Voila: A command prompt with elevated rights :. The next step is to create an account and add this one to the local admin group. Therefore, you need to enter the following commands:. And voila — you can now login with your just created user without a password :. For my first tests I just wanted to connect multiple users to the machine without joining the VM to the AD to prevent impacts by policies or something else.
I created three local users:. When I logged of my created Administrator all three had been available on the Welcome-Screen to Login:. A RDP connection was not possible at this time. As you can see Remote Desktop was not allowed:. Time for another RDP-Test.
The first user logged on successfully — but the second received the message that already two users are logged on and one must disconnect:. That was not the behavior I expected. And now something interesting happened. When shutting down this was shown:. And after booting Windows showed this: All Windows Updates had been installed before and I added no other Windows features, functions or any programs. So what was installed now? The Welcome-Screen after the reboot also looked different: Before you could see the created users and select one for login — now you need to enter username and password.
Looks quite familiar to an RDSH host after booting or? So logging in with the local admin again and directly this message was displayed:. And guess? Time for the next tests. I reverted to a snapshot where I just had created the local Admin-User.
I logged in and joined the machine to the domain:. Interestingly this was already enabled. Furthermore it was not possible to disable it any longer. There had been no policies applied to enable this setting — only the default Domain Policy was active. Like before the logon of a third user was denied:.
But as we already know a reboot is necessary to install the missing features. Like before magically some features are installed:. So connect the Virtual Apps and Desktop 7 — iso and start the Component selection. Just a quick reminder: None of the things I test here are designed or supported to work under such circumstances.
After accepting the license agreement the Component selection appeared. I selected all available Components. The error just showed something failed with DISM. So I just installed the IIS with all available components manually.
I decided to first have no deeper look into this issue and remove all components that require the ,IIS: Director and StoreFront. The installation of the other components worked without any issues — as you can see all selected components are installed on Windows 10 Enterprise for Virtual Desktops.
Time to create a Site on our Windows 10 Delivery Controller. The Summary shows that the Site was successfully created. And the Citrix Studio now shows the option to create Machine Catalog. And a last check of the services: Everything is running fine.
The summary shows the selected components and the Requirements. The installation started…. The first step is to select the Operation System. I selected the created Machine Catalog…. The Summary shows the configured settings. For Windows 10, version , the following are the optimization settings applied to the default user profile registry hive to optimize performance:.
In the local policy settings, you might want to disable images for backgrounds in VDI. If you do want images, you might want to create custom background images at a reduced color depth to limit network bandwidth used for transmitting image information. If you decide to specify no background image in local policy, you might want to set the background color before setting local policy, because once the policy is set, the user has no way to change the background color.
It might be better to specify " null " as the background image. There is another policy setting in the next section on not using background over Remote Desktop Protocol sessions. If the equivalent settings are not specified in any other way, such as group policy, the settings would still apply.
The following settings were chosen to not counter or conflict with any setting that has anything to do with security. These settings were chosen to remove settings or disable functionality that might not be applicable to VDI environments. We recommend using a low resolution, non-complex image so less data is transmitted over the network each time the image is rendered. If you enable this policy setting, automatic learning stops, and any stored data is deleted.
Users can't configure this setting in Control Panel. Windows doesn't connect to an online font provider and only enumerates locally-installed fonts.
Disable passive polling check box Enabled. Use this setting if you're on an isolated network or using a static IP address. Offline files Allow or disallow use of Offline Files. In the disabled state, no Teredo interfaces are present on the host. The Connect to suggested open hotspots , Connect to networks shared by my contacts , and Enable paid services are turned off, but users on this device can enable them.
If you enable this setting, apps and system features won't be able to receive notifications from the network from WNS or by using notification-polling APIs. Enabled Device installation Prevent device metadata retrieval from the Internet Enabled Device installation Prevent Windows from sending an error report when a device driver requests additional software during installation Enabled Device installation Turn off Found New Hardware balloons during device installation.
Turns off web-to-app linking and http s URIs are opened in the default browser instead of starting the associated app. The Windows device is not discoverable by other devices, and can't participage in cross-device experiences.
If you enable this policy setting, all Windows Update features are removed. Windows automatic updating is also disabled; you'll neither be notified about nor will you receive critical updates from Windows Update. This policy setting also prevents Device Manager from automatically installing driver updates from the Windows Update website.
