One of the problems that has continued to plague Windows is the ability for users, administrative or not, to execute programs from unsafe temporary file system locations sometimes bypassing security controls. UAC has helped to reduce the attack surface along with the Windows integrity mechanism that monitors and restricts files based on a level of trustworthiness.  Combine that with a good anti-virus product and sometimes the bad stuff can still get through, even when accidentally executed from a dangerous location such as temporary internet files. Internet Explorer contributes to this problem as the only major browser on the market that actually allows execution directly from a download (which can happen accidentally). Chrome and Firefox require a download to be saved to disk first then manually executed after the download is completed. This alone is good enough reason to not use IE for daily casual browsing.

Microsoft’s AppLocker is a free built-in group policy utility that comes with the Enterprise and Ultimate versions of Windows that puts a stranglehold on the execution environment of the OS. Unlike the troublesome software restriction policies of long ago, AppLocker provides an intuitive and highly customizable framework to protect your PC and servers, if desired. AppLocker works for home or corporate PCs and can be configured using group policy. I have configured AppLocker on every Win7 PC I’ve built for friends or family for years and they do not have malware problems. Period.

Best practices for novice or intermediate user PCs:

• Users should not run as administrators, remove the user account from local admins
• Enable the local admin account and set a password
• Run a quality antivirus product
• Ensure UAC is enabled and set to the default level
• Configure AppLocker to protect the OS

Accessed from within the local computer security policy (gpedit.msc) or via group policy in a AD domain, AppLocker can be found in the Application Control Policies section below Security Settings.

A number of different rule types can be configured and new for Win8/ Server 2012, AppLocker now supports Packaged apps, which I’ll talk about in the section that follows.

Executable Rules

Executable rules are by far the simplest and most effective means of providing solid protection. First thing to do is to create the default rules: right-click in the white space in the right pane, click “create default rules.” These rules will ensure that executables can only be run from within the trusted program files and windows folders. Administrators will be allowed to execute any file regardless of file system location. Anything that is executed from the desktop or temp folders, for example, will be denied.

For the PC of a non-administrative user, to execute a file outside of the specified safe locations will require both intent and elevation via UAC to run; no accidents will be possible.

Applications that are not installed for “all users” of a PC are typically installed to a space in %userprofile%\AppData. These applications will need to be individually permitted or they will subsequently fail to run. The easiest method providing the best protection is to configure path rules for each application as required.

If this is too troublesome, a publisher rule will suffice which will cast a wider net allowing any application of a given publisher or product to execute. Move the slider to enforce more or less granularity as desired.

Windows installer and script rules can also be used to to provide further restrictions. Use care if you choose to enable these as frustration could ensue when trying to install certain applications afterwards.

Packaged App Rules

For Windows 8 and Server 2012, having the interface formerly known as Metro and apps to go with it, AppLocker provides a new mechanism to comprehend these “packaged apps.” The options are more limited but provide suitable protection and control.

Create a packaged app rule by first choosing a reference file from the Metro apps installed:

Adjust the slider to specify a publisher, package or version rule:

Enforcement

Any configured rules will be enforced by default unless you specify Audit Only in the enforcement properties.

For any configured rules to actually take affect, the Application Identity service must be running. Set the service to Automatic and start it.

Follow these recommendations and you should never have to clean another malware infested PC again. I honestly can’t remember the last time I’ve had to.

References:

Windows System Integrity Mechanism

AppLocker Technical Architecture

Contrary to popular attempts to convince you otherwise – the PC is not dead. Fewer novice-level users may actually require a PC these days thanks to smart phones and tablets but I’m not quite ready to concede to “app store” style games and pecking out emails with my index fingers pressed on smudgy glass as my only means. I have smart phones, a tablet, several laptops, and yet I still find myself wanting and using a PC more than the others combined. Multi-displays serving rich graphics rendered from a discrete GPU, Chrome with 50 tabs opened at once, a few RDP sessions, streaming audio, RARs unpacked and copied in seconds, Visio, PowerPoint, Premier Pro, the latest DX11 game titles…you get the picture. Some things just work better with a mouse and keyboard and honestly, unless Minority Report ever becomes a reality (via Kinnect perhaps?) this will probably always be the case. My current PC is still humming along just fine with a 4-year old Windows 7 build on what was then, top of the line hardware. Ivy Bridge is here now, parts are more efficient, use less power, and are faster than ever. Time to upgrade.

