PolicyPak for VMware Workstation

PolicyPak for VMware Workstation

PolicyPak for VMware Workstation

Posted on by Ali Hassan

It’s truly wonderful to have the ability to manage multiple virtual machines from your desktop or laptop using applications such as VMware Workstation.  The problem is that when the settings are misconfigured for an application like this, it doesn’t just impact the program itself.  It can impact all of your virtual machines as well.

This makes VMware Workstation a potential single point of failure for multiple machines, which is why you can’t afford to allow your VMware users to manage these critical settings.

That’s where PolicyPak comes in.  We enforce and lock down the optimum settings values that you, the administrator, want them to have.  PolicyPak sets and enforces expectations for your users’ applications, so that they get the same experience, every time they launch it, especially for an application such as this that can lead to compounding problems.

Keep your VMware Workstation configuration settings enforced and streamlined with PolicyPak.  Check out this video to see how it’s done:

Download this video

Our PolicyPak software snaps-in to the Group Policy Editor and gives you the same user interface as VMware Workstation itself.  Managing software updates is important for all applications, but especially so for an application such as this.  Make sure that “Check for product updates on startup” is always unchecked.  Then make sure that your users can’t override your setting choice by selecting “Disable corresponding control in target application.”
You can ensure that Anti-Virus applications are always working for you, like what is seen here.
As a network administrator, you are always concerned with security which means you like to disable vendor participation programs within your installed software. PolicyPak helps you ensure that “Help improve VMware Workstation” is always unchecked. Notice in the screenshot below, we chose to disable the setting but notice that you can hide settings as well. PolicyPak gives you the ability to lock down your desired settings in either fashion.

You don’t want your users to be confused whether their virtual machines are running or not each time they close VMware Workstation.  Decide how you want to handle this situation and enforce that configuration with PolicyPak.  In the example below, “Keep VMs running after Workstation closes” will always remain checked.  Notice that the example below utilizes PolicyPak’s signature feature, “Perform ACL Lockdown,” as well.  ACL Lockdown locks your desired settings within the application configuration file itself  (preferences.ini in this case), ensuring that even the savviest of users can’t modify your setting values within the registry.

With PolicyPak, you’re the one in control.

Besides, once you’re using PolicyPak to manage VMware Workstation, you’ll also get to manage all your other enterprise desktop applications the same way: Flash, Lync, Java, Firefox, and any custom applications you have. They’re 100% included – absolutely free.

It’s all included when you’re a PolicyPak Professional customer.

PolicyPak was designed by Microsoft MVP, Enterprise Mobility Jeremy Moskowitz – who “wrote the book” on Group Policy, runs GPanswers.com, and lives and breathes Group Policy and enterprise software deployments and desktop lockdown.

When you’re ready to get serious about managing VMware Workstation, PolicyPak is ready for you.

Lockdown VMware Workstation Video Transcript

Hi, this is Jeremy Moskowitz, Microsoft MVP, Enterprise Mobility and Founder of PolicyPak Software. In this video, we’re going to learn how to configure VMware Workstation using PolicyPak.

I’ve already got VMware Workstation installed on my computer, and I’m just a regular user here. As you can see, I’m logged on as a guy called “eastsalesuser4.” I’ll open up VMware Workstation, go to Preferences, and examine the configuration settings a user has access to.

Right here we have our Workspace settings where we have settings that govern all sorts of aspects for our virtual machines as well as a key security settings for remote login information.  Here in Updates I have many settings for updating the various components of this application along with a Feedback section that includes one of those typical vendor customer participation programs.

VMware Workstation has a settings file that stores its setting values.   An experienced computer user can locate this setting and modify this file to get around your desired settings.  I have the file location saved here where I can go straight into the setting values such as “pref.backgroundOnClose” and change the value from True to False.  As you can see, EastSalesUser4 has the rights to do this.

Now let’s see how we can ensure compliance and perform desktop management of settings quickly using PolicyPak. I’ll go ahead and switch over to my Management Station computer.

We’ll go ahead and right click over our “East Sales Users”, “Create a GPO” and we’re going to call it “Lockdown VMware Workstation.” So this GPO is now associated with the “East Sales Users.” I’ll right click over it. I’ll click “Edit…” I’ll dive down under “User Configuration,” PolicyPak/Applications/New/Application.” There it is, “PolicyPak for VMware Workstation” along with other applications like “Java,” “Flash” “Firefox,” “Skype” and lots of other important desktop applications that your users utilize every day (and you want to make more secure).

Let’s start with “Updates” and let’s check “Check for product updates on startup.” Now to make sure that users can’t alter this modification, I will right click on it and select “Disable corresponding control in target application”.  Now the setting cannot be accessed and possibly modified by the user.

Now let’s go to “Feedback” and let’s uncheck “Help Improve VMware Workstation” and disable it as well.  Next let’s head to Workspace and let’s make sure that “Offer to save login information for remote hosts” is always unchecked.

Now let’s use Policypak’s unique “ACL Lockdown feature” that will prevent users from altering these delivered settings by modifying them within the INI settings file.  I’ll simply right click on the setting and choose “Perform ACL Lockdown.”  I’ll go up to “Keep VMs running after Workstation closes” and check it and then use ACL lockdown with it as well.

Now I will go back to my client machine, we’ll get a command prompt and run “gpupdate.”  Now you could envision the user logging on for the very first time, using a Terminal Services or Citrix machine, using a VDI session, changing job roles, or getting a new computer.   I just happen to be using gpupdate.  Yes, PolicyPak performs the magic. To get the magic delivered, you can use Group Policy, SCCM, LanDesk, KACE or your own systems management software.  Even if the user is offline, your settings are always preserved because PolicyPak is always working for you in the background, making the job of you the administrator, easier.

Now let’s open up VMware Workstation again and check our settings.  Notice that my setting for “Check for product updates on startup” has been delivered and is disabled so that it can’t be accessed.  Notice that the “Help improve VMware Workstation“ is unchecked on Feedback. On Workspace we see that both “Offer to save login information for remote hosts” and “Keep VMs running after Workstation closes” is checked.

Now let’s pretend this user tries to change the settings in the settings INI file again.  I’ll open up the file location once again and to attempt to modify “pref.backgroundOnClose” and as you can see the efforts of this user has been thwarted.  PolicyPak with ACL Lockdown has successfully locked down these file configuration settings.

And we are done. That is how incredibly easy it is for you to use PolicyPak to manage VMware Workstation as well as tons of other desktop applications.

If you’re looking for a trial of PolicyPak, just click on the “Webinar / Download” button on the right.

Thanks so much for watching, and get in touch with us if you’re looking to get started. Talk to you soon.