If you enable this policy setting, when you are presented with a certificate issued by an untrusted root authority, your computer won't contact the Windows Update website to see if Microsoft has added the CA to its list of trusted authorities. NOTE: Only use this policy if you have an alternate means to the latest certificate revocation list. This policy setting turns off the active tests performed by the Windows Network Connectivity Status Indicator NCSI to determine whether your computer is connected to the Internet or to a more limited network As part of determining the connectivity level, NCSI performs one of two active tests: downloading a page from a dedicated Web server or making a DNS request for a dedicated address.
If you enable this policy setting, NCSI does not run either of the two active tests. With this setting enabled, the background image shows without blur. If you disable or do not configure this policy setting, the local computer clock doesn't synchronize time with NTP servers. NOTE: Consider this setting very carefully. Windows devices that are joined to a domain should use NT5DS.
Virtual machines sometimes use "enhancements" or "integration services". If you enable this policy setting, the advertising ID is turned off.
Apps can't use the ID for experiences across apps. If you choose the Force Deny option, Windows apps are not allowed to access account information and employees in your organization cannot change it. If you choose the Force Deny option, Windows apps are not allowed to access the call history and employees in your organization cannot change it. If you choose the Force Deny option, Windows apps are not allowed to access contacts and employees in your organization cannot change it.
If you choose the Force Allow option, Windows apps are allowed to access email and employees in your organization cannot change it. If you choose the Force Deny option, Windows apps are not allowed to access location and employees in your organization cannot change it.
If you choose the Force Deny option, Windows apps are not allowed to access messaging and employees in your organization cannot change it. If you choose the Force Deny option, Windows apps are not allowed to access motion data and employees in your organization cannot change it. If you choose the Force Deny option, Windows apps are not allowed to access notifications and employees in your organization cannot change it.
If you choose the Force Deny option, Windows apps are not allowed to access tasks and employees in your organization cannot change it. If you choose the Force Deny option, Windows apps are not allowed to access the calendar and employees in your organization can't change it. If you choose the Force Deny option, Windows apps are not allowed to access the camera and employees in your organization can't change it.
If you choose the Force Deny option, Windows apps are not allowed to access the microphone and employees in your organization can't change it. If you choose the Force Deny option, Windows apps are not allowed to access trusted devices and employees in your organization can't change it. If you choose the Force Deny option, Windows apps are not allowed to communicate with unpaired wireless devices and employees in your organization can't change it. If you choose the Force Deny option, Windows apps won't have access to control radios and employees in your organization can't change it.
If you choose the Force Deny option, Windows apps are not allowed to make phone calls and employees in your organization can't change it. If you choose the Force Deny option, Windows apps are not allowed to run in the background and employees in your organization can't change it.
If you enable this policy setting, Autoplay is disabled on CD-ROM and removable media drives, or disabled on all drives. This policy setting prevents Windows tips from being shown to users. If you enable this policy setting, users will no longer see personalized recommendations from Microsoft and notifications about their Microsoft account.
SmartScreen will be turned off for all users. Users will not be warned if they try to run suspicious apps from the Internet. When Find My Device is off, the device and its location are not registered and the Find My Device feature will not work. The user will also not be able to view the location of the last use of their active digitizer on their device.
File Explorer Turn off caching of thumbnail pictures Enabled File Explorer Turn off display of recent search entries in the File Explorer search box Enabled File Explorer Turn off the caching of thumbnails in hidden thumbs. Users won't receive enhanced suggestions while typing in the Address bar. In addition, users won't be able to change the Suggestions setting.
If you enable this policy setting, user won't be suggested matches when entering Web addresses. The user can't change the auto-complete for setting web addresses. If you enable this policy setting, browser geolocation support is turned off. If you disable this policy setting, the entry points and functionality associated with this feature are turned off. If you enable this policy setting, the user cannot use the Compatibility View button or manage the Compatibility View sites list.
Microsoft collects your browsing history to improve how flip ahead with page prediction works. This feature isn't available for Internet Explorer for the desktop.
If you enable this policy setting, flip ahead with page prediction is turned off and the next webpage isn't loaded into the background.
If you enable this policy setting, the location feature is turned off, and all programs on this computer are prevented from using location information from the location feature. If you enable this setting the automatic download and update of map data is turned off. If you enable this policy setting, features that generate network traffic on the Offline Maps settings page are turned off.
Note: This might turn off the entire settings page. This policy setting allows backup and restore of cellular text messages to Microsoft's cloud services. Turns off compatibility lists in Microsoft Edge.
