(last update: Mar-29-2018)

About NAS
NAS : Network-Attached Storage  is a file-level computer data storage server connected to a computer Network providing data access to a heterogeneous group of client.

NAS(Network-Attached Storage) can be integrated into vCloudPoint’s shared computing solution to allocate private storage for each assigned zero client User.

Synology Network Storage Installation And User Instructions

Notes:

• This installation guide only applies to NAS model DS216j used as users’ private disk. Please choose the appropriate network storage plan according to your actual needs.
• Please use Gigabit or above LAN to ensure NAS Network bandwidth.
• Please use LAN with DHCP that can automatically assign IP.
• To use the other functions of Sysnology NAS, please refer to Synology’s official website :https://www.synology.com

Hardware Models:

NAS Server: Synology DiskStation DS216j

Hard Disk: Western Digital NAS Red Disk 4TB * 2

Hardware setup:

1. Install the hard drive into the NAS, and secure it with screws.
2. Connect the NAS to the switch using Ethernet cable.
3. Connect the NAS to the power and finish the setup.

 First Time Installation:

1. Power the NAS device on, and wait for 1 to 2 minutes.
2. Open the browser with any computer in the same LAN, view http://find.synology.com or the IP address of the NAS device to enter the Web Assistant page.
3. After entering the Web Assistant page, click Install Now and confirm the hard disk mode (select the default system) to download the Synology DSM system from internet, follow the prompts to complete the installation.
4. After installing the system, create the administrator account and customize DSM update and maintenance; leave QuickConnect settings as default.
5. After initial installation is complete, enter the system;this storage solution is used only as a private disk for vCloudPoint users, other plug-ins is not required for installation.

 NAS System Quick Setup:

1. Open the control panel -> file sharing à shared folders and edit homes
2. Select: (Hide this shared folder in “My Network Places”; Hide sub-folders and files from users without permission; Enable recycle bin) Cancel: (Restrict access to administrator only)
3. Confirm the settings of the homes
4. Apply the same steps to rest of the Shared Folders.
5. Open Connectivity-> Network ->  Network Interface, select LAN and Edit:
6. IPv4 -> Usemanual configuration, set static IP address for the NAS device;
7. IPv6 ->  Select Off to turn off the IPv6, then confirm the
8. Open Connectivity-> network ->  traffic control, select the top right corner of the LAN ->  Click Edit ->  select All ports, Set the bandwidth settings. The default NAS LAN transmission bandwidth is 1 Gbps. But we recommend to set to 20000KB/s, the largest 40000KB/s. If bandwidth limitation is not set, users will use up all the bandwidth while transferring files.
9. Open System->  theme style, set page landing page title and theme as needed.
10. Open System->  Hardware & Power …you can customize Power Recovery, Beep Control, Fan Speed mode, Led Brightness Control.
11. Open File sharing-> User -> Advanced : Password Settings->  apply password strength rule, scroll down to User home ->  Enable User home services and Recycle bin.
12. Open File Sharing ->  User accounts, create users.
13. Enter the user name and password (we recommend that NAS password should be different from vCloudPoint User password), Next step.
14. System default group: leave as default, Next step.
15. Assign shared folder permissions: leave as default, Next step.
16. User quotas setting: set it according to the actual use of each user and can set to limit or unlimited, Next step.
17. Assign application permission: leave as default, Next step.
18. User speed limit: leave as default Next step.
19. Check the new user settings, confirm then Apply.
20. Select the user just created, select user -> Create-> Copy User, simply enter the user name and password, and copy all the user configuration.
21. NAS installation completed.

 Connect to the NAS device on a zero client:

1. Open the File Explorer, enter the NAS device’s IP address : \\ xxx.xxx.xxx.xxx.
2. Enter the assigned NAS user name and password, press OK.
3. Right-click the home folder, select Map Network Drive, click Finish.

(last update: Mar-29-2018)

Software Restriction for Zero Client Users by Using AppLocker Group Policy

Description:
AppLocker Group Policy for Windows system Applications can be used for restricting User or User Groups from running and installing programs.

