VMware ACE
For a jumpstart to a customer, I use the VMware ACE product since a few days. Since I am now a bit confidential with the product, I must say it is quite cool.
In the following article I will talk a bit about VMware ACE and explain how to install and use this product.
VMware ACE is a product for employees, partners or external staff who use there own, private notebook or PC. With VMware ACE you can deploy a virtual machine as a manages pc on an unmanaged pc. I would consider it as a step between a regular PC workstation (FatClient) and a View / ThinClient.
How does it work?
An employee of the IT creates a virtual machine in its VMware Workstation and enabled them for the use of ACE. This allows the admin the set of rules for the VM, and many other policies. Here are a few examples:
- Password to start the virtual machine
- AD authentication
- Expiry of the virtual machine after X days (no longer possible to boot)
- Prevent copying the virtual machine
- Encryption of all files
- Hardware independent
- Works even without connecting to the corporate network
- Transportable
- Host system independently
The VMware ACE instance logs now in a VMware ACE Management Server. There are all the settings and policies centrally managed. On this server, for example, it is then possible to disable the image after the employee left the company.
This allows a virtual machine to be distributed and the VMware ACE Management Server to control. A very good solution for companies which will not move completely to VMware View or the users will work offline. I know they can also work with View offline but this is not supported at the moment. It is only experimental.
You have a runtime environment on any computer (Windows or Linux) which can be copied and then launched. The image is protected by various Policies e.g. protected with a password, can not be copied or external media can not be connected. A managed virtual machine on a PC which is unmanaged. You can work without any problems with data loss or something.
Next I show you how to install VMware ACE and uses.
What software you need:
- VMware ACE Management Server Appliance or VMware ACE Management Server for Windows
- VMware Workstation 6 with ACE Option
- Windows or Linux virtual machine to distribute
- Firefox or Internet Explorer to configure
You can download the ACE Management Server and the Workstation on the site from VMware. Just follow this link.
Installing and configuring ACE Management Server
There are two very simple ways the ACE Management Server to install. There is even an appliance you can download or install the ACE Management Server on Windows. Both very easy. In our case we use the appliance.
After the ACE Management Server is started, you must connect with a browser to the system. https://<IP: 8000. Now you can configure the hole
system.
Here I will only comment briefly on what side which can be configured.
The configuration itself is easy:
Licensing: Here is the serial number (you find it in the downloads after you registered for the test) and the name of the company.
Database: Everything is in a database stored. It is possible to either a local database or to use an external database. To test the internal database is sufficient. An external database should be used when multiple management servers used or more then 100 images are managed. Supports SQL and Oracle databases.
Access Control: Here it is possible to set Active Directory authentication. There are still some preparations are being made as the admin create a user for ACE. It is also possible to use a local user.
Custom SSL certificates: SSL Certificates can be configured.
Logging: Change the settings for the logging
With these steps you finished the configuration of the server.
Workstation installation and configuration.
The installation of VMware Workstation needs no further explanation! The installation is very simple and is therefore skipped. But what needs to be done is to add the ACE product key in the Workstation.
Creating an ACE Images
Now we can create an ACE image. To do this, you should only first connect your ACE Management server with your workstation. Just go over “File” “Connect to ACE Management Server”. If you've added it appears in the sidebar of the workstation. When you click on the ACE Management Server it gives you an overview of the existing ACE instances.
Now you need a virtual machine which will be the new ACE instance. I just made a clone of my Windows Server 2003 Clone Source. It is ideal.
If you choose the virtual machine and you look to the Commands on the left side you see a new button “Enable ACE feature”.
If you enable ACE for this virtual machine by clicking this link, new options will be displayed. This new menus can configure the policies, create the
packages and so on. It is also possible now to define the ACE Management server in the virtual machine options. Choose the IP of your ACE Management server and configure it. I will describe shortly the options which can be configured now:
Edit deployment settings:
Encryption: Here you can configure if the files of the ACE instance should be encrypted.
Package Lifetime: This is a period or a date to be specified how long it is possible to install the package
Instance Customization: You can use sysprep to configure the windows guest OS. There must also be the Sysprep files in the directory of the VMware Workstation copied. Under this point are more options to configure sysprep.
Custom EULA: Provides a text to display which must be read and accepted by the user which is running the ACE instance.
Deployment Platform: Here, you can specify whether the ACE package will be used on Windows, Linux or both
Edit Policies:
Access Control: This allows several options for activating the image. For example a password to activate the ACE instance or a max number of
activations for this instance. Expiration date or period as long as the image will be used.
Copy Protection: Set whether it is permitted to copy the ACE Package
Signing Resources: How and where the data manipulation should be considered.
Network Access: This is a very interesting point. You can configure settings for the network. For example you can configure that if the system is connected to the network 192.168.178.0/24 that only the virtual machine can connect to the network and not the host system. In any other networks the virtual machine can not connect to the network but the host system can connect. This is a great option to be sure that host systems which are not managed by the IT department can not connect to the company network. If the virtual machine starts in an other, non secure network, the virtual machine can not connect to be sure no virus or something can affect the virtual machine.
Removable Devices: You can specify which devices in the virtual machine should be available and what can be connected. If you ban USB and DVD drives you can be sure that no one can copy data from the virtual machine.
Virtual Printer: Creates a printer port and allows you to configure local printer.
Runtime Preferences: Here you can make a lot of changes. For example you can configure that the ACE instance will run all the time in full screen. This is sometimes a good choose if you have users which are not so familiar with the technology. They are not confused about the two windows screens on the desktop…
Snapshots: Allow the user to make a snapshot
Administrator Mode: Here you can set a password with the admin later this package can changed.
Kiosk Mode: Enable Kiosk Mode
Policy Update Frequency: You can specify how often the ACE instance communicates with the ACE Management Server to update the policies. You can also configure how long the ACE instance can be used without connecting to the ACE management server.
That was all the settings which can be made. I have only touched on everything. A detailed statement would be beyond the scope.
Next, the packages can be created. There are two different ways. Once the draw of a normal package, which then can be easily copied, or an optimized package for use on a USB flash drives. The draw of the packages is very fast and easy. It will not be further discussed. There is a wizard of the self-explanatory.
After the packages have been created, you can simply start the VMware Player and select the appropriate VM. This connects to the ACE server and then allows the start. If you do not have a player installed you can use the player in the package. If you install the player a ACE shortcut on the desktop will be created which starts directly the virtual machine.
That was a brief overview of VMware ACE. There is still much more to say and to configure and test but I think for a first overview it is enough.
I will create an installation video if it works. I had today problems. I hope I can do this the next days.
For questions, just write.