If you disable this setting, the Microsoft Compatibility List isn't used during browser navigation. Directs Edge to open with blank content when a new tab is opened. Disables autofill on address bar. If you enable this setting, Do Not Track requests are always sent to websites asking for tracking info.
If you disable this setting, employees can't use Password Manager to save their passwords locally. Users can't see search suggestions in the Address bar of Microsoft Edge. If you enable this setting, you can configure one or more Start pages. Windows Defender SmartScreen is turned off and employees can't turn it on. NOTE: Consider this setting within the environment. If not connected to the Internet, this will prevent the computers from trying to contact Microsoft for SmartScreen information.
Users won't see the First Run page when opening Microsoft Edge for the first time. Enable this setting to prevent the OneDrive sync client OneDrive. Unless OneDrive is used on- or off-premises.
If you enable this policy setting, the ability to synchronize feeds and Web Slices in the background is turned off. When Cortana is off, users will still be able to use search to find things on the device.
If you enable this policy setting, queries won't be performed on the web and web results won't be displayed when a user performs a query in Search. Share usage information but don't share search history, Microsoft account info or specific location. Enabling this setting prevents this computer from sending data to Microsoft regarding its activation state.
Will not periodically check for updated speech models. If you enable this setting, the automatic download and installation of app updates is turned off. If you enable this setting, the automatic download of app updates is turned off. If you enable this policy setting, "sync your settings" will be turned off, and none of the "sync your setting" groups will be synced on this device.
Only if not opted-in for MAPS diagnostic data. If you enable this setting, Windows Defender Antivirus enhanced notifications will not display on clients. If you enable this setting, definition update sources will be contacted in the order specified. Once definition updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted. Enabling this policy will disable that functionality, and might cause connection to public services such as the Windows Store to stop working.
NOTE: This policy applies only when this device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy. Selecting Disable preview builds will prevent preview builds from installing on the device.
Disables preview builds. Enable this policy to specify the level of Preview Build or feature updates to receive, and when. Enable this setting if you would like to prevent the OneDrive sync client OneDrive. If you enable this policy setting, Windows Defender will not send notifications with critical information about the health and security of your device.
The system does not conduct the final drive search. It just displays a message explaining that the file is not found. The people icon will be removed from the taskbar, the corresponding settings toggle is removed from the taskbar settings page, and users will not be able to pin people to the taskbar.
Start Menu and Taskbar Turn off feature advertisement balloon notifications Enabled. Users cannot pin the Store app to the Taskbar. If the Store app is already pinned to the Taskbar, it will be removed from the Taskbar on next sign in. If your environment does not connect to the Internet at all, or connects indirectly, you can set a group policy setting to remove the Network icon from the Taskbar. The reason you might want to remove the Network icon from the Taskbar is if you turn off Internet connectivity checks, there will be a yellow flag on the Network icon, even though the network might be functioning normally.
If you would like to remove the network icon as a group policy setting, you can find that in this location:. If you're considering disabling your system services to conserve resources, great care should be taken that the service being considered isn't in some way a component of some other service. Note that some services are not in the list because they can't be disabled in a supported manner. Most of these recommendations mirror recommendations for Windows Server , installed with the Desktop Experience in Guidance on disabling system services on Windows Server with Desktop Experience.
Many services that might seem like good candidates to disable are set to manual service start type. This means that the service won't automatically start and isn't started unless a process or event triggers a request to the service being considered for disabling.
Services that are already set to start type Manual are usually not listed here. You can enumerate running services with this PowerShell sample code, outputting only the service short name:. Per-user services are services that are created when a user signs into Windows or Windows Server and are stopped and deleted when that user signs out.
These services run in the security context of the user account - this provides better resource management than the previous approach of running these kinds of services in Explorer, associated with a preconfigured account, or as tasks. Per-user services in Windows 10 and Windows Server. If you intend to change a service start value, the preferred method is to open an elevated. For more information on using 'Sc. The following list of tasks are those that perform optimizations or data collections on computers that maintain their state across reboots.
When a VDI VM task reboots and discards all changes since last boot, optimizations intended for physical computers are not helpful. You can get all the current scheduled tasks, including descriptions, with the following PowerShell code:. There are several tasks that can't be disabled via script, even if you're running elevated. We recommend that you don't disable tasks that can't be disabled using a script.