Typically, only administrators have the permission to install programs. But green software and other software package do not necessarily need administrators’ permission to be installed. So using AppLocker Group policy can directly limit the User from accessing and installing all programs.

Tips：

• AppLocker Group Policy needs to be used in conjunction with User Account Control (UAC). Please refer to User Account Control Guide to turn on UAC.
• Before setting up AppLocker, please standardize the program installation path, be sure to install the required programs in C: \ Program Files or C: \ Program Files (x86) path. As Program Files folder is a kind of system file, which requires the administrator permission to make changes.
• Recommended operating systems: Windows 7 (Ultimate, Enterprise), Windows 8.1 Enterprise, Windows 10 (Professional, Enterprise), Server 2008R2 Standard, Datacenter, Server 2012R2 (Standard, Datacenter), Server 2016 (Standard, Datacenter).

Quick Configuration Steps:

• Enter Service, set the Application Identity startup type to automatic
• Enter the local Group Policy Editor àAppLocker
• Executable rulesà Windows installer rulesà and script specifications create default rules
• AppLocker open Configuration rules
• Restart the host, Then the AppLocker settings will take effect.

(last update: Mar-29-2018)

Restrict Zero Client Users To Modify System Files & Setting By Using User Account Control (UAC)

Description:
User Account Control (UAC) is a new set of infrastructure technologies in Windows Vista (and later Microsoft operating systems) that helps prevent malicious programs from damaging your system and helps organizations deploy easier-to-manage platforms.

With UAC, applications and tasks always run in the security context of a non- admin administrator account, except when an administrator specifically grants administrator-level access to the system. UAC will prevent the automatic installation of unauthorized applications to prevent inadvertent changes to the system settings can effectively limit the zero client user to modify the system.

Tips：

• • Administrators must use a complex password.
  • Do not add zero client users to the administrator group as UAC restrictions do not apply to administrators.
  • After enabling UAC, when a nornal user attempts to open a folder that needs admin permission, he will be asked to enter the admin password. IT admins are suggested not to grant a normal user with admin-level access to temporarily access a restricted folder. Because once it is done, the normal user will have permanent access to this folder.
  • UAC is recommened to be used with C Drive Access Restriction. For more detalis, please refer to the document of Restrict User Access To C Drive.
  • Note: UAC is enabled by default in certain Windows Systems.

Enabling UAC:

1. Open control panel, click User Account and Family Safety.
2. Click User Account.
3. Click Change User Account Control Settings.
4. Adjust the level to the third level or the highest level and click OK.
5. UAC settings are completed; restart the host.

(last update: Mar-29-2018)

Restrict Users Access To C Drive through Group Policy

Note:

• You can configure the Group Policy to prevent access to C drive through system File Manager, but you cannot restrict access through third-party file manager, for example, decompression software.
• After you restrict access to C drive by Group Policy, all users, including the Admin account, cannot access C drive. Therefore, before you configure the Group Policy, you shall complete all installations and settings in C drive.
• Although the default desktop file path is in C drive. (C \ Users \username \ Desktop), after the restriction configuration, users can still create, download or drag files onto the desktop, but the “paste” function on desktop is disabled. If you want to re-visit C drive, just modify the related Group Policy setting back to the default.
• When you configure C drive access restriction, you are suggested to have UAC enabled, otherwise, users are able to modify Group Policy to re-gain C drive access. For more details about UAC, refer to the “User Account Control” guide.

1. Configuration Steps:
   Log into the host with the Administrator account, run “gpedit.msc” to open the Group Policy Editor.
2. Computer Configuration>> User Configuration >>Administrative Template>>Windows Components>>Windows Explorer>> Prevent access to drives from My computer>> Edit policy setting.
3. Enable this setting and select “Restrict C drive only” , click “OK“.

Most customers mistakenly think that a zero client should be, like thin clients, configured high in its internal hardware such as, CPU, flash, network chipset, to grantee a high performance.

