Horizon 5.1 Client Logo

VMware Horizon Client GPO Registry Keys

Have you ever been eager to tweak a feature in your Horizon virtual desktop environment only to be stuck waiting on your group policy administrator? Followed by endless questions of what you’re up to! Or perhaps you’re like me and are trying to help customers deploy a solution which they asked for and continue to run into roadblocks from the friendly security teams??

Below is a list of corresponding Horizon Client registry settings to the Horizon 7.9.0 View GPO Bundle

VMware Horizon Client Configuration - These settings are stored in HKLM\Software\Policies\VMware, Inc.\VMware VDM\Client

GPO SettingRegistry KeyKey TypeValues
Allow data sharingAllowDataSharingREG_SZfalse - disabled
true - enabled
Allow display scalingAllowDisplayScalingREG_SZfalse - disabled
true - enabled
Allow HEVC DecodingAllowClientHEVCREG_SZfalse - disabled
true - enabled
Enable Horizon Client online updateAutoUpdateAllowedREG_SZfalse - disabled
true - enabled
URL for Horizon Client online updateAutoUpdateURLREG_SZhttp://website.com
Automatically install shortcuts when configured on the Horizon serverAutomaticallyInstallShortcutsREG_SZfalse - disabled
true - enabled
Block multiple Horizon Client instances per Windows sessionBlockMultipleInstancesREG_SZfalse - disabled
true - enabled
Disable desktop disconnect messagesDisableDisconnectMessagesREG_SZfalse - disabled
true - enabled
Disable time zone forwardingDisableTimeZoneForwardingREG_SZfalse - disabled
true - enabled
Disable toast notificationsDisableToastREG_SZfalse - disabled
true - enabled
Disallow passing through client information in a nested sessionDisallowClientInformationPassthroughREG_SZfalse - disabled
true - enabled
Enable relative mouseEnableRelativeMouseREG_SZfalse - disabled
true - enabled
Custom error screen footerErrorFooterTextFileREG_SZC:\somefile.txt
Always hide the remote floating language (IME) bar for Hosted AppsForceFloatingLanguageBarOffREG_SZfalse - disabled
true - enabled
URL for Horizon Client online helpHelpURLREG_SZhttp://website.com
Hide items in application context menuHideSettingsAppContext
HideCreateShortcutToDesktopAppContext
HideAddToStartMenuAppContext
HideMarkAsFavoriteAppContext
REG_SZ
REG_SZ
REG_SZ
REG_SZ
false - disabled
true - enabled
Default value of the 'Hide the selector after launching an item' checkboxHideClientAfterLaunchSessionREG_SZfalse - disabled
true - enabled
Hide items in desktop context menuHideResetDesktopDesktopContext
HideRestartDesktopDesktopContext
HideDisplayDesktopContext
HideSettingsDesktopContext
HideCreateShortcutToDesktopDesktopContext
HideAddToStartMenuDesktopContext
HideMarkAsFavoriteDesktopContext
REG_SZ
REG_SZ
REG_SZ
REG_SZ
REG_SZ
REG_SZ
REG_SZ
false - disabled
true - enabled
Hide items in desktop toolbarHideHelpDesktopMenu
HideSupportInformationDesktopMenu
HideEnableRelativeMouseDesktopMenu
HideShareFoldersDesktopMenu
HideAllowDisplayScalingDesktopMenu
HideResetDesktopDesktopMenu
HideRestartDesktopDesktopMenu
HideConnectUSBDeviceDesktopMenu
REG_SZ
REG_SZ
REG_SZ
REG_SZ
REG_SZ
REG_SZ
REG_SZ
REG_SZ
false - disabled
true - enabled
Hide items in system tray menuHideSharingNotificationMenu
HideSettingsNotificationMenu
REG_SZ
REG_SZ
false - disabled
true - enabled
Hide items in the client toolbar menuHideFavoritesToolbar
HideSettingsToolbar
REG_SZ
REG_SZ
false - disabled
true - enabled
Display modifier function keyDisplaySwitchModifierKey
DisplaySwitchFunctionKey
REG_SZ
REG_SZ
Alt,Ctrl,Shift
F1 to F12
Redirect smart card readers in Local ModeRedirectSmartCardsInLocalModeREG_SZfalse - disabled
true - enabled
Delay the start of replications when starting the Horizon Client with Local ModeReplicationStartupDelayREG_DWORD1-9999 (seconds)
Tunnel proxy bypass address listTunnelProxyBypassREG_SZhttp://website.com
Disconnected application session resumption behaviorAppSessionReconnectBehaviorREG_SZask - Ask to reconnect to open applications
never - Do not ask and do not automatically reconnect
always - Reconnect automatically to open applications
DesktopLayoutDesktopLayoutREG_SZFullScreen - Full Screen
MultiMonitor - Multimonitor
WindowLarge - Window - Large
WindowSmall - Window - Small
DesktopName to selectDesktopNameREG_SZtext field (ie. Win10)
Logon DomainNameDomainNameREG_SZtext field (ie. domain.local)
Locked Guest SizeLockedGuestWidth
LockedGuestHeight
REG_DWORD
REG_DWORD
640-4096
480-4096
Suppress error messages (when fully scripted only)NonInteractiveREG_SZfalse - disabled
true - enabled
Logon PasswordPasswordREG_SZtext field plain text (ie. P@ssw0rd)
Server URLServerURLREG_SZtext field (ie. https://horizon.domain.com)
Automatically connect if only one launch item is entitledSingleAutoConnectREG_SZfalse - disabled
true - enabled
Account to use for Unauthenticated AccessUnauthenticatedAccessAccountREG_SZtext field (ie. Username)
Enabled Unauthenticated Access to the serverUnauthenticatedAccessEnabledREG_SZfalse - disabled
true - enabled
Logon UserNameUserNameREG_SZtext field (ie. Username)
Connect USB devices to the desktop or remote application when they are plugged inconnectUSBOnInsertREG_SZfalse - disabled
true - enabled
Connect all USB devices to the desktop or remote application on launchconnectUSBOnStartupREG_SZfalse - disabled
true - enabled
Disable 3rd-party Terminal Services pluginsnoTSCAddinsREG_SZfalse - disabled
true - enabled