Parts Selection

Now that I decided mATX was the way to go, it was time to assemble the Bill of Materials. Case selection was not an easy feat and I usually find myself just ahead of the curve, wanting what’s just about to come out. My last few ATX builds have been using Lian-Li cases which are high quality, aluminum, artful designs that do tend to cost more. Silverstone is another manufacturer of like ilk creating some of the highest reviewed products in this space. Taiwan seems to have the high-end PC case market cornered between these two companies.

I looked at a lot of cases over the course of several days seeking the smallest most functional mATX case I could find. I based my decision between 2 cases: The PC-V355B by Lian-Li and the Sugo SG09 by SilverStone. Lian-Li’s case is the closest thing out there to the Node 304 in looks, trouble is there are fitment limitations and design problems. The biggest restriction is the CPU cooler height at 100mm which rules out any high performance tower style cooler. Some people have reported that the motherboard once installed, does not sit flush to the IO shield in the back.  Another problem is that the PSU perches over the motherboard without even a shelf to support it! TweakTown’s review of this case highlighted that using a larger ATX PSU actually caused the rear of the case to flex. Not good. Shame because she’s pretty.

SilverStone on the other hand, created a case that is not only smaller but has no restrictions on CPU coolers or GPU lengths plus supports ATX sized PSUs in a proper shelf. The SG09 has received high praise from just about every review I read. Space efficient, quality construction, free flowing and small. Exactly what I’m looking for. The largest point of contention with the SG09 are its looks. At first glance I didn’t like it either. That front panel is actually plastic made to look like brushed aluminum. I can honestly say that I’ve stared at this thing so long now that it has really grown on me. SilverStone announced at CES a premature successor to the SG09 called the SG10. It’s essentially the same case with a flatly-styled aluminum front panel. Initially I was holding out for the SG10 which is rumored to ship some time in April 2013. The more I looked at the 2 cases the more I liked the SG09 and less so the SG10. I’m also not afraid to modify this thing if it ever bothers me. Functionally this case is very close to mATX perfection which at the end of the day is what matters most.

I didn’t find building in the SG09 terribly difficult, but I’ve been doing this for a while. Careful part selection is of utmost importance and having patience working in tight spaces is key. There is a big warning right on the box to dissuade novice builders.

For my power supply, considering this SFF build in a tight space, I chose a 140mm modular PSU from Silverstone: ST55F. Gold efficiency, clean power, fully modular, with a max of 600 watts, this PSU should provide everything I need and more. I also purchased the SilverStone PP05 short cable kit which, in hindsight, is still a good idea but I should have gone with a fewer higher quality PP07 cables instead. I used maybe 2 or 3 cables from the PP05 kit leaving the others to waste. Space is at a premium so the less you have to tuck inside of tight spaces the better! The review site JonnyGuru.com does an incredibly detailed job reviewing power supplies so definitely stop there first to check out any PSU contenders.

CPU, RAM and Mobo

I’ve long since abandoned AMD as the economy play in the CPU market for Intel who continues to have very little competition in the high-end CPU space. Ivy Bridge is no exception and is the smallest (22nm) most powerful hyperthreaded quad-core yet, with power consumption under 80 watts. More and more functionality is going on-chip with this “Tick” in Intel’s Tick-Tock cycle, getting a die shrink and enhanced graphics capabilities. I debated my CPU choice considering even the 3570 as clock cycles really don’t matter today as much as they once did. Overclockability, cores, cache, power consumption and instructions are all notable considerations but my decision was ultimately made up for me by price. 4 years ago I got an amazing deal on my 1st gen Core-i7 920 CPU from MicroCenter locally, this time around MicroCenter again did not disappoint. They were selling the high end 3770K CPU (K=unlocked) for $100 less than NewEgg, who are really the last bastion of online PC parts. The lesser chips that I was considering were more expensive than this high performer. This was really a no brainer.

