the nurse moves to a different floor, she should no longer access information from the previous floor. Such a policy can be supported by creating a separate pooled collection for each floor of the hospital. Nurses can be entitled to use some or all of these collections. In addition, the administrator can specify that DVMS in the collection can only be accessed from a specified set of Pano devices. The result is that a nurse who uses a Pano device on floor 2 will be assigned to a DVM from the collection that corresponds to floor 2. The administrator needs to have configured the DVMs within the collection to access only the authorized data. This is done using a 3rd party access management solution.

Note that Device Restriction is a property of the collection, not the device. While Device Restriction limits the devices from which a specified collection can be accessed, it does not limit the collections to which the device may potentially connect.

The section titled Setting up the collection with Device Restrictions outlines the steps to follow when setting up a configuration that utilizes a user assigned collection with the Device Restrictions feature.

### Device Restrictions and Device Assigned Collections

You can also set Device Restrictions for device assigned collections (i.e. Single User / Device, User Group / Device and Single User / Device). You would set Device Restrictions if you wanted to prevent a user from inadvertently establishing an assignment between a device and a device assigned collection. For instance, you may have created a Single User /Device collection. One way to assign a device to such a collection is to log into an unassigned Pano device using the credentials of the specified user. If you have setup Device Restrictions as part of the collection property, you can prevent someone from logging into the collection and establishing the assignment with an unauthorized device.

### Setting up the Collection with Device Restrictions

You can specify device restrictions for any type of collection. The Device Restrictions field identifies the devices that are allowed to access the collection.

The easiest way to manage device restrictions is to edit the names of your Pano devices (see Editing Pano Device Information). If you wish to restrict access from the Pano devices on the 1st floor to a given collection, then rename all such Pano devices that are physically installed on the 1st floor to something like PanoFirstFloor01, PanoFirstFloor02, PanoFirstFloor03, etc.

When you create the collection or edit the collection’s properties, specify a search string in the Device Restrictions field. Continuing the example, enter PanoFirstFloor* as the search string.

If you add new Pano devices to your network and you want them to access the restricted collection, make sure to edit the name of the Pano device. Similarly, if you change the physical location of the Pano device and no longer want it used to access the restricted collection, change the name of the Pano device.

# Chapter 9 - Monitoring DVM Status

You can use the stacked-bar chart at the bottom of the DVM Collections tab to monitor and track the utilization of DVMs within each collection.

Select a collection from the list to display the chart for that collection.

Each bar represents a two-hour period, and the height of the bar reflects the total number of DVMs in the collection.

Each section of the bar represents the number of DVMs in a particular state:

Bar Color | DVM State | Description
White | Suspended | The DVM is suspended, not powered on, or the Pano Desktop Service is not reachable.
Green | Ready | The DVM is powered on and the Pano Desktop Service is reachable. The DVM is available to be assigned to a user.
Gray | Assigned/idle | The DVM is assigned to a user, but the user is not logged in.
Red | Waiting | The DVM is unavailable when a user attempts to log in.

## Monitoring Status of Individual DVMs

You use the DVMs tab to:

§ Monitor DVMs

§ Unassign a user from a DVM

§ Assign a user to a DVM

The following columns of information are available on the DVM Collections tab:

Column Name | Contents
Virtual Machine Name | Name of the DVM
DVM State | Power status of the DVM (PoweredOn, PoweredOff)
IP Address | IP address of the DVM
DNS Name | DNS name of the DVM
DAS Status | Status of the DVM as known to the Pano Manager: § Unreachable § Connected § Responding
DAS Version | Version number of the Pano Desktop Service installed in the DVM
Assigned User | User assigned to the DVM
Logged In User | User who is logged in to the DVM
Client | Pano device through which connection is made to the DVM
Virtual Machine Path | The VirtualCenter path to the DVM

## Managing Assignments

Assignments happen between users and DVMs or between devices and DVMs.

### Understanding User Assignment

In pooled and cloned collections, users are assigned to a specific DVM. (Users are not assigned to DVMs that are part of a custom collection.) Assignment happens automatically and works differently for pooled and cloned collections.

For a pooled collection, a user is automatically assigned to a DVM each time a new Windows session is started. The assignment lasts until the user logs out of Windows. If a user merely disconnects from their session, the assignment remains active so that the user can log back in from the same or different Pano Device or software client.

For a cloned collection, a user is automatically assigned to a specific DVM the first time they access the collection. The initial assignment lasts indefinitely until an administrator manually removes the assignment via the Unassign operation.

In some cases you may wish to manually assign a user to a specific DVM prior to the user logging in. For instance, you may want to assign a DVM to a new employee before they start work and perform some special customization for them ahead of time. Use the Assign operation to accomplish this task.

### Manually Assigning a User to a DVM

To manually assign a user to a DVM:

Select the DVM from the list, and then click Assign. Select the desired user object from the directory hierarchy. The DVM is now assigned to that user. If the DVM is a member of a pooled collection, the assignment will last until the user logs off Windows. If the DVM is a member of a cloned collection, the assignment will last until the assignment is manually removed, or the DVM is moved to trash.

