Endpoint Security for Windows Virtual Desktop Infrastructure (VDI)

Virtual Desktop Infrastructure (VDI) is the technology to create and manage virtual desktops. VDI is available as a feature in Check Point's Endpoint Security Client releases.

  • VMware Horizon is supported in E81.00 (and higher) for Persistent Mode and as a feature on E83.10 (and higher) for Non-Persistent Mode.

  • Citrix XenDesktop is supported in E84.20 (and higher).

A virtual machine monitor (the hypervisor) controls the virtual machine that creates the virtual desktops. All the activity on the deployed virtual desktops occurs on the centralized server.

The "Golden Image" is the base ("Master") desktop image and the model for clone images. Desktop Pools define the server resources for the virtual desktops and solutions to hold the latest Anti-Malware signatures on all the virtual desktops.

Virtual desktop software applications support two modes.

  • Persistent Mode:

    • Each user has a single specific desktop for their solitary use.

    • Each user's desktop retains data on the desktop itself between logins and reboots.

    • The user's machine is not "refreshed" for other users.

  • Non-Persistent Mode:

    • Each user has a desktop from a pool of resources. The desktop contains the user's profile.

    • Each user's desktop reverts to its initial state when the user logs out.

    • The user's machine is fresh in each instance.

Important:

Non-Persistent virtual desktops access Anti-Malware signatures in a shared folder in the Shared Signatures Solution.

The tested versions are:

  • VMware Horizon 7 version 7.6 and 7.10 (E81.00 for Persistent Mode, E83.10 for Non-Persistent Mode)

  • VMware Horizon 7 version 7.13 (E86.60 for both Persistent Mode and Non-Persistent Mode)

  • VMware Horizon 8 version 8.3 (E86.60 for both Persistent Mode and Non-Persistent Mode)

  • Citrix Virtual Apps and Desktops 7 1912

The software environments between and after these versions should work. Earlier versions may work. Contact Check Point Support for assistance with earlier versions.

Important:

AD Scanner feature must be enabled in VDI environments.

Minimal Requirements for Virtual Machines:

Limitations

  • VDI Clients must be part of a domain. Workgroup configurations are not supported.

  • FDE capability is not supported. Do not enable FDE in packages for Non-Persistent VDI machines.

  • "Anti-Malware Scanning Storms" may occur when the Anti-Virus scan runs at the same time on multiple Virtual Machines on the same physical server. A serious degradation of the system performance is possible that can affect disk I/O and CPU utilization.

  • The "Repair" push operation does not work for VDI machines.

  • The Shared Signature Server does not share signatures with non-persistent desktops if you clear and select the Set as shared signature server checkbox in the Policy > Web & Files Protection > Advanced Settings > Files Protection > Signature window. To resolve this issue, uninstall and redeploy the Endpoint Security client on the Shared Signature Server.