REVIEWER'S GUIDE REVIEWER’S GUIDE VMWARE ACE...

RE VIE WER'S GUIDEVMWARE ACE

11

RE VIE WER’S GUIDEVMWARE 2.0 for Windows NT and Windows 2000

1

� � � � � � � � � � � � � � � �


22

Introduction to VMware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3

Overview of ACE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4

Getting Started with VMware ACE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5

Sample VMware ACE Deployment Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5

Sample Deployment Hardware Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6

Installing VMware ACE Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7

Setting Up a Policy Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9

Using VMware ACE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13

Creating a New Project Using the New Project Wizard. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13

Add a Virtual Machine to the Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14

Apply Policies to the Virtual Machine. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17

Version-based Network Access Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20

Installing an Operating System and Applications in the Virtual Machine . . . . . . . . . . . . . . . . . . . . . . . .27

Installing a Guest Operating System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27

Installing Windows XP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27

Installing VMware Tools in a Windows Guest Operating System . . . . . . . . . . . . . . . . . . . . . . . . . . .28

Installing Application Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28

Running the Completed Virtual Machine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29

Creating a Package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30

Updating the Virtual Machine Version. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32

Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .38

Using ACE in the Enterprise . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39

ACE Feature Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39

VMware Professional Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40

VMware Support Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40

VMware Partner Alliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41

Where to Get More Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .42

About VMware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .42

Contents


33

Introduction to VMware VMware software is used throughout the enterprise—from the desktop to the data center—to minimize total cost of ownership (TCO) of computing infrastructure by maximizing its manageability, flexibility, and efficiency.

VMware has thousands of corporate customers, including many Global 2000 companies, in such industries as financial services, technology, and manufacturing, in more than 100 countries. These customers are using VMware software to meet some their most complex business challenges – they have realized significant benefits from their deployment of VMware software, including lower TCO, higher return on investment (ROI), and improved service levels to their customers.

About This GuideThis guide offers evaluation materials for VMware ACE™. The content includes a product overview, describes how customers use the product, and provides examples of how easy it is to get started using VMware ACE. It concludes with a detailed demonstration of the power of using VMware ACE and where to find additional information.

Providing FeedbackWe appreciate your feedback on the material included in this guide. In particular, we would be grateful for any guidance on the following topics:

• How useful was the information in this guide?

• What other specific topics would you like to see covered?

• Overall, how would you rate this guide?

Please send your feedback to the following email address: [email protected], with “VMware ACE Reviewer’s Guide” in the subject line. Thank you for your help in making the VMware ACE Reviewer’s Guide a valuable resource.


44

Overview of ACEThe Assured Computing Environment for the EnterpriseVMware ACE is an enterprise solution for IT desktop managers who want to rapidly provision standardized and secure PC environments throughout the extended enterprise. VMware ACE installs easily, improving the manageability, security and cost-effectiveness of any industry-standard PC. VMware ACE enables IT desktop managers to apply enterprise IT policies to a virtual machine containing an operating system, enterprise applications, and data to create an isolated PC environment known as an “assured com-puting environment.” VMware assured computing environments are self-policing, protect enterprise data, and enable safe access to enterprise resources.

VMware ACE is used across the enterprise to:

• Provision enterprise-standard PC environments on unmanaged remote PCs

• Provision time-limited, locked-down PC environments on unmanaged guest PCs

• Encrypt and protect sensitive enterprise and personally identifiable information on mobile PCs

• Provision standardized, hardware-independent PC environments on any enterprise PC

Using VMware ACE Manager, IT desktop managers create projects that include:

• A virtual machine with an operating system, applications, and data

• An application to run the virtual machines

• A set of policies to control the lifecycle and capabili-ties of the virtual machine

From this project, PC managers create a VMware ACE package that is distributed to end users via download, DVD, or CD media. VMware ACE enables end users to run an assured computing environment on their desktop or laptop PC. The VMware virtualization layer maps the physical hardware resources to the VMware ACE virtual machine resources, providing the full equivalent of a standard x86 machine within the assured computing environment.

“VMware ACE allows us to create, maintain and manage a standardized, hardware-independent, secure desktop confi guration that can be provisioned to any PC in the enterprise.”

— David Parsons VP of Product Development, ALG Software

��

��

��

“This new solution from VMware installs and runs like an application on the students’ PC--it’s easy for students to use and much easier for us to manage. This product will save us time and money. It is going to decrease development time on my part, and because we can set everything up for the students, they need less training and have fewer problems. They just click it and it works.”

— Scott Worthington Technology Support Analyst, Arizona State University


55

Getting Started with VMware ACEGetting started with VMware ACE is as simple as following the key steps listed below. This condensed infor-mation is designed for a technical product reviewer. For more detailed information, please see the VMware ACE Administration Guide available at www.vmware.com/support/ace/doc/index.html.

This sample deployment will walk through the installation of VMware ACE.

Here is an overview of the sample deployment:

Initial Setup1. Install and configure VMware ACE Manager software.