Unlike x86 thin clients that are typically required for standalone usage and have local system and software. vCloudPoint offer nothing locally but just enable users to connect to a remote desktop. In other words, the residing hardware of a zero client do not act on jobs of processing locally as in thin clients, but only to initialize a conversation with the network, begin network protocol processes, and display desktop output. Therefore, the configuration of a zero client itself does not contribute to its performance. Even a zero client with powerful configuration as a Pro PC can’t guarantee good performance.

Then what helps with good performance to a zero client?

There are a few aspects

• Well-configured host computer– including sufficient cores and frequency of CPU,  IOPS and stroage of Disks, size and frequency of Memory. (Multi-threading technology of Intel also helps increasing CPU capability and i series with hardware acceleration performs better than Xeon series of the same level. Disks in RAID configuration increases redundancy and performance. Intensive graphics processing requires sufficient frequency of memory. Video card on the host helps in video playback only.)
• Low latency, high-bandwidth network– recommend local-area network connections provided by standard 100 /1000 Mb/sec networks (i.e. Ethernet) between the host computers and the vCloudPoint.
• High efficient remote display protocol– offers high-resolution sessions, multimedia stream remoting, dynamic object compression, USB redirection, drive mapping and more.

Of the above 3 aspects, only the display protocol is determined by the vCloudPoint. The display protocol determines two critical measures: experience and resource usage. The sticking point for many organizations will be various levels of multimedia support. Regardless of implementation status, any organization can have issues with multimedia support. This is true not only in large implementations that push bandwidth limits — even smaller installations may consume enough bandwidth to push the limits of the display protocol without a bottleneck on the wire. vCloudPoint vCloudPoint utilized our innovative DDP (Dynamic Desktop Protocol) for remote desktop display. This protocol is purpose-built for vCloudPoint and is designed to make efficient use of the network bandwidth and host resources, delivering a user experience that is equivalent to or even better than a business PC.

(By vCloudPoint)

We all know the vCloudPoint are free of CPU, memory, processor and hardware requirements. This means that another strong factor plays a role in transmitting of the information from server to client. That is the network. And in case of vCloudPoint, this network bandwidth should be really wide and sufficient enough for the seamless transfer of information.

Let us start with an example. S100 zero client uses Ethernet as the network connection. The deployment so far has registered recognition about its appreciable performance, which is attained with the category 5 or 6 network cable to connect to the Ethernet network. The next question is:

What is a Category-5 or Category-6 cable??

Usually, the high quality copper wires are used for Cat-5/ 6 cabling. They are twisted into 4 pairs which run along an outer cover. This design of the cable makes it immune to the other signal interferences, which means a better transmission of the data signal over the cable.

Most of the times, the poor cabling is responsible for the faulty network transmission. This very often leads to the unnecessary testing of the other equipments. There are a few very high standards tagged with the category 5 and 6 cabling, which must be followed during installation as well. This guarantees a high performance over the network.

Recommendation With Us:

For multimedia intensive environments, especially those with concurrent multiple video playback, we recommend a standard 100 /1000 Mbps network between the host computer and the vCloudPoint, to guarantee a smooth high-end experience; as shown in the figures: (click to view large pictures)

The videos consume higher bandwidth, for example, when the server side videos are played at vCloudPoint vCloudPoint, each 480p video file consumes up to 13 Mpbs of the network bandwidth, a 720p video can take up to 15 Mpbs of bandwidth and a 1080p video can take up to 17 Mpbs of bandwidth straight away.

Most of the Wide Area Networks (WAN) have excessive latency and lower bandwidth. This compromises with the rich PC-like experience over the network.

The ideal recommendation from vCloudPoint is a low latency higher bandwidth Local Area Network, which is the secret behind the excellent performance of zero client devices.