### Unassigning a User from a DVM

To unassign a user from a DVM:

Select the DVM from the list, and then click Unassign. The DVM is now available to be assigned to another user.

### Understanding Device Assignment

In device assigned collections (Single User / Device, Shared User / Device, User Group / Device) devices are assigned to specific DVMs. Assignment happens automatically the first time a user logs into the DVM or assignment can be done manually through the DVMs tab on the Pano Management Console.

### Manually Assigning a Device to a DVM

To manually assign a device to a DVM:

Select the DVM from the list, and then click Assign. Select the desired Pano device from the list. The list does not include Pano devices that have already been assigned to DVMs, so if your desired device is not listed you may have to unassign it from another DVM first. The assignment will last until the device is manually unassigned from the DVM.

### Unassigning a Device from a DVM

To unassign a device from a DVM:

Select the DVM from the list, and then click Unassign. The DVM is now available to be assigned to another device.

## Choosing a DVM Collection Type

### Pooled Collection

Pooled collections are most appropriate for a set of users that all use the same set of applications. By using Windows roaming profiles and document redirection, you can allow users of pooled collections to have some degree of personalization. The size of users’ profiles should be kept small in order to keep login times short.

An example where this type of collection may be used is a Call Center environment. All users would have the same configuration for their machines, which are not assigned to them permanently.

### Cloned Collection

Cloned collections are appropriate for users that can benefit from starting with a standard image, but require the ability to customize their computer or save files locally.

This would be the most commonly used collection type for a typical office environment where the user’s PCs were being replaced by Panos.

### Custom Collection

Custom collections are appropriate when you want to create a one-to-one mapping between a user and a DVM that has been created through some other process than Pano’s automated process. Each custom collection should normally have only one virtual machine in it; otherwise, the user will be connected arbitrarily to one virtual machine in the collection.

A custom collection will most often be employed when a user’s physical machine has been converted to a virtual machine through VMware Converter, and permanently assigned to the user.

### Single User / Device

Single User / Device collections allow you to set up Pano devices and their corresponding DVMs to act like kiosks. Rather than displaying the Pano client login screen, the Pano device automatically connects and logs into the associated DVM using a specified account name and password. In a Single User / Device collection, the account name and password used is the same for all DVMs in the collection. The account name and password are entered as properties of the DVM collection. The account can be a domain account or a local account. This collection type is best when you wish to create a set of kiosks but do not want the administrative burden of managing multiple accounts and passwords.

### User Group / Device

User Group / Device collections allow you to set up Pano devices and their corresponding DVMs to act like kiosks. Rather than displaying the Pano client login screen, the Pano device automatically connects and logs into the associated DVM using a specified account name and password. The User Group / Device collection type relies on a user group that has as its members the individual accounts to be used. The user group and the individual accounts must exist in the directory service; local accounts are not supported. This collection type is best when you wish to create a set of kiosks and want to have a unique user name and password for each DVM.

### Shared User / Device

Shared User / Device collections allow you to set up a Pano device and a corresponding DVM to act like a general purpose Windows computer. Rather than displaying the Pano client login screen, the Pano device automatically connects to the DVM but does not login. The user must authenticate to Windows prior to using the DVM. This sort of collection is useful if you require users to use biometric devices (e.g. fingerprint scanner) for authentication.

## User Controlled DVM Operations

### Move to Trash

The user can move a DVM to trash if it has become unusable (corrupted operating system, virus/malware, etc.) they can choose to move the DVM to Trash. The user can perform this operation by clicking on “Options…” when logging in as shown in the panels below. The label of this button changes from “Help…” to “Options…” once the user has entered a username and password.

This operation will cause the DVM assigned to the user to be decommissioned and moved to the “Trash” folder. The Trash folder will be created is a sub-folder under the collection’s folder in VirtualCenter if it does not exist.

This operation is only available to users with DVMs in a cloned collection. After moving a DVM to trash, the user will receive a new DVM (cloned from the collection’s template) upon their next login.

The administrator may choose to power up a trashed DVM to diagnose its issues. It is recommended that the administrator clear the Trash folder periodically to recuperate the system resources from the trashed DVMs.

