Deploying XenApp Within a Virtual Desktop: The Why's & How's

We posted recently about the possibilities of creating a flexible, yet secure virtual desktop - with the right management tools. If you're familiar with the benefits of virtualization and have already invested in application virtualization technology, now you can go a step further to get security and centralized management of the entire desktop image. Deploying a well-managed virtual desktop will secure your user's operating system and simplify management of the entire environment, without sacrificing the ability to let users customize, run offline or on the go. The secret with virtual desktops is to "manage centrally, execute locally."

Deploying a flexible virtual desktop management solution is a relatively quick and simple process (a few hours to set things up), but can save IT administrators an impressive 60% on desktop support and management costs. Support costs drop as users can simply restart their virtual desktop to "rejuvenate" the original clean-state image with all of its applications and settings, wiping away any malware picked up along the way.

For instance - if you're already using XenApp, here are the basic steps:

1) Make sure your XenApp Server is configured to talk to your Domain Controller - this is important because you will be targeting apps based on users

2) Use MokaFive’s Creator to build a base LivePC image

3) Now that you have created a base image, you can install other applications, including XenApp applications, on top of it

4) From MokaFive's management console, target this LivePC to any users you choose to receive it

5) In the XenApp Access Management Console, set a number of policies for how you want XenApp to launch and run (from the server, locally, online/offline, etc.).

For step-by-step instructions, check out this document.

MokaFiveTV is Live

Curious to know more about desktop virtualization? The concept of managing virtual desktops with layers? Want to learn the backstory on how MokaFive came to be?

To satisfy your curiousity and learn about innovations in desktop computing, we invite you to check out the MokaFiveTV channel on YouTube. Our co-founder and CTO John Whaley, along with co-founder and current Stanford CS professor Monica Lam as well as other experts from the team will give you an inside look at what it's all about.

For starters, you'll find the following video episodes:
MokaFive: A brief background
Virtual Layers - Inside View
At the Whiteboard - Layering
Virtual Layers - Application Management

For an even more intimate view, follow "Joe Whaley" and MokaFive on Twitter.

Building a Flexible (yet secure) Desktop Solution

Many of you are already familiar with server virtualization and VDI and you might be looking for a virtualization approach that will help more easily secure and control desktop environments in a wider range of environments, i.e. bring-your-own-laptop, offline access, remote employees, etc.

In this post, I am going to describe one way to build a desktop environment which provides a lot of flexibility to users but still lets IT maintain control.

Consider an alternative approach to VDI: instead of running the VM image on a centralized server, the VM is running locally on the end-user's machine. The mantra is: "Manage centrally, execute remotely." This new model provides a great platform for IT organizations to customize solutions to fit their needs.

First, let's look at application virtualization and how that might fit in. Some of you maybe familiar with it - the big names in this space are: Microsoft AppV (formerly SoftGrid), VMware ThinApp (formerly Thinstall), and Citrix XenApp. In this model, an application is packaged up in a bundle and the user runs the application from this bundle in a sandbox environment on their unmanaged desktop. This is a great solution for delivering single applications to users because the application does not need to be installed manually on the local machine and it is delivered on-demand to the user. IT does not get involved in managing the OS and data on the machine.

However, not managing the OS or the rest of the desktop makes the computing environment vulnerable. In most cases, it's imperative to properly manage the environment to make sure the computer doesn't crash due to a missing security patch or that business data is not left unsecured. This is one of the reasons the desktop virtualization approach "manage centrally, execute locally" really shines - by easily securing the environment around a virtualized application:

Let's use the below image to explore the MokaFive layer approach to managing a virtual desktop, from bottom to top:

• On the lowest layer, there is the host PC or Mac operating system. The Mokafive Player, to download and run the virtual "LivePC" desktop, can be run on either platform, so you don't need to worry about cross-platform support in your solution. We take care of that.
• The layers above the host platform is the MokaFive Player and the Hypervisor. This allows you to manage the next layers above and control various security settings. IT can control what the user can or cannot do in the virtual desktop by setting policies on the central, Web-based management console.
  
• Then there is the base OS that runs inside the virtual machine (Windows XP or Vista).
  
• You can also install any corporate applications, i.e. Outlook, Word, a CRM or ERP application, etc. Together with the base OS, this can be your standard base virtual desktop image for your company or one base image for a specific department. By default, the base image is locked down by the MokaFive Player so it can't be tampered with.
  
• The top layer is where the magic happens. You can deploy additional applications to your users, based on their needs, using application virtualization technology. You can have users run applications from the server or you can have the applications streamed down to the virtual desktop, depending on performance needs. If you have an existing virtualized application installation, the MokaFive solution fits right now.
  
• Also on the top layer is the user installed applications. Using the personalization feature that is built into the MokaFive 2.0 technology, you can allow users to install their own applications on top of your standard managed image. You give your users flexibility to do whatever they want on the top layer while you maintain control on the lower layers.
  

We have tried this configuration with XenApp, AppV and ThinApp. I think this configuration provides the most flexibility to both IT and end users while at the same time, IT still maintains control.