VMware Horizon Client Configuration > Security Settings - These settings are stored in HKLM\Software\Policies\VMware, Inc.\VMware VDM\Client\Security\BrokersTrustedForDelegation

GPO SettingRegistry KeyKey TypeValues
Servers Trusted For Delegation1
2
3
REG_SZdomain\system$
system$@domain.com
SPN (service principal name)

VMware Horizon Client Configuration > View USB Configuration - These settings are stored in HKLM\Software\Policies\VMware, Inc.\VMware VDM\Client\USB

GPO SettingRegistry KeyKey TypeValues
Allow Audio Input DevicesAllowAudioInREG_SZfalse - disabled
true - enabled
Allow Audio Output DevicesAllowAudioOutREG_SZfalse - disabled
true - enabled
Allow Auto Device SplittingAllowAutoDeviceSplittingREG_SZfalse - disabled
true - enabled
Allow other input devicesAllowHIDREG_SZfalse - disabled
true - enabled
Allow HID-BootableAllowHIDBootableREG_SZfalse - disabled
true - enabled
Allow keyboard and Mouse DevicesAllowKeyboardMouseREG_SZfalse - disabled
true - enabled
Allow Smart CardsAllowSmartcardREG_SZfalse - disabled
true - enabled
Allow Video DevicesAllowVideoREG_SZfalse - disabled
true - enabled
Exclude All DevicesExcludeAllDevicesREG_SZfalse - disabled
true - enabled
Exclude Device FamilyExcludeFamilyREG_SZ[;...] (ie. bluetooth;audio-in)
Exclude Vid/Pid DeviceExcludeVidPidREG_SZ_pid->[;...]
(ie. vid_0781_pid-554c;vid-0781_pid-9999
Include Device FamilyIncludeFamilyREG_SZ[;...] (ie. storage;audio-out)
Include Vid/Pid DeviceIncludeVidPidREG_SZ_pid->[;...]
(ie. vid_0781_pid-554c;vid-0781_pid-9999
Exclude Vid/Pid Device from SplitSplitExcludeVidPidREG_SZ_pid->[;...]
(ie. vid_0781_pid-554c;vid-0781_pid-9999
Split Vid/Pid DeviceSplitVidPidREG_SZ_pid-(exintf:xx[;exintf:xx])>[;...]
(ie. vid-0781_pid554c(exintf:01;exintf:02);vid-0781_pid-9999(exintf:02)
Allow Device Descriptor Failsafe behaviorAllowDevDescFailsafeREG_SZfalse - disabled
true - enabled
Disable Remote ConfigurationDisableRemoteConfigREG_SZfalse - disabled
true - enabled
Exclude PathExcludePathREG_SZtext field (exclude a device at a specified hub or port path from being forwarded)
Include PathIncludePathREG_SZtext field (include a device at a specified hub or port path that can be forwarded)

4 comments