# Chapter 10 - Managing Pano Devices and Desktop Preferences

You use the Pano Devices tab to:

§ Monitor the Pano devices on your network

§ Set the image for the Pano login screen

§ Configure Pano devices for dual-monitor use

§ Manually add Pano devices to the Pano Manager

§ Edit the names of your Pano devices

§ Remove Pano devices

§ Set desktop preferences

## Managing Pano Devices

The following columns of information are available on the Pano Devices tab:

Column Name | Contents
Name | Name of the Pano Device (this can be edited)
MAC Address | Media Access Control address (unique hardware number) of the Pano Device
IP Address | IP address of the Pano Device
Connection | Connection status of the Pano Device as known to the Pano Manager: · Unreachable · Login (log in screen displayed) · DVM (logged in to DVM)
Rx Packets | Number of packets received by the Pano Device
Re Rx Packets | Number of identical packets received by the Pano Device multiple times
Tx Packets | Number of packets transmitted by the Pano Device
Re Tx Packets | Number of identical packets transmitted by the Pano Device multiple times
Min RTT | Minimum round-trip time from the Pano Device to an agent on the DVM and back
Avg RTT | Average round-trip time from the Pano Device to an agent on the DVM and back
Max RTT | Maximum round-trip time from the Pano Device to an agent on the DVM and back

### Setting the Pano login image

You can replace the image that is presented on the Pano login screen. The image must meet the following requirements:

- Image format must be PNG
- Image dimensions must be 640 pixels wide by 200 pixels high or smaller
- Image file size must be less than 1MB

To load a custom image

1. Press the “Settings” button and select “Login Image…”
2. Press the “Set Custom Image…” button.
3. Select the desired image from your local disk.
4. Click the “x” icon to close the window.

To reset the image to the default

1. Press the “Settings” button and select “Login Image…”
2. Press the “Restore Default Image”.
3. Click the “x” icon to close the window.

### Configuring Pano devices for Dual-Monitor Use

Two Pano devices can be configured to work as a team to provide a single Windows desktop that is spanned across two monitors. To configure this option attach two Pano devices to the network as normal. Make sure each Pano device is discovered by the Pano Manager and that you can access the Pano system from either device.

The requirements for dual-monitor use are as follows:

1. The primary monitor must be placed to the left of the secondary monitor
2. The monitors that make up the pair must support a common vertical resolution.
3. Both Pano devices must be on the network in order to log into the system. If either device making up the pair is unreachable, you will not be able to log in solely through the available device.

To configure a pair of Pano devices for dual-monitor use

1. Arrange the equipment so that the Pano device that is to be primary is connected to the left monitor and the Pano device that is to be the secondary is connected to the right monitor.
2. Log into the Pano Manager console.
3. Navigate to the Pano Devices tab
4. Select the primary Pano device from the list and click Edit…
5. Enter the name of the secondary Pano device. You may type in the name of the device or use the browser to choose from a list of available devices.
6. Click Update Pano Device

To change to a single monitor configuration, simply edit the properties of the primary Pano device and delete the information in the Secondary Monitor field.

### Manually Adding Pano Devices

If you enable one of the automatic discovery methods during setup, Pano devices will be automatically discovered and added to your Pano Manager. If you do not enable one of theses methods of discovery, then you need to manually add Pano Devices.

To manually add a Pano Device:

1. Click Add.

2. Enter the name you want to use to identify the Pano Device. For example, you can enter a user name or the physical location of the Pano Device.

3. Enter the Media Access Control (MAC) address (unique hardware number) of the Pano Device.

4. Enter the IP address.

5. Click Add Pano.

### Editing Pano Device Information

To edit a Pano Device:

1. Select the Pano Device from the list.

2. Modify the name, MAC address, or IP address.

3. Click Update Pano.

### Removing Pano Devices

To remove a Pano Device:

Select the Pano Device from the list.

Click Remove.

## Default Preferences

Pano devices have a number of default preferences that are settable by the administrator. These preferences affect display, audio, keyboard and mouse properties. Access these settings by pressing the “Settings” button and selecting “Login Preferences”.

Default settings are used by Pano devices when they are displaying the Pano client login screen. Default settings are also used when a user has logged in and has not set their personal preferences, which they can do through the Pano Control Panel running within their desktop virtual machine. The end user does not have control over the color quality (bit depth). If you wish to allow users to connect at millions of colors (24 bits) follow the instructions in Appendix E.

### Display Preferences

The display settings (resolution, colors, refresh rate and power save delay) indicate the preferred settings to be used by a Pano device to drive a video monitor. The physical monitor may not actually support the preferred display settings. In this case, the Pano device will query the monitor for its list of supported settings and drive the monitor as close as possible to the preferred settings. Only monitors that support EDID can be queried. If you use non-EDID monitors, the resolution used may be lower than expected.

### Audio Preferences

The audio preferences settable by the administrator control the volume of the internal speaker and the volume of the external audio jack. Users can set these values individually to suit their personal preference through the Pano Control Panel running within their desktop virtual machine.

### Keyboard Preferences

The keyboard repeat delay indicates how long the user needs to hold down a key before it starts to automatically repeat. The keyboard repeat rate determines how quickly the key repeats when it is held down. The user has the ability to set their preferences through the Pano Control Panel.

### Mouse Preferences

The mouse pointer speed determines how far the screen cursor moves on screen relative to the movement of the physical mouse.

### Locale

This is a system wide setting that allows you to configure the system for use with a specific set of keyboard layouts. English is the default, but German and Swiss German are also supported. Note that this is a system wide setting and all keyboards connected to Pano devices must be the same language and layout.

