Build document for Dell Wyse 7020 thin client with VMware Horizon View client custom shell

As noted in one of my previous posts:

Configuring a custom shell launcher with VMware Horizon View Client on a Dell Wyse 7020 Windows 10 IoT device
http://terenceluk.blogspot.com/2019/03/configuring-custom-shell-launcher-with.html

I was recently involved with building a base image for a Dell Wyse 7020 Windows 10 IoT device that was non-domain joined and used a customized VMware Horizon View shell without access to the desktop for users to log into their virtual desktops.  The build is not quite complete in the way I want it to be due to the time constraint I had to work with but the steps outlined in this blog post should provide a good set of steps as a start.

Base Operating System Image

Windows 10 IoT Maintenance Release

Download the latest Dell provided Windows 10 IoT Enterprise Maintenance Release at the following URL:

https://www.dell.com/support/home/us/en/04/product-support/product/wyse-7020/drivers

Security Patches

Download and install the latest security patches from the following URL:

https://www.dell.com/support/home/us/en/04/product-support/product/wyse-7020/drivers

Base Applications

Remove Unused Applications

TightVNC

Remove the pre-installed TightVNC with the following commands:

cd\
"C:\Program Files\TightVNC\tvnserver.exe" -remove
rmdir "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TightVNC" /s /q
rmdir "C:\Program Files\TightVNC" /s /q

Ericom Connect Client

Remove the pre-installed Ericom Connect Client software with the following command:

wmic product where name="Ericom Connect Client" call uninstall

Ericom PowerTerm InterConnect for Thin Clients

Remove the pre-installed Ericom PowerTerm InterConnect for Thin Clients
software with the following command:

wmic product where name="Ericom PowerTerm InterConnect for Thin Clients" call uninstall

Lync VDI Plugin

VMware Horizon View now utilizes a gen 2 Skype for Business Server integration that is built directly into the Horizon View Client so there is no need to have the Lync VDI plug-in installed onto the thin client.  Remove the plug-in by creating the follow XML file:

<Configuration Product="Lyncvdi">
<Display Level="none" CompletionNotice="no" SuppressModal="yes" AcceptEula="yes" />
<Setting Id="SETUP_REBOOT" Value="Never" />
</Configuration>
Then executing this command:
"C:\Program Files\Common Files\microsoft shared\OFFICE15\Office Setup Controller\Setup.exe" /UNINSTALL Lyncvdi /config D:\TMRUK-7020\UninstallLync.xml

Then executing this command:

"C:\Program Files\Common Files\microsoft shared\OFFICE15\Office Setup Controller\Setup.exe" /UNINSTALL Lyncvdi /config D:\TMRUK-7020\UninstallLync.xml

Operating System Customizations

Remove Unused

Enabled Firewall

Enable the Windows firewall on the Windows 10 IoT operating system.

Disable Display Last User Name

Disable remember credentials for Windows which would also cause the Horizon View client to not remember the previous login via the registry key:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=dword:00000001

Disable VMware Horizon View Client Shade

Disable the shade of the VMware Horizon View client via the registry key for the User account:

Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\SOFTWARE\VMware, Inc.\VMware VDM\Client]
"EnableShade"="false"

**Note that this is added to the local user account’s HKCU.  The HKCM configuration never worked during my testing.

Force Num Lock On

Create the following registry key file (.reg) and import the configuration to force Num Lock on for all profiles.

Windows Registry Editor Version 5.00
[HKEY_USERS\.DEFAULT\Control Panel\Keyboard]
"InitialKeyboardIndicators"="2"
"KeyboardDelay"="1"
"KeyboardSpeed"="31"

Configure Power Plan

The preparation of the image for capture does not retain the Power Plan settings but it is still good to configure it in case future versions of the script does.

Set Power Plan to High Performance

Execute the following command to configure the power plan as High performance:

powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c

Turn off Display

Execute the following command to configure the high performance power plan to turn off the display after 15 minutes:

powercfg -x -monitor-timeout-ac 15

Computer Sleep Mode

Execute the following command to configure the high performance power plan to never put the computer to sleep:

powercfg -x -standby-timeout-ac 0

Change Admin and User account credentials

Change the default DellCCCvdi credentials for both the Admin and User account.

Update Credentials for Auto Logon

Update the credentials used for auto logging on the User account:

Configuring Custom Shell for User Account

Refer to one of my earlier posts here:

Configuring a custom shell launcher with VMware Horizon View Client on a Dell Wyse 7020 Windows 10 IoT device
http://terenceluk.blogspot.com/2019/03/configuring-custom-shell-launcher-with.html

Preparing Image for Capture

Execute the Build_Master.cmd in the C:\Windows\Setup folder on the thin client to start the capture wizard:

Fill in the appropriate settings and select the Enable local account credential changes under the Configure local account credentials heading to configure the password for the admin and user account.