2. Install and configure a policy server to use with the VMware ACE network quarantine feature.

Overview of ACE functionality3. Create a project and a virtual machine with VMware ACE Manager.

4. Use Virtual Rights Management technology to apply lifecycle policies to the virtual machine.

5. Apply device-specific policies to the virtual machine.

6. Use VMware ACE to create version-based networking privileges for the virtual machine.

7. Power on the virtual machine and install a guest operating system from the installation media (CD-ROM or floppy disks) of the operating system. Install any required software in the virtual machine.

8. Preview the virtual machine in VMware ACE Manager.

9. Create a package for deployment to end users.

Sample VMware ACE Deployment OverviewThe following scenario is used to demonstrate VMware ACE features. In this scenario, you are a desktop administrator who will configure an assured computing environment for Matt, an employee who needs to work from home two days a week for the next two months.

Specifically, the requirements for Matt’s computing environment are:

• Secure data in the ACE computing environment through mandatory password authentication

• Set the ACE environment to expire two months after installation

• Copy protect data with the ACE environment

• Restrict network access to only authorized versions of the ACE environment

The sample deployment will walk through the following key features of VMware ACE:

• Virtual Rights Management (VRM). Control VMware ACE lifecycle, security settings, network settings, system configuration and user interface capabilities.

• Tamper resistant and copy protected environments. Protect the entire VMware ACE environment, including data and system configuration, with seamless encryption.

• Rules-based network access. Identify and quarantine unauthorized or out-of-date VMware ACE environ-ments. Enable access to the network once the VMware ACE environment complies with IT policies.


66

Sample Deployment System Requirements

Host System Requirements

ACE Manager— Desktop Manager’s PC ACE—End-User’s PC

PC Hardware • Standard PC

• 500MHz or faster compatible x86 processor (recommended; 400MHz minimum). Compatible processors include:

• Intel®: Celeron®, Pentium® II, Pentium III, Pentium 4, Pentium M, Xeon

• AMD: Athlon, Athlon MP, Athlon XP, Duron, Opteron

• Multiprocessor systems supported

• Experimental support for AMD64 Opteron, Athlon 64, or Intel IA32e CPU

• Standard PC

• 500MHz or faster compatible x86 processor (recommended; 400MHz minimum). Compatible processors include:

• Intel: Celeron, Pentium II, Pentium III, Pentium 4, Pentium M, Xeon

• AMD: Athlon, Athlon MP, Athlon XP, Duron, Opteron

• Multiprocessor systems supported

• Experimental support for AMD64 Opteron, Athlon 64, or Intel IA32e CPU

Memory • 256MB recommended, 128MB minimum

• Enough memory to run the host operating system, plus memory required for the guest operating system and for applications on the host and guest; see your guest operating system and application documentation for the memory requirements

• 256MB recommended, 128MB minimum

Display • 16-bit display adapter recommended; 8-bit display adapter required

• 16-bit display adapter recommended; greater than 8-bit display adapter required

Disk Drives • 150MB free space required for basic installation

• At least 1GB free disk space recommended for each guest operating system and application software used with it

• Additional disk space for building packages; temporary files require about as much space as those of the virtual machine included in the package

• IDE or SCSI hard drives, CD-ROM and DVD-ROM drives supported

• 80MB free space required for basic installation

• At least 1GB free disk space recommended for the guest operating system and the application software used with it; if you use a default setup, the actual disk space needs are approximately the same as those for installing and running the guest operating system and applications on a physical computer

• IDE or SCSI hard drives, CD-ROM and DVD-ROM drives supported

Local Area Networking (Optional)

• Any Ethernet controller supported by the host operating system

• Non-Ethernet networks supported using built-in network address translation (NAT)

• Any Ethernet controller supported by the host operating system

• Non-Ethernet networks supported using built-in network address translation (NAT)


77

Host System Requirements

ACE Manager— Desktop Manager’s PC ACE—End-User’s PC

Windows Host Operating Systems

• Windows®• Server 2003 Web Edition, Windows

Server 2003 Standard Edition, Windows Server 2003 Enterprise Edition

• Windows XP Professional and Windows XP Home Edition with Service Pack 1 or 2

• Windows 2000 Professional Service Pack 3 or 4, Windows 2000 Server Service Pack 3 or 4, Windows 2000 Advanced Server Service Pack 3 or 4

• Windows Server 2003 Web Edition, Windows Server 2003 Standard Edition, Windows Server 2003 Enterprise Edition

• Windows XP Professional and Windows XP Home Edition with Service Pack 1or 2

• Windows 2000 Professional Service Pack 3 or 4, Windows 2000 Server Service Pack 3 or 4, Windows 2000 Advanced Server Service Pack 3 or 4

Browser • Internet Explorer 4.0 or higher required for Help system

• Internet Explorer 4.0 or higher required for Help system

Installing VMware ACE Manager

1. Log on to your Microsoft Windows host as the Administrator user or as a user who is a member of the Windows Administrators group.