# Chapter 11 – Best Practices

### Organizing Folders in VirtualCenter

A best practice for organizing DVMs, templates and folders in VirtualCenter is as follows.

- Create a top level folder with the same name as the collection.
- Create a sub-folder called Templates which will contain the template for this collection
- Create a sub-folder called DVMs which will contain all active DVMs
- Create a sub-folder call Maintenance which will contain DVMs that you take out of service while performing maintenance tasks or debugging on them.
- Create a sub-folder called Old DVMs for use in refreshing a collection as described below.

The following screen shot illustrates the best practices.

### Refreshing a Pooled Collection

In a pooled collection, DVMS are cloned from a template. You may want to apply an update to the template and refresh the collection. One method for performing this task is described below:

1) Update your template with the change.

2) Create a new folder in VirtualCenter called "Old DVMs" or similar.

3) Move all the DVMs into the "Old DVMs" folder.

Any users that are already connected to a DVM will continue to be able to use them until they logout. Any new users that attempt to login will get new DVMs, which will automatically be deployed to the pool.

When old DVMs are no longer in use, the administrator can delete them in VirtualCenter.

# Chapter 12 – Using Pano VDS with VMware Virtual Desktop Manager

Pano devices can be used in a VMware Virtual Desktop Manager (VDM) environment. In such an environment VDM will typically perform the connection brokering and automated deployment functions that the Pano Manager normally performs. In this scenario the Pano Manager performs the following functions:

- Discovers and controls Pano devices
- Collects user credentials and authenticates users through the directory service
- Queries VMware VDM for the address of the virtual machine assigned to the user
- Establishes the connection between the virtual machine and the Pano device

The following procedures assume that VMware VDM has been fully installed and configured for use with PCs running the VDM client.

## Install the Pano Desktop Service

The Pano desktop service should be installed in all DVMs that you want to access from Pano devices. Typically this means that both the VMware VDM agent and the Pano Desktop Service will run side-by-side in the same virtual machines. If you plan to use USB peripherals with your Pano devices, make sure to install the USB driver component. Refer to the section titled Install Pano Desktop Service for steps on installing the Pano Desktop Service.

## Install the Pano Manager Virtual Machine

The Pano Manager should be installed as described in Chapter 5, Installing the Pano Manager Virtual Machine.

## One-Time Setup of Pano Manager

Once the Pano Manager virtual machine has been installed and configured, you need to perform the following one-time setup tasks using the Pano Management Console:

- Connect the Pano Manager to your directory service.
- Connect the Pano Manager to VMware Virtual Desktop Manager.
- Select the method for discovering Pano devices on your network.
- (Optional) Connect the Pano Manager to your virtual infrastructure manager.

### Directory Service Configuration

Directory service configuration is the same regardless of whether you run VMware VDM or not. The Pano Manager relies on the directory service for user authentication. Follow the instructions in Chapter 6, Setup Directory Service Integration for connecting the Pano Manager to your directory service.

### VMware VDM Configuration

When connecting a user session from a Pano device to a virtual machine managed by VDM, the Pano Manager needs to communicate with the VDM server. On the Setup tab in the Pano Management Console, perform the following steps:

1. Specify the VDM server by entering a URL of the form https://<server_name_or_IP_address>>

Example: https://vdmserver1.yourdomain.com

2. Enter the name of the account in VDM.

Example: panomanager

3. Enter the above account’s password

4. Click Configure

### Discovery Configuration

Discovery configuration is the same regardless of whether you run VMware VDM or not. Follow the instructions in Chapter 6, Setup Pano Device Discovery for setting up discovery of Pano devices.

## Create VMware VDM Collection

Once the above steps have been completed, the next task is to create a VMware VDM collection. The easiest way to configure the system is to create one collection that encompasses all your users. Pano Manager will rely on VDM to determine the appropriate mapping of users to DVMs.

To setup a generic collection for all your VMware VDM users, perform the following steps.

1. Navigate to the DVM Collections tab.

2. Click Add…

3. In the Type field select VMware VDM.

4. Enter a name for the collection.

5. Specify the users. If you specify a group that contains all your users, VDM will determine the specific mapping.

6. Click Add DVM Collection.

## Validate the Configuration

Validate the integration by having a user login via a Pano device. After successful authentication, the Pano Manager will determine to which Pano collections the user has been assigned. If the user is assigned to multiple collections, the user is mapped according to the following precedence:

1. Custom collection

2. Cloned collection

3. Pooled collection

4. VMware VDM collection

Assuming the user has not been assigned to a collection of higher precedence, the Pano Manager will query VDM to determine the appropriate desktop for the user. The Pano Manager will connect the Pano device to the desktop specified by VDM.