Note the following settings that do not end up getting retained after the image preparation:

1. The name of the Windows OS does not change
2. The Power Scheme configuration will be reverted back to defaults (monitor and computer would go to sleep)

More information about the Custom Sysprep tool can be found here: https://www.dell.com/support/manuals/us/en/04/wyse-7020/wie10_th_mr4/running-custom-sysprep-tool?guid=guid-5bd77921-f2e6-4c84-b55f-dbffddc1a89f&lang=en-us

Post Image Operation

Customizations

Configure and reconfigure the following customizations that does not get retained after customization.

Configure Computer Name

Configure a unique name for the Windows 10 IoT operating system.

Set Power Plan to High Performance

Execute the following command to configure the power plan as High performance:
powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c

Turn off Display

Execute the following command to configure the high performance power plan to turn off the display after 15 minutes:

powercfg -x -monitor-timeout-ac 15

Computer Sleep Mode

Execute the following command to configure the high performance power plan to never put the computer to sleep:

powercfg -x -standby-timeout-ac 0

Prevent User from launching Internet Explorer

Configure the following AppLock rules for the local computer policy to prevent the user from launching Internet Explorer.  Note that this may be able to be bundled into the prebuild but I was not able to test to see if this is retained after the image prep process.

Launch GPEdit.msc and navigate to Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker > Executable Rules > Create New Rule…:

Configure the local User with the Action as Deny:

I haven’t had any luck using Path as the Condition so select Publisher:

Click on the Browse button and locate the 32 or 64-bit version of Internet Explorer:

There will not be a need for Exceptions so proceed to the next page:

Leave the name as the default and complete the creation:

Select Yes to create the default rules:

**Repeat the same for the 32 or 64-bit Internet Explorer.

Proceed and create the default rules for the Packaged app Rules:

Force the Application Identity service to automatically start by editing the following registry key (if this isn’t started then AppLocker will not work:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppIDSvc]
"Start"=dword:00000002

Note that would receive an Access is denied error if you attempt to manually configure this in the services console:

Having the above configured will prevent users from launching IE via the About VMware Horizon Client window:

Notes

Limitations

The following are items that need to be highlighted as the build can be improved on but were left out due to the amount of time available for the initial build.

Host name generation

The feature Host Name calculation is supposed to generate a new name for the Windows 10 IoT OS but it does not:

Power Scheme Settings

It should be possible to place the power scheme commands in the scripts that are executed at the end of the preparation but this requires time to identify and test.

Preparation Finalization

The initial build of the image does not complete automatically because the final steps requires the Windows shell but the customization of the User account to be shell-less means the administrator needs to manually log into the thin client as the admin account so the finalization can complete.

AppLocker Configuration

The AppLocker configuration can be included into the base image but due to time constraints, it was not added in.

Further Security Lockdown

AppLocker can be further configured to disable other applications that may be able to be launched within the shell but will require additional time.

Poor multi-monitor performance using Dell Wyse 7020 Windows 10 IoT with VMware Horizon View 6.x to 7.x

This is a follow up to a previous post I wrote about poor VMware Horizon View video, keyboard and mouse performance when adding a 3^rd monitor to the Dell Wyse 7020 Windows 10 IoT thin client:

Adding a 3rd monitor to a Dell Wyse Z90QQ10 thin client connecting to a VMware Horizon View 6.2 virtual desktop causes slow video performance with mouse movement and typing delays

http://terenceluk.blogspot.com/2018/04/adding-3rd-monitor-to-dell-wyse-z90qq10.html

The poor performance issue began affecting our Microsoft Windows 2016 RDS services, which escalated the priority so I was finally able to take 2 days to troubleshoot the problem. I had also opened up a ticket with VMware and Dell prior to beginning troubleshooting the issue myself and the VMware EUC engineering said this was likely a Dell Wyse issue since it does not happen on a full thick PC while Dell never got back to me at all after a ticket was opened. I’ve never been impressed with Dell support for the Wyse devices but figured I’d give them a try but they have yet to call me days after the ticket was opened and I don’t have much confidence that I would receive a call back soon.

Before I begin, the following are the environment details:

Hardware

Thin Client: Dell Wyse Z90QQ10 Thin Client

Operation System: Windows 10 Enterprise 2015 LTSB

Monitors: 3 x Dell P2414Hb (1920 x 1080) and 3 x Dell U2417H (1920 x 1080)

View Horizon Client: VMware Horizon View Client 4.8.0 build-8547331

Troubleshooting

The first item I looked at the start of the troubleshooting was the PCoIP Client Session Variables configuration provided by VMware to apply to the Horizon View Client and in particular the Configure PCoIP client image cache size policy and Configure the PCoIP session bandwidth floor settings:

Both of these settings did not help with the problem so I moved on to upgrading the VDI’s virtual machine version (no improvement), increasing resources (no improvement) then reviewing the drivers available for the two video cards in the thin client but noticed that there was an 2 month newer update for the AMD Radeon HD 8330E but no update for the AMD Radeon E6460:

Realizing I’m not going to have much luck with the drivers or the Horizon View Client application tweaking, I started reviewing the display output connections of the thin client:

After trying different combinations to connect the 3 monitors, I concluded that the degrade in performance happens when both of the video cards are used. Independently using the video cards to display 2 monitors at a time was fine but using 1 output connector from each video card for 2 monitors degraded performance immediately. Having ran out of ideas, I decided to review the specifications to see if I had missed something:

https://www.dell.com/en-us/work/shop/wyse-endpoints-and-software/wyse-7000-series-thin-clients-high-performance-virtual-desktop/spd/wyse-z-class

What I immediately noticed was that the thin client actually supported 6 displays as indicated under the Display specifications:

Wyse 7020
DisplayPort: 2560 x 1600 @32bpp
Dual DisplayPort: 2560 x 1600 @32bpp
DVI-I: 1920 x 1200 @32bpp
Dual Display: 1920 x 1200 @32bpp
Four Displays (DVI & DisplayPort): (1) 1920x1200@32bpp, (3) 2560x1600 @32bpp
Four Displays (DisplayPort daisy-chain): 3840x2160@32bpp
Six Displays (DisplayPort daisy-chain): 2560x1600@32bpp

I have to admit that I don’t really follow the advancements of monitor outputs so I was unfamiliar with DisplayPort daisy-chain but taking it literally made me realize that I could potentially connect more than 2 monitors to the same video card. The Dell P2414Hb (1920 x 1080)

monitors we had in the office did not support daisy chaining so we ended up purchasing 3 x Dell U2417H (1920 x 1080) to test this capability and I immediately noticed that daisy chaining 3 monitors to the AMD Radeon HD 8330E video card provided optimal performance in Horizon View. I then went and tried to the do the same with the AMD Radeon E6460 and received an error indicating it only supported 2 monitors via a single daisy chained display port.

It was a bit absurd to find that this was the problem and I could not find any information about this anywhere on the internet so I hope this post would help anyone who may encounter the same problem. Below is a photo of the Dell Wyse 7020 back panel with the video cards labeled and a table of the test results:

AMD Radeon E6460

Port	Connection	Monitors	Resolution	Performance Results
Display Port	Daisy-Chain DP	2	1920 x 1080	Poor with mouse delays
Display Port	Daisy-Chain DP	3	1920 x 1080	Unsupported as only a maximum of 2 monitors is supported
DVI and Display Port	Direct connection	2 (1 on DP and 1 on DVI)	1920 x 1080	Good as expected

AMD Radeon HD 8330E

Port	Connection	Monitors	Resolution	Performance Results
Display Port	Daisy-Chain DP	2	1920 x 1080	Good
Display Port	Daisy-Chain DP	3	1920 x 1080	Good
Display Port	Daisy-Chain DP	4	1920 x 1080	Good
Display Port	Daisy-Chain DP	4 (1 on DP and 3 on other DP)	1920 x 1080	Good

**Any combination of mixing the AMD Radeon E6460 and HD 8330E resulted in poor performance and would generated the following low on memory message for the VMware Remote MKS service:

Close programs to prevent information loss

Your computer is low on memory. Save your files and close these programs:

VMware Remote MKS

Where to download the latest Wyse USB Firmware Tool / Dell USB Firmware Tool

I was recently asked by a colleague of mine as to where he could download the Wyse USB Firmware Tool / Dell USB Firmware Tool as shown in one of my previous blog posts:

Attempting to pull and image from a Wyse thin client fails with: “Copy image to USB failed Press Enter key to reboot now.”
http://terenceluk.blogspot.com/2014/09/attempting-to-pull-and-image-from-wyse.html

… because he searched all over the internet and couldn’t find the following page I included in the post above:

I haven’t had to work with Wyse thin clients for a while but after searching through the Wyse and redirected to Dell site, I noticed that this tool was no where to be found. It was not until about 15 minutes later when I finally found it so I thought I’d write this quick blog post in hopes that such an activity wouldn’t waste other administrator’s time.

Many of the Wyse tools such as PCE, TXC, USBFT, WCM and WDM have been moved to the following URL:

https://downloads.dell.com/wyse/

This URL brings you to the following no nonsense and no frills directory:

The directory we’re interested in is the USBFT directory where you will find the USB Firmware Tool:

https://downloads.dell.com/wyse/USBFT/

For those who are interested, I found this information in the following post:

http://en.community.dell.com/techcenter/enterprise-client/wyse_general_forum/f/4949/t/19629018

Dell Wyse Device Manager Version 5.0 WDMServiceLog process pegs processor at 100%

Problem

Dell Wyse Device Manager Version 5.0 is installed onto a Windows Server 2012 R2 server:

… and you notice that the WDMServiceLog (32 bit) / RptSvcLog.exe process consistently consumes close to 100% of the CPU process pegging the processor at 100% and allowing the server down to a crawl:

Solution

While the following may not be the best solution for the issue as it’s more of a workaround, it was the only one I could find while searching:

http://www.technicalhelp.de/forums/topic/problem-with-wdm-service-log-makes-cpu-usage-go-to-100/

The suggestion was to disable the WDM Service Logs logging service found here in the Preferences options:

Disabling this service will cause the WDMServiceLog (32 bit) / RptSvcLog.exe never to run and therefore fixes the issue.