2. Note: On a Windows XP or Windows Server 2003 host computer, you must be logged in as a local administrator (that is, not logged in to the domain) in order to install ACE Manager.

3. Note: Although you must be logged in as an administrator to install ACE Manager, a user with normal user privileges can run the program after it is installed. Keep in mind that you need one license for each user.

4. If you are installing from a CD, from the Start menu, choose Run and enter D:\setup.exe, where D: is the drive letter for your CD-ROM drive.

If you are installing from a downloaded file, from the Start menu, choose Run, browse to the directory where you saved the downloaded installer file and run the installer.

5. The Welcome dialog box appears.

6. Click Next.

7. Acknowledge the end user license agreement (EULA). Select the Yes, I accept the terms in the license agreement option, click Next.

8. Choose the directory in which to install ACE Manager. To install it in a directory other than the default, click Change and browse to your directory of choice. If the directory does not exist, the installer will create it for you. Click Next.

9. Caution: Do not install ACE Manager on a network drive.

10. Note: Windows and the Microsoft Installer limit the length of a path to a folder on a local drive to 255 characters. For a path to a folder on a mapped or shared drive, the limit is 240 characters. If the path to the ACE Manager program folder exceeds this limit, an error message appears. You must select or enter a shorter path.


88

11. The installer has gathered the necessary information and is ready to begin installing the software.

12. If you want to change any settings or information you provided, now is the time to make those changes. Click Back until you reach the dialog box containing the information you want to change.

13. If you do not need to make any changes, click Install. The installer begins copying files to your computer.

14. If the installer detects that the CD-ROM autorun feature is enabled, a message will appear giving you the option to disable this feature. Disabling it prevents undesirable interactions with the virtual machines that you install on this system.

15. You may see one or more Digital Signature Not Found dialog boxes when the installer begins to install the VMware Virtual Ethernet Adapters. You can safely ignore these warnings and click Yes or Continue to approve installation of the drivers.

16. Enter your name, company name and serial number, then click Next.

17. The serial number is located in the email you received with your download instructions for VMware ACE. The user and company information you enter here is then made available in the About box (Help > About VMware ACE Manager). If you skip this step, you are prompted to enter your serial number the first time you run ACE Manager.

18. Click Finish. The ACE Manager software is installed.

19. You may see a prompt suggesting that you reboot your PC. Reboot now to allow ACE Manager to complete the installation correctly.

For more information on VMware ACE setup and configuration, please refer to the VMware ACE documenta-tion at: www.vmware.com/support/ace/doc/index.html.


99

Setting Up a Policy ServerVMware ACE works with existing networking infrastructure to enforce many of the policies you will create with the VMware ACE Manager. One such policy is the version-based networking rules that are demonstrated in this guide. Normally, a systems administrator would deploy this policy to a Web server or directory service in the corporate network. For the purposes of this evaluation, this policy server will be simulated using a Web server on the host PC. Specifically, Microsoft Internet Information Services (IIS) will be used. For more informa-tion on using IIS, please visit the Microsoft Web site at: windows.microsoft.com/windows2000/en/server/iis/default.asp?url=/windows2000/en/server/iis/

Please note, after evaluating VMware ACE you should uninstall or “stop” your IIS Web server to prevent security and management problems. To install and configure IIS:

1. Click Start, point to Settings, click Control Panel and start the Add/Remove Programs application.

2. Select Add/Remove Windows Components icon on the left side of the Add/Remove Programs application. The Windows Components Wizard will open. Check the box next to Internet Information Services and click Next. Windows will now install IIS on your host PC.


1010

3. Now that IIS is installed, you will need to record the computer name for use later. From the Control Panel, open the System information application. Select the Computer Name tab and write down your full computer name and put it aside.


1111

4. From Control Panel, open Administrative Tools and open the Internet Information Services shortcut and make sure your default Web site is running. If it has stopped running, highlight the default Web site and click on the Play button from the tool bar.

5. To test that your Web server is functioning properly, you will create a default Web page. Open Microsoft Word or Microsoft Front Page and create a new page. Type “VMware ACE.”


1212

6. Save it in your Web server’s root directory, typically: C:\inetpub\wwwroot on your host PC. Name the file “default.htm”. If you are using Word, make sure the file type is set to “Web page.”

7. Open an Internet browser and in the address bar enter http://YOURCOMPUTERNAME from step 3. If IIS is configured correctly the browser should now be displaying your default page with the text

“VMware ACE.”


1313

Using VMware ACE

Creating a New Project Using the New Project Wizard Start the process by creating a new project for Matt’s home computing environment. A project contains a virtual machine and an application used to run the virtual machine. After you create the project, you will add a virtual machine to the project and set policies for that virtual machine.

To create a project:

1. Start ACE Manager. The first time you run ACE Manager, you are prompted to enter your serial number.

Click the New Project icon to start the New Project Wizard.