(By vCloudPoint)

Thin clients used to be the thinnest, but now vCloudPoint are giving them a run for their money with almost no storage or configuration requirements.

vCloudPoint are similar to thin clients in their purpose — accessing a desktop in a data center — but vCloudPoint require a lot less configuration.

vCloudPoint tend to be small and simple devices with a standard set of features that support most users. They also tend to be dedicated to one data center desktop product and remote display protocol. Typically, configuration is simple with a couple dozen settings at the most, compared to the thousands of settings in a desktop operating system. vCloudPoint load their simple configuration from the network every time they are powered on, which means the vCloudPoint at a site will all be the same.

vCloudPoint support access to a variety of desktop types, terminal services, a virtual desktop infrastructure or dedicated rackmount or blade workstations.

vCloudPoint vs. thin clients

The basic premise of a zero client is that the device on the user’s desk doesn’t have any persistent configuration. Instead, it learns how to provide access to the desktop from the network every time it starts up. This gives a lot of operational benefits because the zero client devices are never unique. This contrasts with a thin client, which may have local applications installed and will hold its configuration on persistent storage in the device.

The original thin clients were much like what we now call vCloudPoint. They were simple devices that gave access to a desktop in a data center. Two factors led to the evolution of thin clients into thicker devices. The first was PC makers’ entry into the thin client market, and the second was a need to work around the limitations of remotely displaying a Windows desktop.

A brief history of thin clients

Thin clients became a mainstream product class shortly after Microsoft introduced Windows Terminal Server and Citrix launched MetaFrame, both in 1998. To enter this market, PC manufacturers cut down their desktop hardware platforms. They repurposed their PC management tools, reusing as much technology as possible from their existing PC businesses. This meant that a fairly customized Windows or Linux setup could become a thin client. But even a customized Linux build usually has local configuration and a fair bit of storage. As a result, these thin clients were not so thin, and their management tools could be relatively complex.

The other motivation to thicken clients was the need to handle rich media, such as video. Early remote display protocols didn’t produce great results, so technologies for thin client video rendering appeared. These used media players on the thin client rather than in the desktop, transferring the compressed video stream over the network. Now the thin client needed video codecs as well as a local operating system.

Over time, optional features for USB redirection, a local Web browser, Voice over IP integration agents and multi-monitor display support were added. Each additional feature increased the configuration and complexity of the thin client. After a few years, thin clients turned into small PCs. Some even added PCI or PC Card slots.

These thicker thin clients get quite close to a full PC in terms of capabilities and complexity. Instead of simplifying management, the thin clients forced IT administrators to manage the device on the user’s desk as well as in the data center. This is obviously not what we had in mind. vCloudPoint are a return to the simpler devices on user’s desks with simpler management.

Operational and security benefits of vCloudPoint vs. thin clients

Any worker can use any zero client because the zero client doesn’t store anything unique. This gives workers the flexibility to access their desktops from any zero client anywhere in the organization, reducing the need for employees to carry laptops between branch offices or shared desks. An organization can simply provide desks with vCloudPoint, with all uniqueness stored in the data center desktop.

Another benefit is that a new zero client can be shipped directly to the user. There’s no need for desk-side support or preconfiguration. All the zero client needs is a network connection and a power source. For an organization with many branch offices, this simplicity saves time and makes it considerably easier to set up a new hire or support a worker whose device is failing. Companies can even keep a spare zero client at each branch, which eliminates shipping delays.

vCloudPoint usually load their configuration from the network, often from a few files and shared by every zero client at a site. Changing a configuration generally means changing these shared files and then rebooting the vCloudPoint. Updating vCloudPoint is generally the same process: Place a new firmware file alongside the configuration files and reboot the vCloudPoint. The new firmware is automatically loaded when the zero client boots. This makes it fairly simple to keep zero client builds consistent, so long as users turn off their vCloudPoint at the end of the day.

One common reason to deploy data-center-based desktops is to contain data so a company’s intellectual property isn’t distributed to every desk. Because vCloudPoint usually have almost no persistent storage, there is far less chance of critical data remaining on the device. Also, the zero client doesn’t run a general purpose operating system, so it’s unlikely to be compromised by a virus or network intrusion. In fact, this lack of local storage is a deciding factor for deploying vCloudPoint in some highly secured environments.

vCloudPoint provide these benefits without the intrusion of a local operating system. For example, users don’t want to see how the client device handles the USB key they just plugged in — only their desktop should care. With thin clients, however, a local operating system must identify and handle the USB device before handing it over to the remote display client and then the user’s desktop. Besides this being a slow process, there’s an increased chance that something along the way will fail. vCloudPoint simply hand the USB device directly to the desktop, resulting in a far more PC-like experience. vCloudPoint also tend to show a far leaner local interface, getting to the user’s desktop with fewer dialogue boxes than thin clients.