The 3770K provides a ton of performance right out of the box. Pushing this chip further will be an easy albeit potentially unnecessary task.

CPU cooling is an area that has a lot of very good data to help make your selection, if opting to buy into the after-market. The stock Intel coolers are marginally ok, barely. If any overclocking is to be attempted at all, an after-market cooler should be a serious consideration. Noctua is one of my favorite brands of cooler with somewhat expensive but highly effective products including some of the best fans around. The NH-D14 is a MASSIVE cooler that is pretty much top dog right now. It occupies a tremendous amount of real estate so low profile RAM is a must in SFF. It’s also $80. For a fraction of that cost ($35), the Cooler Master Hyper 212 Evo delivers impressive results stacking well against its pricier counterparts and was my choice for this build. It is a somewhat rawer product with a direct contact style sleeve where the CPU rests directly against the flattened copper pipes of the cooler. Some minor prep work was required on the 212 Evo before installation, namely filling the cracks between the pipes with Arctic Silver 5.

I also replaced the cheapy Cooler Master fan with a high quality Noctua for silent operation and high performance. Here it is installed in the SG09. There is plenty of clearance for DIMMs with taller heat spreaders.

For motherboards, I’ve bought into the Asus high end for a very long time and have never been disappointed. Performance, value, stability, and longevity are all traits I’ve come to expect from Asus. ASRock has ramped up as a worthy competitor along with Gigabyte with many good reviews and satisfied customers, but at the $200 price point I felt no need to stray from Asus who has only left me satisfied in the past. The Maximus V Gene is the Asus answer for the high-end mATX z77 chipset market. Overclocking, customization, features, performance… everything I could want is in this board and for less than many of its high-end competitors.

Memory is another area of agony with so many choices on the market. One thing was clear at the outset: I wanted a 32GB 1600Mhz DDR3 kit (4 x 8GB). When building SFF the size of the heat sink on the RAM is a key consideration especially if you plan to run an after market CPU cooler. I wanted a kit with tight timings (CAS 8 or CAS 9), low voltage (1.35v) and a low profile to sit unobstructed in the DIMM channels. The Crucial Ballistix Tactical and Sport VLP products fit this bill perfectly. The Tactical LP DIMMs (CAS8) in yellow would have been my first choice but there was a lack of third-party supply for this build and buying directly from Crucial for much more really negated the value for these modules. I ended up going with the 32GB VLP kit (CAS9) in black and have absolutely no regrets. All head-to-head reviews peg these kits very close in performance with a slight edge going to the Tactical LP for overclocking. The Tactical LPs also have a slightly taller heat spreader and carry a higher price premium. The VLP (Very Low Profile) sit almost flush to the DIMM channels providing zero obstruction for any CPU cooler. These modules are seriously low profile and with Micron chips under the hood, you can absolutely trust their performance and longevity.

Both run very tight timings at the stock 1.35v and offer a couple of XMP profiles to boost performance. There are other modules on the market that will clock higher but for me, these are perfect. The VLP modules clock in at 800Mhz out of the box with a very attractive 9-9-9-24 at a 2T command rate.

Data

MLC SSD prices continue to become more attractive with loads of available performance. At a minimum, running an SSD for your OS disk is a worthy investment. For this build I’m running 3 disks: 1 x 128GB SSD for OS, 1 x 64GB SSD for apps/scratch, 1 x 1TB 7.2K SATA for data. I have an external NAS array for backup and greater data capacity. My OS disk is the highly acclaimed Samsung Pro 840 SATA 6Gb/s that boasts random reads up to 97K IOPS and sequential reads/writes up to 530/390 MB/s, respectively. In other words, pretty damn fast.

For scratch and application files I’m reusing my Kingston SSDnow+ drive and for data I got a new Seagate Constellation ES drive. Any drive worth buying will have a warranty of at least 5 years. Those with 2 tend to wear out faster from my experience.

All hard drives are mounted cleverly behind the motherboard in the SG09. Up to 2 x 3.5” drives or 4 x 2.5” drives. Having done away with optical media a very long time ago, this new PC will not be getting a DVD/BR drive which must be slot loader style in this case anyway.