2. Click Next to enter the wizard. The Name the Project panel appears.

Enter ACE Demo in the Project Name field.


1414

3. Click Next. The Ready to Complete panel appears.

Leave the check box selected for Open the Add Virtual Machine Wizard. Click Finish to complete the New Project Wizard.

Add a Virtual Machine to the Project From this wizard you can create a new virtual machine or you may add a virtual machine created with VMware Workstation 4 or VMware GSX Server™ 3.

To add a new virtual machine to the project:

1. Click Next to enter the wizard. The Add New or Existing Virtual Machine panel appears.

Select “A new virtual machine” and click Next.


1515

2. The New Virtual Machine Wizard starts. Click Next to create a new virtual machine with the wizard.

Select Typical and click Next. The wizard prompts you to specify or accept defaults.

3. Select a guest operating system.

The remaining steps assume you plan to install a Windows XP Professional guest operating system. You can find detailed installation notes for this and other guest operating systems in the VMware Guest Operating System Installation Guide, available from the Help menu.

Select “Windows XP Professional” and click Next.


1616

4. Select a name and folder for the virtual machine.

The default folder for this Windows XP Professional virtual machine is C:\Documents and Settings\<username>\My Documents\My Virtual Machines\Windows XP Professional. Click Next.

5. Configure the networking capabilities of the virtual machine.

If you are installing the package on a host computer that is on a network and a separate IP address is available for the virtual machine (or it can get one automatically from a DHCP server), select “Use bridged networking.” Choose this setting if you are installing the package to a computer connected to an office network.

If no separate IP address is available for the virtual machine but the virtual machine must have access to the Internet, select “Use network address translation (NAT).” NAT also allows the end user to share files between the virtual machine and the host operating system.

Click Next.


1717

6. Specify the capacity of the virtual disk.

Accept the default value and click Finish to complete the Add Virtual Machine Wizard. Click Next.

Apply Policies to the Virtual MachineWhen the Add a New Virtual Machine wizard closes, the Policy Settings window opens. You are now ready to use the ACE Virtual Rights Management interface to define Matt’s computing environment. As a reminder, the requirements are:

• Set encryption and mandatory password authentication

• Set the virtual machine to expire in two months

• Turn on copy protection so Matt cannot copy the virtual machine to another computer

• Create a version-based network quarantine policy to make sure Matt’s computing environment is always up-to-date

1. Authentication Policies: Select “Encryption and authentication” from the Policy list to specify encryption and password policies.


1818

2. Encrypted Virtual Machine: Select this option to have all the files within the virtual machine automatically encrypted.

3. Password Authentication: Select Password to password-protect the virtual machine. The virtual machine will not run until the user enters the correct password. Each user must set a password the first time that user's installation of this virtual machine is opened. If you run Active Directory, you can authenticate your credentials against that system.

Click Password Policy to specify requirements for user passwords.

Select Minimum Password Length and enter “6” to force a minimum 6 character password. You can also Restrict Password Contents to require that passwords use a mix of character types . Make the selections you want, then click OK.

4. Expiration Policies: Since Matt will only need this virtual machine for two months, select Expiration from the Policy list to set an expiration date for the virtual machine. When a virtual machine expires, the files will remain on Matt's computer, but the virtual machine cannot be used.

Set the virtual machine to expire 60 days after installation. You may customize the expiration message, enable a warning message, set the lead-time for a warning message, and customize the text of the warning message.


1919

5. Copy Protection Policies: Select “Copy protection” from the Policy list to ensure that virtual machines can run only from the location where they were originally installed.

Select “Copy protect this virtual machine.” Now if Matt copies this virtual machine to a new folder or computer, the virtual machine will not run.

6. Device Connection Policies: Click the “+” sign to open the “Device connection” folder.

You may restrict Matt’s access to any of the listed devices from this window. This policy setting allows you to prevent unwanted copying of data from VMware ACE to USB memory devices or to a recordable CD or DVD.


2020

Version-based Network Access Policies You have now set the lifecycle policies and device policies of Matt’s computing environment. Now you can set network quarantine policies to control how Matt can access network resources. For example, you can:

• Allow users to access only specified machines or subnets

• Require that users have up-to-date virtual machines in order to access network resources

• Temporarily block virtual machine access to network resources to control a virus outbreak

From the Policy Settings panel, select “Network quarantine.”

Select “Quarantined - restricted access to networks and machines.” Click ”Initial Setup” to set quarantine poli-cies. The wizard guides you through the settings. You may run the wizard at any time to change the settings.

1. Click the Network Quarantine Wizard button. The Network Quarantine Options panel appears.

Select “Version-based quarantine.”


2121

2. The Policy Lookup panel appears.

Select “Web server” to deploy this policy to the IIS Web server that you set up during the beginning of this evaluation.

