Setting Up Desktop and Application Pools in View

You can prevent specific device families from being redirected to the remote desktop or application. For
example, you can block all video, audio, and mass storage devices:
ExcludeDeviceFamily o:video;audio;storage
Conversely, you can create a whitelist by preventing all devices from being redirected but allowing a
specific device family to be used. For example, you can block all devices except storage devices:
ExcludeAllDevices Enabled
IncludeDeviceFamily o:storage
Another risk can arise when a remote user logs into a desktop or application and infects it. You can prevent
USB access to any View connections that originate from outside the company firewall. The USB device can
be used internally but not externally.
To disable external access to USB devices, you can block TCP port 32111 from the security server to the
remote desktops and applications. For zero clients, the USB traffic is embedded inside a virtual channel on
UDP port 4172. Because port 4172 is used for the display protocol as well as for USB redirection, you cannot
block port 4172. If required, you can disable USB redirection on zero clients. For details, see the zero client
product literature or contact the zero client vendor.
Setting policies to block certain device families or specific devices can help to mitigate the risk of being
infected with BadUSB malware. These policies do not mitigate all risk, but they can be an effective part of an
overall security strategy.
Using Log Files for Troubleshooting and to Determine USB Device IDs
Useful log files for USB are located on both the client system and the remote desktop operating system or
RDS host. Use the log files in both locations for troubleshooting. To find product IDs for specific devices, use
the client-side logs.
If you are trying to configure USB device splitting or filtering, or if you are trying to determine why a
particular device does not appear in a Horizon Client menu, look in the client-side logs. Client logs are
produced for the USB arbitrator and the Horizon View USB Service. Logging on Windows and Linux clients
is enabled by default. On Mac OS X clients, logging is disabled by default. To enable logging on Mac OS X
clients, see Using VMware Horizon Client for Mac OS X.
When you configure policies for splitting and filtering out USB devices, some values you set require the VID
(vendor ID) and PID (product ID) for the USB device. To find the VID and PID, you can search on the
Internet for the product name combined with vid and pid. Alternatively, you can look in the client-side log
file after you plug in the USB device to the local system when Horizon Client is running. The following table
shows the default location of the log files.
Table 14‑2. Log File Locations
Client or Agent Path to Log Files
Windows client
%PROGRAMDATA%\VMware\VDM\logs\debug-*.txt
C:\Windows\Temp\vmware-SYSTEM\vmware-usbarb-*.log
View Agent
%PROGRAMDATA%\VMware\VDM\logs\debug-*.txt
Mac OS X client
/var/root/Library/Logs/VMware/vmware-view-usbd-xxxx.log
/Library/Logs/VMware/vmware-usbarbitrator-xxxx.log
Linux client
(Default location) /tmp/vmware-root/vmware-view-usbd-*.log
If a problem with the device occurs after the device is redirected to the remote desktop or application,
examine both the client- and agent-side logs.
Chapter 14 Using USB Devices with Remote Desktops and Applications
VMware, Inc. 185