Graphics

Although the Ivy Bridge CPU now includes a more powerful on-chip graphics processor, it’s better suited to mobile devices or applications with less graphical demand. I opted to continue to run a discrete GPU for high performance graphics. The GTX 670 is a very good high/middle-end card that many benchmarks have pegged near the 680. I chose the 670 over the closely-spec’d 660Ti due to its 256-bit memory architecture which is stunted on the 660 at 192-bit and as a result offers less memory bandwidth. Most of the other specs are almost identical. Near term you would probably not notice much in the way of a severe performance difference but long game, the 670 has longer legs and more headroom. If the price is close, the 670 is the way to go.

Build Summary

As far as sourcing parts goes, it found it interesting that Amazon and NewEgg are really the only reasonable places online to source parts anymore. Sure TigerDirect is out there (compusa) but I found their prices to be generally not competitive. I suppose this does reflect the current state of the custom PC today with fewer builders perhaps but there are still a plethora of available parts. As a long time customer of NewEgg, they appear to be doing quite well and have earned top spot as premier parts destination online. Its return and RMA process still leave something to be desired with restocking fees and customer paid return shipping. If Amazon started stocking more PC parts I‘m pretty sure it could push NewEgg out of the game entirely. The only thing I bought from Amazon for this build was the PSU, consequently. MicroCenter provided the CPU and Pro 840, everything else was cheaper with coupons, shipped free, and tax free from NewEgg.

Windows 8, or…bust?

There’s a lot to like about Windows 8: settings sync between devices, new windows explorer, task manager, file copy/ pause operations, power savings, memory savings, oops reset, and some increased security. There’s a lot not to like about Win8: start screen, devalued search, hot corners, separate UIs to update and manage, a device with no touch negates many of the new improvements. I’ve run every version of Win8 since the first preview release. I’ve had a lot of time to digest it, watch the changes, read the white papers, blogs and get accustomed to the UI(s). I’m sad to say that Win8 will be the first new Windows OS ever that I will not be installing on my new PC. It just doesn’t make sense to me. The majority of the under the hood changes to Win8 deal with optimizing the OS for portability, which is fine, but I’m not overly concerned with less RAM consumption or new sleep modes on my PC. I am sure that Win8 is an amazing product on a proper touch enabled device a la the Surface or Dell XPS 12.

Win8 is a dual-personality OS with 2 distinct UIs each with its own set of applications. Metro apps run sandboxed much like Android or IOS and silently suspend or terminate in the background, much the same way. After a long time forcing myself to adapt, I’ve come to the conclusion that metro just isn’t for me on a desktop PC with a keyboard and mouse. I’m not interested in live tiles or apps from an app store, nor do I want to hover over hotspots or drag windows via mechanisms designed for touch. The new Start screen is essentially an exploded version of the Start menu, but now the search functionality has been handicapped. You can still push the windows key, type cmd and hit enter but if you’re searching for something there are more clicks involved now between the apps, settings, and files sub categories. Windows7 start search is far superior in this regard. Metro (formerly known as) is an interface designed for touch, period. So I resigned myself to “live on the desktop side”, I installed Classic Shell and enabled booting to the desktop which brought back the familiar feel of Win7. Start search is still severely lacking with Classic Shell in place and I’ve had a few application compatibility problems as well. Win8 just doesn’t feel like an upgrade, especially having to make so many concessions to live with it. The user experience overall has gotten worse, not better, in my opinion for non-touch enabled devices. Win8 will likely be the new Vista (which I never had a problem with personally) and Microsoft has some time to watch the market before making their next move. They hedged their bets between tablets and PCs with Win8 and have managed to give each group enough of what they need. If this tablet thing fizzles into a fad, no problem, out comes the full blown desktop, if the PC dies completely metro will be primary. I’ll continue to run Win8 on my laptop, but my new powerhouse desktop will be getting a fresh build of Win7 SP1.