In the bottom field of this panel you need to specify the URL of your Web server and where your quarantine policy will be deployed. It should be http://<YOURCOMPUTERNAME>/NETQPOLICY.VMPL

You must specify your computer name in the above URL. Click Next.


2222

3. The Normal Access panel appears.

Select “Full access.” If Matt is running the latest version of the corporate virtual machine, he will have full network privileges. Click Next.

4. The Restricted Access panel appears.

Select “Allow access to selected networks and machines.” If Matt’s virtual machine is not an out-of-date version, it will be granted network access. For a version that is no longer supported, Matt can download required updates to restore his network access. In a normal deployment, Matt would access these files at his company’s remediation server. Click Next to continue.


2323

5. The Networks and Machines panel appears.

Enter the IP address or the fully qualified host name for each network or machine that this virtual machine may access (if it does not qualify for normal access), then click Add. In this example, you would enter the IP address of the company update server (e.g., patchserver.companyname.com). For demonstrations purposes, you will add vmware.com. Click Next.

6. The Restricted Access – Traffic panel appears.

Using this panel, you may set up exceptions to allow the virtual machine to communicate with certain network resources. In this case, make sure all of the boxes are checked. This will give Matt access to network printers as well as permit DHCP, DNS, and ICMP traffic. Click Next.


2424

7. The Manage Versions panel appears.

The initial version is shown with normal access, but the name is dimmed because the virtual machine has not yet been deployed.

If you update the virtual machine at some later time, you may return to this panel to specify which versions have normal access and which versions have restricted access.

Click Next to continue.


2525

8. The Message panel appears.

Use the default messages. Click Next.

9. The Summary Panel appears.

This panel displays a summary of the settings you have made using the wizard. Review the settings to be sure they are correct. Click Next.


2626

10. The Deploy Policy panel appears.

You now need to deploy this policy to your Web server. Select “Mark this policy as deployed and save it to a network quarantine policy file.” Browse to C:\inetpub\wwwroot\ and click OK.

Click Finish.


2727

Installing an Operating System and Applications in

the Virtual Machine Before deploying virtual machines to your end users, be sure they have the necessary operating system and software installed.

If you created a new virtual machine and added it to the project, you must install a guest operating system in the virtual machine. The example steps in this section describe how to install a Windows XP guest oper-ating system from an installation CD. For notes on installing all supported guest operating systems, see the Guest Operating System Installation Guide, available from the Help menu.

Installing a Guest Operating System A new virtual machine is like a physical computer with a blank hard disk. Before you can use it, you need to partition and format the virtual disk and install an operating system. The operating system’s installation program may handle the partitioning and formatting steps for you.

Installing a guest operating system inside your VMware ACE virtual machine is essentially the same as installing it on a physical computer. The basic steps for a typical operating system are:

1. Start VMware ACE Manager.

2. Insert the installation CD-ROM or floppy disk for your guest operating system.

Note: In some host configurations, the virtual machine is not able to boot from the installation CD-ROM. You can work around that problem by creating an ISO image file from the installation CD-ROM. Use the Virtual Machine Control Panel to connect the virtual machine’s CD drive to the ISO image file, then power on the virtual machine.

3. Power on your virtual machine by clicking the Power On button.

4. Follow the instructions provided by the operating system vendor.

Installing Windows XP

The next section provides notes on installing a Windows XP guest operating system.

1. Insert the Windows XP CD in the CD-ROM drive.

2. Power on the virtual machine to start installing Windows XP.

3. Follow the Windows XP installation steps as you would for a physical computer.

4. Install VMware Tools in the guest operating system.

Note: Be sure to install VMware Tools in the guest operating system. A number of key features in VMware ACE are provided by the VMware Tools package.


2828

Installing VMware Tools in a Windows Guest Operating System The detailed steps for installing VMware Tools depend on the version of Windows you are running. The steps that follow show how to install VMware Tools in a Windows XP guest. Some steps that are automated in newer versions of Windows must be performed manually in Windows 9x and Windows NT.

1. Power on the virtual machine.

2. When the guest operating system starts, prepare your virtual machine to install VMware Tools.

Choose VM > Install VMware Tools.

The remaining steps take place inside the virtual machine.

Note: You must log in to a Windows NT, Windows 2000, Windows XP, Windows Server 2003 or Longhorn guest operating system as an administrator in order to install VMware Tools. Any user can install VMware Tools in a Windows 95, Windows 98 or Windows Me guest operating system.

1. If you have autorun enabled in your guest operating system (the default setting for Windows operating systems), a dialog box appears after a few seconds. It asks if you want to install VMware Tools. Click Yes to launch the InstallShield wizard.

If autorun is not enabled, the dialog box does not appear automatically. If it doesn’t appear, run the VMware Tools installer. Click Start > Run and enter D:\setup\setup.exe where D: is your first virtual CD-ROM drive.

