WSS Agent Support for Virtual Environments

Products

• Web Security Service - WSS

Issue/Introduction

Some confusion exists on whether the WSS Agent can be run on virtualized environments such as VDIs. 

The following details highlights the environments we do and do not support with WSS Agent :

• WSS Agent 7.1.1 or later supports virtual environments that present a full virtual machine exclusive to each user.
• Environments where it does NOT work:
  • NOT supported where multiple users share a single installation of the operating system.
  • NOT supported on Windows Server OS's.
  • NOT supported in terminal server environments such as Citrix, XenApp, WVD (Windows Virtual Desktops), etc..

Environment

WSS Agent 7.1.1 +

Virtual Environments

Resolution

 

• WSS Agent must be installed on each virtual machine.
• Install the Agent with the "MCU=1" parameter since these machines will be accessed remotely. Failure to do so will result in an error status of: "No user logged on at physical console."
  • See the portal documentation for more details (under section: Configuration Option: Multiple Concurrent Users): Connectivity: Install WSSA—Win CLI  )

 

Additional Information

 

Reporting Impact

• The Agent can detect when it has been cloned and treats each new instance as a new installation by assigning a unique installation ID for each new VM cloned off an image. The pristine image will keep the same installation ID throughout its life.
• Each new VDI session will result in the creation of an additional entry in the Connectivity > Agent page. For large orgs, this could result in a very large number of entries, but this shouldn't present a problem because even a small number of entries will require searching or filtering for record location.
• For the Last Access report, the number of logged sessions will be the same, with or without VDI, because this report simply logs new sessions from the Agent to WSS. What will change is that each session for a given user will have a different Device ID corresponding to each virtual session. In a physical deployment, the Device ID would remain constant across all sessions. The practical implications of this change in behavior are immaterial.