Final Thoughts

Overall I am extremely pleased with my new Ivy Bridge build in the SG09. One of the few aesthetically bothering items is that the ST55-F PSU in the SG09 sits off-center to the left so you can see the PSU logo off behind the case logo. Also the bar of stickers on the right side of the face of the PSU are somewhat distracting. The use of 90-degree sata connectors should be avoided in this case as they can interfere with the closing of the top lid. SATA “6Gb” cables came with the V Gene board but tests show there is no performance difference whatsoever between these and SATA cables from years ago. The 6Gb cables do have locking mechanisms on the ends which are a nice touch.

The OS installation was a marvel all unto its own taking 5 minutes flat from start to finish. Reboots are a literal 10 seconds from click to logon screen. In complete stock form this rig is a beast. I plan to overclock a bit once the TIM has broken in on the CPU but the need to do so is really minimal. It will be for fun more than anything.

From a power consumption perspective, this PC has yet to break 200w of usage, even during peak graphical or CPU intensive operations. For anyone wondering if 550w in a SFX PSU will be enough, yes it will! I have light fixtures that consume more power than this PC! It is also very quiet with all fans operating normally. There is a fan switch in the rear of the case to boost all RPMs to high which does kick up the noise a bit. Between this build and my old rig it’s almost like my office is too quiet now. :-)

Temperatures are so far better than average from what I’ve read, with the CPU idling ~33-34 Celsius. This will get better as the Artic Silver 5 sets in.

I don’t have any other performance benchmark data at this point (other than my 7.9 Windows user experience score) so I’ll just leave it that this thing is FAST and was well worth the upgrade. Faster, quieter, smaller, less power consumed = mission accomplished.

From:

To:

VDI is one of the most intensive workloads in the datacenter today and by nature uses every major component of the enterprise technology stack: networking, servers, virtualization, storage, load balancing. No stone is left unturned when it comes to enterprise VDI. Physical desktop management can also be an arduous task with large infrastructure requirements of its own. The sheer complexity of VDI drives a lot of interesting and feverish innovation in this space but also drives a general adoption reluctance for some who fear the shift too burdensome for their existing teams and datacenters. The value proposition Unidesk 2.0 brings to the table is a simplification of the virtual desktops themselves, simplified management of the brokers that support them, and comprehensive application management .

The Unidesk solution plugs seamlessly into a new or existing VDI environment and is comprised of the following key components:

• Management virtual appliance
• Master CachePoint
• Secondary CachePoints
• Installation Machine

Solution Architecture

At its core, Unidesk is a VDI management solution that does some very interesting things under the covers. Unidesk requires vSphere at the moment but can manage VMware View, Citrix XenDesktop, Dell Quest vWorkspace, or Microsoft RDS. You could even manage each type of environment from a single Unidesk management console if you had the need or proclivity. Unidesk is not a VDI broker in and of itself, so that piece of the puzzle is very much required in the overall architecture. The Unidesk solution works from the concept of layering, which is increasingly becoming a hotter topic as both Citrix and VMware add native layering technologies to their software stacks. I’ll touch on those later. Unidesk works by creating, maintaining, and compositing numerous layers to create VMs that can share common items like base OS and IT applications, while providing the ability to persist user data including user installed applications, if desired. Each layer is stored and maintained as a discrete VMDK and can be assigned to any VM created within the environment. Application or OS layers can be patched independently and refreshed to a user VM. Because of Unidesk’s layering technology, customers needing persistent desktops can take advantage of capacity savings over traditional methods of persistence. A persistent desktop in Unidesk consumes, on average, a similar disk footprint to what a non-persistent desktop would typically consume.

CachePoints (CP) are virtual appliances that are responsible for the heavy lifting in the layering process. Currently there are two distinct types of CachPoints: Master and Secondary. The Master CP is the first to be provisioned during the setup process and maintains the primary copy of all layers in the environment. Master CPs replicate the pertinent layers to Secondary CPs who have the task of actually combining layers to build the individual VMs, a process called Compositing. Due to the role played by each CP type, the Secondary CPs will need to live on the Compute hosts with the VMs they create. Local or Shared Tier 1 solution models can be supported here, but the Secondary CPs will need to be able to the “CachePoint and Layers” volume at a minimum.