Note: You do not use an actual CD-ROM to install VMware Tools, nor do you need to download the CD-ROM image or burn a physical CD-ROM of this image file. The VMware ACE software contains an ISO image that looks like a CD-ROM to your guest operating system and even appears as a CD-ROM in Windows Explorer. This image contains all the files needed to install VMware Tools in your guest operating system. When you finish installing VMware Tools, this image file no longer appears in your CD-ROM drive.

2. Follow the on-panel instructions.

3. On Windows Server 2003, Windows Me, Windows 98 SE and Windows 98 guests, the SVGA driver is installed automatically and the guest operating system uses it after it reboots. With Windows 2000 and Windows XP guests, you do not have to reboot to use the new driver.

Installing Application Software If you plan to distribute application software in the virtual machine, be sure the correct software is installed.

You may install application software in the virtual machine just as you would on a physical computer, by using a CD or an installer file on a network server, for example.

If you are installing from a file on the network, you may need to change the networking configuration of the virtual machine or network settings of the guest operating system in order to navigate to the installer file. If you need to make such changes, be sure to reconfigure the settings as needed after you finish installing the application software.


2929

Running the Completed Virtual Machine To preview a virtual machine as your end users will see it, you may run the virtual machine in the VMware ACE Manager interface.

1. Click the Run in VMware ACE icon on the virtual machine summary page or the Run in VMware ACE button on the VMware ACE Manager toolbar to launch the VMware ACE interface and run the virtual machine.

2. Your computing environment will now boot up; the environment is governed by all the policies that you have created using Virtual Rights Management.

3. You can now explore the assured computing environment that you have created. In one sense, VMware ACE behaves like a normal software application. You can resize the window by dragging the bottom right corner; you can maximize and minimize the window with the sizing buttons in the top right corner. The default setting in ACE is to suspend the application on exit. You can test this by clicking on the “X” button in the top right corner and watch the environment suspend. After it’s been suspended you can resume it by clicking the “Run in ACE” link in the ACE Manager tab.

On the other hand, this application is an entirely separate and managed computing environment. Please note the simple user interface. There is only one end-user menu from which Matt can access different options such as troubleshooting.

4. After you are satisfied with the behaviors and attributes that you defined for the virtual machine, make sure you shut down the operating system as you normally would from the Start menu.

Note: You can also Power On any virtual machine in VMware ACE Manager to be sure the guest operating system and applications perform as expected. However, a virtual machine that is simply powered on in VMware ACE Manager does not follow any of the policies that you set while designing the VMware ACE package.


3030

Creating a Package Now, you must create an install package to give to Matt on a DVD. A package includes an installer and the additional files needed to install a virtual machine and the VMware ACE application that runs the virtual machine.

To create a package, take the following steps:

1. Before creating a package, be sure that the virtual machine is shut down and powered off.

2. While you have the Project tab selected, click “Create package for distribution to end users” under the Commands section. This starts the New Package Wizard.

3. The Name the Package panel appears.

Enter a name for the package in the Package Name field.

The Location field displays the path to the default location for storing the package’s files. To change the location, type a new path in the field or click Browse and navigate to the new location.

Use the Notes field to enter any background information you want to store with the package. Your end users do not see this information.

Click Next.


3131

4. The Select Package Contents panel appears. It shows the application and all virtual machines available in the project.

Click Next.

The Package Files panel appears.

Select Multiple files for distribution on DVD or CD media, the default media size for a DVD is shown. When the package wizard creates the package, it divides the package into sets of files small enough to fit on a DVD (or the media you choose in this step).

Click Next.


3232

5. The Ready to Complete panel appears.

Review the summary information. If you need to make changes, click Back. If the information is correct, click Next.

A progress bar appears while the wizard is creating the package files. It may take quite some time to complete this step, especially for packages that include large virtual machines or multiple virtual machines.

The wizard notifies you when the package is complete and tells you how many files are included in the package.

The files are now ready to burn to disc. Use disc-burning software of your choice to create the discs.


3333

Updating the Virtual Machine Version At this point, you have created a project and a virtual machine for Matt, our employee who needs to work from home two days a week for the next two months. You have mandated password authentication, set an expiration date, turned on copy protection, and deployed a version based network quarantine policy. You have also created a DVD installation package to give to Matt, so he can easily install on his home PC.

The next event in our scenario is that Microsoft has released Service Pack 2 for its Windows XP operating system. As the desktop administrator, you want to roll out this patch to all your users, including Matt.

1. Make sure that the Virtual Machine summary tab is displayed.

2. Click the Update network quarantine policy version icon on the summary tab.


3434

3. The Policy Settings panel appears.

Select the Manage Versions link.

4. You are now back in the Manage Versions panel.

5. Click on the Add Button

You can see that the initial version that was created and deployed is listed in this panel as well as the new “Update Version” that you are in the process of deploying.

To restrict the network privileges of the old virtual machines in your network, you need to move the restriction line above the “Initial Version” so that the Red Line is above the “Initial Version” but below the

“Update Version.”