# Appendix A – Understanding Pano Device Discovery

## Configuring DHCP Assisted Discovery

Pano devices need to be discovered so they can be controlled by the Pano Manager. Rather than using one of the broadcast-based discovery methods, you can configure a DHCP server to provide the address of the Pano Manager to the Pano device. This method relies on a DHCP feature called vendor-specific codes. The basic sets are as follows:

In DHCP Server configuration, define a vendor class called Pano Logic identified by the ASCII string “Pano Logic”.

For that vendor class, use a vendor specific option, Code 1, Type IP address, Value: <PanoManagementServerIPAddress> where <PanoManagementServerIPAddress> is the static IP address of the Pano Manager virtual machine.

Turn on scope option.

### Instructions for Configuring Windows DHCP Server

Step-by-step instructions for configuring the Windows DHCP Server follow:

From the Windows server running the DHCP Server, launch the “Manage Your Server” tool.

1. Click on “Manage the DHCP server”

2. Right click on the domain controller and click Define Vendor Classes…

3. Create a new vendor class by clicking Add.

4. Perform the following tasks in the New Class dialog

1. Type Pano Logic in the Display name field.
2. Type Pano Logic Management Server in the Description field.
3. Type Pano Logic underneath “ASCII” in the large field. Note that even though it is blank you can still click there and type in the field as shown in the screen shot below.
4. Click OK.

5. Click OK to close the DHCP Vendor Classes dialog.
6. Right-click on the Domain Controller and select Set Predefined Options.

7. Select “Pano Logic” in the Option Class dropdown list and click Add.
8. In the Option Type dialog perform the following steps:

1. Type Pano Management Server into the Name field
2. Select IP Address in the Data type field
3. Type 1 or 101 in the Code field as shown in screen shot below.
4. Press OK to close the Option Type dialog.

9. Enter the IP address as shown in screen shot below. This IP address is the static IP address of the Pano Manager virtual machine. Click OK to close the Predefined Options and Values dialog.

10. Right click the Scope Options under Scope and select Configure Options.

11. Select the Advanced Tab

12. Select “Pano Logic” for the vendor class and check the available option that corresponds to the Pano Manager as shown below. Click OK.

13. The Pano Manager will now show up in the scope options.

At this point the DHCP Server is properly configured to pass the Pano Manager’s address to Pano devices.

# Appendix B – Configuring DVM Firewall

Configuring Group Policy

Open the group policy object editor and select the default domain policy. Navigate to the “Computer Configuration / Administrative Templates / Network / Network Connections / Windows Firewall / Domain Profile” section. This is where you set the properties that take effect when the machine is running attached to a domain. The “Standard Profile” item is used if you wish to have different firewall settings for times when the computer is disconnected from the domain.

From there, enable settings as shown in the diagram below.

The setting “Windows Firewall: Define port exceptions” is very important. This is where you specify which additional ports should be opened. For PanoDAS you need to add the following two lines:

8319:TCP:*:Enabled:Pano Management Server Connection

8321:UDP:*:Enabled:Pano Device Connection

The syntax is described in the “Explain” tab of the properties dialog box. See the screen shots below for an example of setting this property.

These same settings can be made using the “Local Computer Group Policy” if you wish. This is done by opening the Group Policy Object Editor and selecting “Local Computer” when prompted for the Group Policy Object (GPO), as shown below:

Note that domain policies have higher precedence than local policies. This means you should not expect local policies that are applied to a DVM template to always be used when new DVMs are cloned from the template. The best strategy is to always use the domain level GPOs.

Remember, GPOs can be applied to an organizational unit (OU) so it is possible to narrow the scope of this Firewall policy to just the collections of DVMs that the Pano Manager manages.

Note: If any firewall exceptions were added using the program file path for PanoDAS.exe, these should be updated when upgrading from pre-1.1 versions to 1.1 or later.

# Appendix C – Pano Manager Network Port Usage

#

## Inbound ports used

Port | Protocol | Service | Usage
ICMP |  | ping | Test connectivity to the server.
80 | TCP | HTTP | Connections from the UI to control the Pano Manager.
443 | TCP | HTTPS | Connections from the UI to control the Pano Manager.
22 | TCP | SSH | Remote terminal access.
68 | UDP | DHCP | DHCP responses
123 | UDP | NTP | Synchronizing of server time.
8320 | UDP |  | Communication from the Pano.
8321 | UDP |  | Communication from the Pano.

##

## Outbound ports used

Port | Protocol | Service | Usage
ICMP |  | ping | Test connectivity to the server.
53 | TCP | DNS | DNS requests.
80 | TCP |  | Communication to Virtual Center.
443 | TCP |  | SSL communication to Virtual Center.
389 | TCP | LDAP | Communication to LDAP server.
636 | TCP | LDAPS | Communication to LDAP server (Secured).
3268 | TCP |  | Communication to the Global Catalog.
3269 | TCP |  | Communication to the Global Catalog (Secured).
8319 | TCP |  | Broker to the Pano.
53 | UDP | DNS | DNS requests
67 | UDP | DHCP | DHCP
123 | UDP | NTP |
389 | UDP | LDAP | Communication to LDAP server.
636 | UDP | LDAPS | Communication to LDAP server (Secured).
8321 | UDP |  | Broker to the Pano.