The Management Appliance is another virtual machine that comes with the solution to manage the environment and individual components. This appliance provides a web interface used to manage the CPs, layers, images, as well as connections to the various VDI brokers you need to interface with. Using the Unidesk management console you can easily manage an entire VDI environment almost completely ignoring vCenter and the individual broker management GUIs. There are no additional infrastructure requirements for Unidesk specifically outside of what is required for the VDI broker solution itself.

Installation Machines are provided by Unidesk to capture application layers and make them available for assignment to any VM in the solution. This process is very simple and intuitive requiring only that a given application is installed within a regular VM. The management framework is then able to isolate the application and create it as an assignable layer (VMDK). Many of the problems traditionally experienced using other application virtualization methods are overcome here. OS and application layers can be updated independently and distributed to existing desktop VMs.

Here is an exploded and descriptive view of the overall solution architecture summarizing the points above:

Storage Architecture

The Unidesk solution is able to leverage three distinct storage tiers to house the key volumes: Boot Images, CachePoint and Layers, and Archive.

• Boot Images – Contains images having very small footprints and consist of a kernel and pagefile used for booting a VM. These images are stored as VMDKs, like all other layers, and can be easily recreated if need be. This tier does not require high performance disk.
• CachePoint and Layers – This tier stores all OS, application, and personalization layers. Of the three tiers, this one sees the most IO so if you have high performance disk available, use it with this tier.
• Archive – This tier is used for layer backup including personalization. Repairs and restored layers can be pulled from the archive and placed into the CachePoint and Layers volume for re-deployment, if need be. This tier does not require high performance disk.

The Master CP stores layers in the following folder structure, each layer organized and stored as a VMDK.

Installation and Configuration

New in Unidesk 2.x is the ability to execute a completely scripted installation. You’ll need to decide ahead of time what IPs and names you want to use for the Unidesk management components as these are defined during setup. This portion of the install is rather lengthy to it’s best to have things squared away before you begin. Once the environment variables are defined, the setup script takes over and builds the environment according to your design.

Once setup has finished, the Management appliance and Master CP will be ready, so you can log into the mgmt console to take the configuration further. Of the initial key activities to complete will be setting up an Active Directory junction point and connecting Unidesk to your VDI broker. Unidesk should already be talking to your vCenter server at this point.

Your broker mgmt server will need to have the Unidesk Integration Agent installed which you should find in the bundle downloaded with the install. This agent listens on TCP 390 and will connect the Unidesk management server to the broker. Once this agent is installed on the VMware View Connection Server or Citrix Desktop Delivery Controller, you can point the Unidesk management configuration at it. Once synchronized all pool information will be visible from the Unidesk console.

A very neat feature of Unidesk is that you can build many AD junction points from different forests if necessary. These junction points will allow Unidesk to interact with AD and provide the ability to create machine accounts within the domains.

Desktop VM and Application Management

Once Unidesk can talk to your vSphere and VDI environments, you can get started building OS layers which  will serve as your gold images for the desktops you create. A killer feature of the Unidesk solution is that you only need a single gold image per OS type even for numerous VDI brokers. Because the broker agents can be layered and deployed as needed, you can reuse a single image across disparate View and XenDesktop environments, for example. Setting up an OS layer simply points Unidesk at an existing gold image VM in vCenter and makes it consumable for subsequent provisioning. 

Once successfully created, you will see your OS layers available and marked as deployable.

Before you can install and deploy applications, you will need to deploy a Unidesk Installation Machine which is done quite simply from the System page. You should create an Installation Machine for each type of desktop OS in your environment.

Once the Installation Machine is ready, creating layers is easy. From the Layers page, simply select “Create Layer,” fill in the details, choose the OS layer you’ll be using along with the Installation machine and any prerequisite layers.

To finish the process, you’ll need to log into the Installation Machine, perform the install, then tell the Unidesk management console when you’re finished and the layer will be deployable to any VM.

Desktops can now be created as either persistent of non-persistent. You can deploy to already existing pools or if you need a new persistent pool created, Unidesk will take care of it. Choose the type of OS template to deploy (XP or Win7), select the connected broker to which you want to deploy the desktops, choose an existing pool or create a new one, and select the number of desktops to create.

Next select the CachePoint that will deploy the new desktops along with the network they need to connect to and the desktop type.