3535

Now any virtual machine version that is below the red line has restricted network access. In a normal deployment, users with old virtual machines would be forced to connect to a remediation server in order to update their virtual machines. This could be an SMS server or a similar update server. Click Next.

6. You can now customize the update message that your users will see when their access is restricted.

Click Next.

7. The Summary Panel appears.


3636

This panel displays a summary of the settings you have made using the wizard. Review the settings to be sure they are correct. Click Next.

8. You now need to deploy this policy to your Web server. The Deploy Policy panel that appears looks like this.

Make sure the “Deploy the network quarantine policy file to your Web server” box is checked and that “Copy the policy file to my HTTP root directory” is also selected. Your Web server’s root directory C:\\inetpub\wwwroot should already be entered.

Click Finish.


3737

9. You have now deployed an updated policy to your Web server that will restrict the network access privileges of previous virtual machine versions. To test what Matt will see the next time he boots up his virtual machine, select the Run in VMware ACE icon/button again.

10. Your virtual machine will boot up as if it was Matt’s machine, governed by the policies that you have established. However, because you have deployed a new version to your policy server without having updated the virtual machine, the virtual machine will now have restricted network access privileges and Matt will see a warning box that contains a message you specify.

11. Click OK and the virtual machine will continue to boot up, though network access will be restricted. In our example, Matt’s network access is now restricted to www.vmware.com until he can update his operating system.

Note: For more information on updating a virtual machine and changing version numbers, please consult the Help menu from the VMware ACE Manager.

12. After the VM has booted up, shut the machine down as you normally would.

13. At this moment, Matt’s VMware ACE is restricted to only the machines that you specified in the Network and Machines Panel (in this case it is vmware.com). In a typical implementation, this would be any remediation server, patch server, or update server that systems administrators currently use. VMware ACE users do not necessarily need to buy new update servers or networking equipment to use a version-based quarantine. Now, Matt would normally connect to the remediation server and install his update. Systems administrators would include a short command (that can be found in the network quarantine wizard) in this update script, which would update Matt’s virtual machine version number. After this is done, Matt’s machine will comply with the corporate update policy.


3838

SummaryCongratulations! You have just finished a review of VMware ACE. As part of this review, you used the following key features to provision a VMware ACE for Matt:

• Virtual Rights Management (VRM)

• You set a mandatory password rule to authenticate Matt’s VMware ACE

• You set a 60-day expiration period for Matt’s VMware ACE

• Tamper resistant and copy protected environments

• You copy protected Matt’s VMware ACE so that it could not be moved or copied to another PC

• Rules-based network access

• You created a version-based network quarantine policy to prevent access if Matt’s VMware ACE is outdated

In addition, you completed the following tasks

• Created a VMware ACE installation package for a DVD to give to Matt or other users

• Created a new version of the VMware ACE package and deployed the updated policy to your Web server

• Re-tested the VMware ACE network access against the version-based network quarantine policy.

Thank you for taking the time to review and evaluate VMware ACE. If you have any questions, please contact VMware Public Relations at: http://www.vmware.com/news/pr_contacts.html.

Using ACE in the Enterprise

Business Solutions Using ACE

Business Use Benefits

Provision assured computing environments to

unmanaged remote PCs

Provision enterprise-standard PC environments to remote

PCs used by telecommuters, remote employees, or

offshore workers

• Reduce security risk from unmanaged and un-

secured PCs

• Simplify management and support of employee-

owned PCs

• Protect company assets in secure, encrypted, and

copy-protected PC environments

Provision assured computing environments to

unmanaged guest PCs

Provision time-limited, locked-down PC environments to

guest PCs used by consultants, contractors, auditors, and

other temporary workers

• Reduce security risk from unmanaged and unsecured

PCs connecting to the enterprise network

• Simplify management and support of guest worker-

owned PCs

• Protect company assets in secure, encrypted, and

copy-protected PC environments


3939

Secure Data on Enterprise PCs

Encrypt and protect sensitive enterprise and personally

identifiable information on mobile PCs

• Centralize copy protection and encryption policies

with Virtual Rights Management (VRM) technology

• Reduce theft and unauthorized copying of enterprise

and personally identifiable information

Standardize and Secure PC Environments

Provision hardware-independent PC environments

to any PC

Control PC environment lifecycle, configuration, and

compliance with IT policies

• Simplify and streamline the management and

support of enterprise PCs

• Reduce the cost of creating, testing, provisioning,

and migrating PC images

• Lockdown PCs with Virtual Rights Management

(VRM) technology while preserving end user freedom

• Reduce costs by eliminating hardware dependent PC

images

• Improve flexibility of PC purchasing and lease cycles

VMware ACE—Feature Overview

Manageability • Virtual Rights Management interface. Control VMware ACE lifecycle, system configuration, security settings,

network settings, and user interface capabilities.

• Design once, deploy anywhere. Create and deploy standardized hardware-independent PC environments to any PC throughout the extended enterprise.