Whether from Microsoft Update, or from your internal resources, apply the available updates including Windows Defender signatures. This is a good time to apply other available updates including Microsoft Office if installed, and other software updates. If PowerShell will remain in the image you can download the latest available help for PowerShell by running the command Update-Help.
At some point during the image optimization process available Windows updates should be applied. There is a setting in Windows 10 Update Settings that can provide additional updates:. This would be a good setting in case you are going to install Microsoft applications such as Microsoft Office to the base image. That way Office is up to date when the image is put in service.
There are also. NET updates and certain third-party components such as Adobe that have updates available through Windows Update.
One very important consideration for non-persistent VDI VMs are security updates, including security software definition files. These updates might be released once or more than once per day. There might be a way to retain these updates, including Windows Defender and third-party components. The updates are going to apply nearly every logon session, but the updates are small and should not be a problem.
Additionally, the VM won't be behind on updates because only the latest available updates will apply. The same might be true for third-party definition files.
Modern versions of Office such as Microsoft update through their own mechanisms when directly connected to the Internet, or via management technologies when not.
Windows is configured, by default, to collect and save limited diagnostic data. The purpose is to enable diagnostics, or to record data if further troubleshooting is necessary.
Automatic system traces can be found at the location shown in the following illustration:. Others, such as the 'WiFiSession' trace can be stopped. To stop a running trace under Event Trace Sessions right-click the trace and then click 'Stop'. Use the following procedure to prevent the traces from starting automatically on startup:. The above article contains procedures to service the 'gold' VDI image, and how to maintain the VDI clients as they are running.
To reduce network bandwidth when VDI computers need to update their Windows Defender signatures, stagger reboots, and schedule reboots during off hours where possible. The Windows Defender signature updates can be contained internally on file shares, and where practical, have those files shares on the same or close networking segments as the VDI virtual machines.
There are some registry settings that can increase network performance. This is especially important in environments where the VDI or computer has a workload that is primarily network-based.
The settings in this section are recommended to bias performance toward networking, by setting up additional buffering and caching of things like directory entries. Some settings in this section are registry-based only and should be incorporated in the base image before the image is deployed for production use. The following settings are documented in the Windows Server Performance Tuning Guideline , published on Microsoft. Applies to Windows The default is 0. By default, the SMB redirector throttles throughput across high-latency network connections, in some cases to avoid network-related timeouts.
Setting this registry value to 1 disables this throttling, enabling higher file transfer throughput over high-latency network connections. Consider setting this value to 1. The default is 64 , with a valid range of 1 to This value is used to determine the amount of file metadata that can be cached by the client. Increasing the value can reduce network traffic and increase performance when many files are accessed. Try increasing this value to The default is 16 , with a valid range of 1 to This value is used to determine the amount of directory information that can be cached by the client.
Increasing the value can reduce network traffic and increase performance when large directories are accessed. Consider increasing this value to The default is , with a valid range of 1 to This value is used to determine the amount of file name information that can be cached by the client. Increasing the value can reduce network traffic and increase performance when many file names are accessed.
The default is This parameter specifies the maximum number of files that should be left open on a shared resource after the application has closed the file. Where many thousands of clients are connecting to SMB servers, consider reducing this value to Registry-only settings can be configured by using Windows PowerShell as well, as in the following example:.
Microsoft has released a baseline, created using the same procedures as the Windows Security Baselines , for environments that are either not connected directly to the Internet, or wish to reduce data sent to Microsoft and other services. The Windows Restricted Traffic Limited Functionality Baseline settings are called out in the group policy table with an asterisk.
After the image is prepared, updated, and configured, one of the last tasks to perform is disk cleanup. There is a built-in tool called the "Disk Cleanup Wizard" that can help clean up most potential areas of disk space savings. On a VM that has very little installed, but was fully patched you can usually get about 4GB disk space freed up running Disk Cleanup.
Here are suggestions for various disk cleanup tasks. These should all be tested before implementing:. Run elevated Disk Cleanup Wizard after applying all updates. This process can be automated, using command line Cleanmgr.
On a test VM, from a clean installation, running Cleanmgr. If you set more options, or all options, those options are recorded in the registry, according to the Index value provided in the previous command Cleanmgr. In this case, we are going to use the value 11 as our index, for a subsequent automated disk cleanup procedure. After running Cleanmgr. You can check every option, and then click OK. The Disk Cleanup Wizard disappears and your settings are saved in the registry.