# Appendix D – Installing USB Peripheral Support

## Support for USB Peripherals

In addition to support for USB keyboards and mice, this version of Pano Virtual Desktop Solution also includes support for the following devices:

- USB flash drives
- USB mass storage devices
- USB CD readers/writers
- USB DVD readers/writers
- USB floppy drives
- USB printers
- USB scanners
- USB business card scanners
- USB to serial converters
- USB hubs
- USB RIM BlackBerry
- Apple iPod

This release provides support for devices that fall into one of the above categories. Within each category Pano Logic tests a range of devices to ensure broad support; however it is still suggested that you check with Pano Logic Technical Support ahead of time if you plan to use a device in one of the above categories. Pano Logic Technical Support can offer guidance on which specific devices have been validated and work best with the solution.

To enable support for these devices, please refer to the “Install USBD.SYS from Windows XP disk” section below prior to installing the Pano Desktop Service. You must perform the tasks described in this section to individual DVMs or to the template used to clone DVMs.

### Composite USB Devices

Some USB peripherals implement multiple functions from different classes, and such composite devices are not supported with this release. For example, a printer that also includes an integrated multi-card reader is a composite device. Similarly, some of the most recent BlackBerry devices are composite devices. When a composite device is connected to a Pano, no features of the device will work. For example, even though this release supports a printer and mass storage devices individually, when integrated into a composite device, neither function is supported. Support for composite devices is planned for a future release.

### Known Issues and Limitations

While a USB storage device is inserted into a Pano device, improperly disconnecting the session may cause data corruption on the USB device. Keep in mind that there are multiple ways a session can be disconnected. The common ways to disconnect a session include:

1. Select disconnect from the Windows Security dialog

2. Press the Pano Button

3. Log into your original session from another Pano device (also known as session roaming)

4. Log into your original session from another client device, such as through an RDP client running on a laptop computer

The above actions are roughly equivalent to pulling a USB device out of a traditional desktop computer without first selecting Safely Remove Hardware from the Windows system tray. When you are not actively using a USB storage device, you should Safely Remove Hardware or Eject the device.

When you insert a USB mass storage device, the amount of time required for the device to become fully operational and appear in the Windows Explorer is proportional to the size of the storage device. USB thumb drives will generally be operational in a few seconds, whereas a 500GB external hard drive may take a minute or longer to become operational.

When you remove a USB mass storage device from a Pano device, you should wait for the device’s icon to disappear from the Windows Explorer before reinserting the device. Windows requires some time to fully remove the device.

### Install USBD.SYS from Windows XP disk

The file USBD.SYS is needed in order for the Pano USB support to work properly. This file is part of the Windows XP distribution, but is not installed on virtual machines by default during an XP install. You must manually copy this file from the c:\WINDOWS\Drivers Cache\i386\drivers.cab file in order to get full USB functionality. This must be done prior to installing the Pano Desktop Service, otherwise USB support will not be installed. To do so, follow these steps:

1. From the Windows Start Menu, select Run…
2. Open the Windows cabinet file by entering c:\WINDOWS\Driver Cache\i386\driver.cab and pressing Enter. The driver cabinet file will open.
3. Locate the USBD.SYS file in the cabinet, right click, and choose Copy.
4. In the address bar of Windows Explorer, type c:\WINDOWS\System32\Drivers.
5. Paste the copied USBD.SYS file into this directory.
6. You can now proceed with installing the Pano Desktop Service.

## Safely Removing / Ejecting USB Mass Storage Devices

When connecting remotely, Windows XP allows only administrators to be able to access the Safely Remove Hardware utility from the system tray. This is the recommended way to remove USB mass storage devices from your Pano device. To reduce the chance of data corruption, you should allow your non-administrator users to eject USB drives. The following steps show how to configure Windows to allow users to eject removable media.

The permission that needs to be configured is in the Local Security Settings.

1. Select Start à Run…

2. Type 'secpol.msc' and press OK

3. In the 'Local Security Settings' MMC, select 'Security Settings'à'Local Policies'à'Security Options'.

4. In the right pane, double click on 'Devices: Allowed to format and eject removable media'.

5. On the ensuing dialog box select 'Administrators and Interactive Users' and press OK.

6. Close the Local Security Settings MMC.

Once this permission is configured, users can right click on the USB drive letter icon in Windows Explorer and select 'Eject' to gracefully disconnect USB drives.

## Restricting/Allowing Use of USB Devices

You can restrict or allow the use of certain USB devices at the DVM level..These restrictions are controlled by registry settings in each DVM.

### Adding and Setting the USB Filter String

Restricting and allowing the use of USB devices is controlled by using the USB Filter String in the registry of the DVM. The default value for this setting is “3”, meaning only USB mass storage and printer devices are allowed.