Security • Rules-based network access. Identify and quarantine unauthorized or out-of-date VMware ACE environ-

ments. Enable access to the network once the VMware ACE environment complies with IT policies.

• Tamper resistant. Protect the entire VMware ACE environment, including data and system configuration, with seamless encryption.

• Copy protected. Prevent end users from copying VMware ACE to another PC. Prevent end users from copy-ing enterprise information to USB memory devices or to recordable CD/DVD media.

Usability • Customizable interface. Customize the behavior and look and feel for end users.

• Flexible computing environment. End users can revert to a previous state within seconds and work online or when disconnected from the enterprise network.


4040

VMware Professional ServicesVMware professional services can deliver deployment and implementation of key virtual infrastructure services, including customization, rapid cutover and best practices consulting. In addition, VMware has strong partnerships with consulting organizations such as IBM Global Services and HP Services that can also provide consulting services, including server consolidation, deployment, and disaster recovery.

VMware Professional Services include:

Education Services VMware Education Services provide instructor-led courses on all VMware products— from basic functionality to advanced technical usage. Courses offer extensive hands-on labs, case study examples, and course materi-als designed for use as on-the-job reference tools.

Consulting Services For delivery of both VMware custom and pre-packaged solutions, VMware has assembled a team of consult-ing professionals with an extensive knowledge of the entire VMware product family, advanced expertise in technical and systems management architectures, and strong project management discipline.

Professional Certification The VMware Certified Professional Program offers technology professionals the knowledge, skills, and creden-tials to deploy and maintain VMware virtualization technology. This program is designed for any technical individual—partners, end users, resellers, and consultants.

VMware Support ServicesVMware has designed a suite of support offerings mapped to the unique needs of our customers, ranging from simple Web-based self-service to 24/7 coverage provided by highly trained support engineers.

Customer support is a vital part of the total VMware customer experience. We want customers to get the most from our products long after the initial sale and installation. We are dedicated to ensuring that any issues are resolved satisfactorily. We recognize the need for a broad and flexible range of support options that meet the diverse needs of our customers—whether it is a single-user implementation of VMware Workstation or a complex multiplatform implementation of GSX Server and ESX Server.

VMware Web SiteFor more information about VMware support offerings, please see the VMware Support Web site at www.vmware.com/support.

For the latest technical support and troubleshooting information, the VMware support Knowledge Base can be found at www.vmware.com/support/kb/enduser/std_alp.php.

VMware Community ForumsThe VMware community, a set of moderated discussion forums hosted on the VMware Web site, is open to users of all VMware products. VMware technical staff regularly monitors the forums to learn about your issues and feedback and to help facilitate discussions, when appropriate. To participate in the community, go to www.vmware.com/community.

VMware NewsgroupsThe VMware newsgroups are primarily forums for users to help each other. VMware encourages users to read and post issues, workarounds, and fixes. While VMware personnel may read and post to the newsgroups, newsgroups are not a channel for official support. Please visit the VMware NNTP news server at news://news.vmware.com.


4141

VMware Partner AllianceVMware has established a global network of best-of-breed technology and distribution partners to expand and promote the market for compute virtualization. Our value to mutual customers is simple. Together, we deliver solutions that help businesses grow and innovate, while simplifying computing infrastructure and minimizing total cost of ownership (TCO). When organizations combine VMware software solutions with those of our global partners, they can get the most comprehensive virtual machine solutions and services on the market.

Hardware Alliance Partners

Software Alliance Partners


4242

Where to Get More Information

Media ContactAmber Rowland

Sr. Public Relations Manager

[email protected]

650-475-5338

VMware Sales

On the Web: www.vmware.com/vmwarestore/

Email: [email protected]

Phone: call 877-486-9273 (650-475-5000 outside North America)

VMware ACE Product Information www.vmware.com/products/desktop/ace_features.html

About VMwareVMware, an EMC company (NYSE: EMC), is the global leader in virtual infrastructure software for x86-based systems. The world’s largest companies use VMware solutions to simplify their IT, fully leverage their existing computing investments, and respond faster to changing business demands. VMware is based in Palo Alto, California.

VMware, Inc. 3145 Porter Drive Palo Alto CA 94304 USA Tel 650-475-5000 Fax 650-475-5001 www.vmware.comCopyright © 2004 VMware, Inc. All rights reserved. Protected by one or more of U.S. Patent Nos. 6,397,242 and 6,496,847;patents pending. VMware, the VMware "boxes" logo, GSX Server and ESX Server are trademarks of VMware, Inc. Microsoft,Windows and Windows NT are registered trademarks of Microsoft Corporation. Linux is a registered trademark of LinusTorvalds. All other marks and names mentioned herein may be trademarks of their respective companies.

REVIEWER'S GUIDE REVIEWER’S GUIDE VMWARE ACE...

Documents

Transcript of REVIEWER'S GUIDE REVIEWER’S GUIDE VMWARE ACE...