Select the OS layer that should be assigned to the new desktops.

Select the application layers you wish to assign to this desktop group. All your layers will be visible here.

Choose the virtual hardware, performance characteristics and backup frequency (Unidesk Archive) of the desktop group you are deploying.

Select an existing or create a new maintenance schedule that defines when layers can be updated within this desktop group.

Deploy the desktops.

Once the creation process is underway, the activity will be reflected under the Desktops page as well as in vCenter tasks. When completed all desktops will be visible and can be managed entirely from the Unidesk console.

Sample Architecture

Below are some possible designs that can be used to deploy Unidesk into a Local or Shared Tier 1 VDI solution model. For Local Tier 1, both the Compute and Management hosts will need access to shared storage, even though VDI sessions will be hosted locally on the Compute hosts. 1Gb PowerConnect or Force10 switches can be used in the Network layer for LAN and iSCSI. The Unidesk boot images should be stored locally on the Compute hosts along with the Secondary CachePoints that will host the sessions on that host. All of the typical VDI management components will still be hosted on the Mgmt layer hosts along with the additional Unidesk management components. Since the Mgmt hosts connect to and run their VMs from shared storage, all of the additional Unidesk volumes should be created on shared storage. Recoverability is achieved primarily in this model through use of the Unidesk Archive function. Any failed Compute host VDI session information can be recreated from the Archive on a surviving host.

Here is a view of the server network and storage architecture with some of the solution components broken out:

For Shared Tier 1 the layout is slightly different. The VDI sessions and “CachePoint and Layers” volumes must live together on Tier 1 storage while all other volumes can live on Tier 2. You could combine the two tiers for smaller deployments, perhaps, but your mileage will vary. Blades are also an option here, of course. All normal vSphere HA options apply here with the Unidesk Archive function bolstering the protection of the environment.

Unidesk vs. the Competition

Both Citrix and VMware have native solutions available for management, application virtualization, and persistence so you will have to decide if Unidesk if worth the price of admission. On the View side, if you buy a Premier license, you get ThinApp for applications, Composer for non-persistent linked clones, and soon the technology from VMware’s recent Wanova acquisition will be available. The native View persistence story isn’t great at the moment, but Wanova Mirage will change that when made available. Mirage will add a few layers to the mix including OS, apps, and persistent data but will not be as granular as the multi-layer Unidesk solution. The Wanova tech notwithstanding, you should be able to buy a cheaper/ lower level View license as with Unidesk you will need neither ThinApp nor Composer. Unidesk’s application layering is superior to ThinApp, with little in the way of applications that cannot be layered, and can provide persistent or non-persistent desktops with almost the same footprint on disk. Add to that the Unidesk single management pane for both applications and desktops, and there is a compelling value to be considered.

On the Citrix side, if you buy an Enterprise license, you get XenApp for application virtualization, Provisioning Services (PVS) and Personal vDisk (PVD) for persistence from the recent RingCube acquisition. With XenDesktop you can leverage Machine Creation Services (MCS) or PVS for either persistent or non-persistent desktops. MCS is deadly simple while PVS is incredibly powerful but an extraordinary pain to set up and configure. XenApp builds on top of Microsoft’s RDS infrastructure and requires additional components of its own such as SQL Server. PVD can be deployed with either catalog type, PVS or MCS, and adds a layer of persistence for user data and user installed applications. While PVD provides only a single layer, that may be more than suitable for any number of customers. The overall Citrix solution is time tested and works well although the underlying infrastructure requirements are numerous and expensive. XenApp offloads application execution from the XenDesktop sessions which will in turn drive greater overall host densities. Adding Unidesk to a Citrix stack again affords a customer to buy in at a lower licensing level, although Citrix is seemingly removing value for augmenting its software stack by including more at lower license levels. For instance, PVD and PVS are available at all licensing levels now. The big upsell now is for the inclusion of XenApp. Unidesk removes the need for MCS, PVS, PVD, and XenApp so you will have to ask yourself if the Unidesk approach is preferred to the Citrix method. The net result will certainly be less overall infrastructure required but net licensing costs may very well be a wash.