If you wish to change the default USB filtering behavior, the USB filter string first needs to exist in the registry. To add the string or verify that it exists, perform the following steps:

1. Launch Registry Editor

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Neither Pano Logic nor Microsoft can guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

2. Navigate to 'HKEY_LOCAL_MACHINE\Software\Pano Logic, Inc.\Pano Desktop Additions'

3. If a string value named ‘USB Filter’ does not already exist in the key-value right-hand pane, create it by right-clicking on the key named ‘Pano Desktop Additions’ in the left-hand pane and selecting New àString Value.

4. Modify the string value and set the entry in the ‘Value data’ field to your desired value. The table below lists the possible values and the resulting policy.

5. Restart the 'Pano Desktop Additions' service or reboot your desktop virtual machine. The next time you log into your DVM through a Pano device you will be able to use only those USB peripherals that are specified by the USB filter string value.

### USB Filter String Values

The following table lists the possible values of the ‘USB Filter’ string and the resulting policy.

Value | USB peripherals allowed for use
0 | No USB peripherals
1 | USB Mass storage only
2 | USB Printers only
3 | USB Mass storage & Printers only
252 | All supported USB peripherals except USB Mass storage & Printers
253 | All supported USB peripherals except Printers
254 | All supported USB peripherals except USB Mass storage
255 | All supported USB peripherals

# Appendix E – Configuring DVMs for 24-bit Color

In order to get 24-bit color depth from a Pano device, you first have to configure your desktop virtual machine supports up to 24-bit color depth. There are many ways to configure your VM. Using local policy is one of the common ways.

Note: you can also configure this using group policy in Active Directory. If you use group policy, it will override configuration by local policy described below.

1. Run mmc

Click Start à run à type “mmc”

2. Select “Add/Remove Snap-in…”

3. Click “Add…”

4. Scroll down the list, choose “Group Policy Object Editor” and click “Add”.

5. Click “Finish”

6. Click “Cancel” to close all dialogs. You should see “Local Computer Policy” snap-in.

7. Expand “Local Computer Policy” and navigate to “Computer Configuration” à “Administrative Templates” à “Windows Components” à “Terminal Services”. In the right pane, you should see “Limit maximum color depth”. By default, it is “Not Configured”. Double click the item.

8. In the dialog, choose “Enabled” and “24 bit” for Color Depth. Click “Ok” to close the dialog

9. Now you should see “Limit maximum color depth” is “Enabled”.

10. Now your desktop virtual machine supports up to 24 bit color depth. You have the choice to configure Pano device to use 16-bit or 24 bit color depth. By default, Pano device uses 16-bit color depth and you don’t have to configure anything. To get 24-bit color depth, follow these steps:

6. Run Registry Editor

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Neither Pano Logic nor Microsoft can guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

7. Navigate to 'HKEY_LOCAL_MACHINE\Software\Pano Logic, Inc.\Pano Desktop Additions'

8. Add a string entry 'Pixel Bit Depth' and set its value to 24

9. Restart the 'Pano Desktop Additions' service or simply reboot your desktop virtual machine. Next time you login to your virtual machine through a Pano device, you will get 24-bit color depth. If you choose to use 16-bit color depth in the future, you can simply change the value of the registry to 16.

Note: If you choose to configure back your virtual machine to support up to only 16-bit color, you have to change the value of this registry to 16 or delete the registry. Otherwise, you won’t be able to login to your virtual machine from a Pano device.

# Appendix F – Updating the Pano Manager

Updating the Pano Manager entails copying a file downloaded from the Pano Logic Technical Support download server to the virtual machine running the Pano Manager. That file is then used to update the Pano Manager.

If required, the updater will automatically restart the Pano Manager virtual machine at the end of the update process. The update process and restart will typically take a few minutes, during which users will not be able to establish new connections to their DVMs. Users that have existing connections to their DVMs will be able to work without interruption.

You may need to reconfigure the network settings for the Pano Manager after the updater is complete. Please take a note of the following network settings of the virtual machine:

1) IP Address

2) Net Mask

3) Default Gateway

4) Primary DNS Server

5) Secondary DNS Server

6) Default Domain

Follow the steps outlined below to update your Pano Manager:

1. Take a snapshot of the Pano Manager virtual machine before proceeding so that you can revert to a known good state if any errors are encountered.

2. Download the latest software from http://download.panologic.com to a local machine

a. Open a browser to http://download.panologic.com. Contact Pano Logic Technical Support for the proper user name and password.

b. Click on the link titled Latest

c. Save PanoMan.tar.gz to disk

3. Copy PanoMan.tar.gz to the Pano Manager virtual machine using an scp client such as WinSCP. Copy the file to /tmp

4. Log into the Pano Manager virtual machine’s console.

5. After logging in you will be presented with a text-based menu of options. Select 4 – Drop to bash shell (Power Users).

6. Change directories to /tmp.

To run the installer, type /opt/installbroker_wrapper.sh PanoMan.tar.gz and press Enter.