(This was last published in April 2014 by Alastair Cooke on searchvirtualdesktop.techtarget.com)

vCloudPoint and thin clients both offer virtual desktop access, but they aren’t the same when it comes to performance and scalability.

A zero client is similar to a thin client in that both provide access to virtual desktops, but they have significant differences when it comes to performance, usability and security.

A zero client is a lightweight appliance that gives the user access to a desktop stored in a data center. A thin client is more like a small PC, with few expansion options. It too can be a portal to a desktop in a data center, but it can also bring a lot of complexity.

Zero client vs. thin client computing: Plug and play

vCloudPoint provide the most PC-like experience for virtual desktop infrastructure (VDI). One example has to do with USB plug-and-play. When using a PC or thin client with a local operating system, there are three plug-and-play cycles when you plug in a USB device:

Local device plug-and-play. Device detection and driver installation for the USB device
VDI client overtake. Replacing the local operating system driver with a redirection driver
Remote plug-and-play (inside the virtual desktop). Device detection and driver installation for the USB device
It can take a while, sometimes minutes, from the time you plug in the USB key until it shows up as a recognized device. Usually, the first two plug-and-play actions aren’t visible to the user, so they give up in frustration and remove the USB key before the third stage begins.

With a zero client, however, there should be no local plug-and-play. The whole USB experience is transferred to the virtual desktop in the data center. Only the remote plug-and-play inside that desktop occurs, and the user can see it, so the user knows to wait for it to finish.

Zero client vs. thin client performance and manageability

vCloudPoint tend to offer high performance. They should be well optimized for one VDI protocol and provide a great user experience with fast, smooth scrolling and the best video playback the network will allow. User experience is the defining factor in VDI success, so it is critical to use a device optimized for the VDI protocol. vCloudPoint usually provide the best display performance for the protocol.

vCloudPoint tend to be much simpler to manage, configure and update. Zero client firmware images are a few megabytes in size, compared with the multiple gigabytes that thin client operating systems take up. The update process is much quicker and less intrusive on a zero client than on a thin client, possibly occurring every day when the zero client boots. Thin clients need to be patched and updated as often as the desktop operating system they carry, but vCloudPoint have no operating system, so they need fewer updates.

vCloudPoint have few knobs and switches to turn — probably fewer than 100 configuration items in total — so they are simple to manage. Often, their bulk management is a couple of text files on a network share somewhere. Thin clients have a whole operating system to manage, with tens of thousands of settings necessitating complex management applications, usually on dedicated servers at multiple sites.

A zero client is like a toaster: A consumer can take it out of its packaging and make it work. If the consumer is your staff at a remote branch, then there are a lot benefits to having them be able to do the deployment of a new terminal.

Sometimes, thin clients need special builds or customized settings applied to them before they are deployed — not ideal for rapid deployment. The ability to rapidly scale can be important when it comes to something like opening a call center to accommodate an advertising campaign or a natural disaster response.

Another advantage of vCloudPoint is their lower power consumption. Thin clients have mainstream CPUs and often graphics processing units, but a zero client usually has a low-power CPU (or none at all), which cuts down on power consumption and heat generation. The simplicity of vCloudPoint also makes for a much smaller attack surface, so placing them in less trusted networks is not so worrying. Also, placing them in physically hostile locations is safe; lower power and usually passive cooling mean that heat, dust and vibration are less likely to cause maintenance problems.

vCloudPoint are all the same. Models aren’t released every few months, but every couple of years, so your fleet will contain fewer different models. That means there’s no need for help desk calls to move a device from one desk to another, plus a much more consistent user experience. Your supplier’s inventory of vCloudPoint will also have fewer models, which should lead to better availability when you need new vCloudPoint.

(This was last published in April 2014 by Alastair Cooke on searchvirtualdesktop.techtarget.com)