7. When the installer completes, you should see the following:

8. To review the installation history, execute the following command:

tail /opt/atto_install history

9. If the virtual machine is rebooted, its network settings will need to be reconfigured. You can do this by logging into the Pano Manager virtual machine’s console and selecting option 1 – Configure Network Settings. Follow the prompts and enter the network configuration information. Example is shown below:

10. Reconfigure VMware tools by selecting 4 – Drop to bash shell (Power Users) from the menu and executing the following command:

vmware-config-tools.pl –d

# Appendix G - Reading Log Files

The Log tab provides a list of system messages concerning the activity and performance of the Pano environment.

The following columns of information are available on the Log tab:

Column Name | Contents
Time | Time the system message was issued
Level | The security level of the incident
Message | Text of the system message

### Filtering System Messages

To filter the list of system messages:

1. Select the Show Most Recent check box.

2. Enter your filter string in the Message Filter field, and then press Enter on your keyboard.

To clear your filter:

1. Select the Show Most Recent check box.

2. Delete your search string from the Message Filter field, and then press Enter on your keyboard.

### Viewing Message Detail

To see the full details of a message, click on the desired row in the message list. The full message will appear in the area below the message list.

### Downloading Log Files

To download an archived set of log files to your local computer, press the Download button. You will be prompted to save the .zip file to a specific location.

# Appendix H: Enabling Auto Recovery for the Pano DAS Windows Service

The Pano Desktop Service is an essential part of the Pano Virtual Desktop Solution. The following steps ensure that the service is continually running, even if it was shutdown by the end user or by the operating system.

1. Launch the Services MMC snap-in from the “Run” dialog box. The name of the program to run is “services.msc”.

2. Scroll down in the list of services until you locate the “Pano Desktop Additions” line. Right-click on this line to display the context-menu. Select “Properties” from the context-menu.

3. The “Pano Desktop Additions Properties” dialog box should appear next. There are four tabs on the dialog. Initially you will be on the “General” tab. Select the “Recovery” tab.

4. The following figure illustrates one possible recovery configuration. Here the PanoDAS has been configured to restart automatically if it experiences a problem, but to only do so the first two times a problem happens. If a serious issue exists that causes the PanoDAS to restart multiple times then after two failures in 1 day the operating system will stop trying to automatically restart. You may adjust these options to meet the recovery goals for your installation.

5. When you have set the recovery options as you wish, be sure to press the “Apply” button and then the “Ok” button to save your changes to the configuration.

# Appendix I: Updating the SSL Certificate

The Pano Manager uses a self-signed certificate for secure communication over HTTP using SSL (HTTPS). This certificate can be updated to a customer specific certificate using the steps outlined below.

1. Copy the certificate to the Pano Manager virtual machine using scp. Example:

scp mycert.p12 root@pano-ms:/opt/mycert.p12

2. Log into the Pano Manager via the VMware console (or using ssh) using the superuser (root) credentials.
3. If logging from the console, select option 4: “Drop to bash shell”.
4. Edit the /opt/atto/broker/conf/server.xml using an editor. Example:

vi server.xml

5. Add the following XML tags to the Connector element:

keystoreType=”PKCS12”

keystoreFile=”<path to the certificate>”

keystorePass=”<password for the certificate>”

Example:

<Connector

className="org.apache.coyote.tomcat5.CoyoteConnector"

port="8443" minProcessors="5" maxProcessors="75"

enableLookups="true" disableUploadTimeout="true"

acceptCount="100" debug="0" scheme="https" secure="true"

clientAuth="false" sslProtocol="TLS"

keystoreType="PKCS12" keystoreFile="/opt/mycert.p12"

keystorePass="example_password"/>

6. Restart the Pano Manager using:

service atto restart

Pano Manager can now be accessed using HTTPS using the custom certificate. NOTE: The Pano Manager will continue to accept connections on the HTTP port (port 80) if it has not been disabled.

### Disabling the HTTP port

1. Edit /opt/atto/broker/bvm/system-conf/iptables.sh
2. Comment (using ‘#’) or remove the following lines:

iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j

REDIRECT --to-port 8084

iptables -A INPUT -p tcp --destination-port 8084 -j ACCEPT

3. Update the firewall:

bash /opt/atto/broker/bvm/system-conf/iptables.sh

# Appendix J: Enabling SSH Access to the ESX Service Console

SSH is a commonly used UNIX and Linux command shell that lets you remotely log into the service console and perform certain management and configuration tasks for ESX Server.

You may need to change your current security configuration if you plan to use SSH to access the service console.

To change the current SSH configuration:

1. Log into the ESX service console and acquire root privileges.
2. Change directories by entering cd /etc/ssh at the command prompt.
3. To allow remote root login, use a text editor such as vi to change the setting to yes in the following line in the sshd_config file:

PermitRootLogin no

4. Save your changes and close the file.
5. Execute the following command to restart the SSHD service:

service sshd restart