Import GPO Template Files

GPO template files are automatically imported by the Graphics Agent for Windows installer, except on domain controllers. You must manually import the files into the domain controller’s Group Policy Editor.

To import the template on a domain controller:

1. Copy the admx file from

   C:\Program Files\Teradici\PCoIP Agent\configuration\policyDefinitions\PCoIP.admx
   

   to  C:\Windows\PolicyDefinitions

2. Copy the adml file from

   C:\Program Files\Teradici\PCoIP Agent\configuration\policyDefinitions\en-US\PCoIP.adml
   

   to  C:\Windows\PolicyDefinitions\en-US

 

You can configure the PCoIP agent, and optimize PCoIP protocol behavior for local network conditions, by adjusting Windows GPO variables.

The variables are in admx template files, which are imported automatically by the agent installer.

Modifying PCoIP GPO Variables¶

All of the PCoIP settings can be configured using this procedure. The configurable settings are described in the following section.

To modify a PCoIP session variable:

1. Open the Local Group Policy Editor on the agent machine:
   1. Press  + r to open the run dialog
   2. type gpedit.msc and press Enter.
2. In the left pane, navigate to Administrative Templates and then to PCoIP Session Variables.

   The variables you can configure appear in the right pane.

3. Double-click the PCoIP variable you want to configure to open the variable’s configuration window, then:
   1. Select Enabled to enable the PCoIP setting.
   2. Configure any parameters that are available for the setting.
   3. Click OK to close the variable’s configuration window.
4. Repeat step 3 until all variables have been set.
5. Close the Local Group Policy Editor.

Configurable Settings¶

The following settings can be configured on the Graphics Agent for Windows. Refer to Configuring the PCoIP agent to understand how to modify these settings.

Build-to-lossless¶

This setting takes effect immediately. Specifies whether to turn the build-to-lossless feature of the PCoIP protocol off or on; this feature is turned off by default.

If this setting is Disabled or Not Configured then the build-to-lossless feature is turned off and images and other desktop content may never build to a lossless state. In network environments with constrained bandwidth, turning off the build-to-lossless feature can provide bandwidth savings. If this setting is Enabled then the build-to-lossless feature is turned on; this is recommended for environments that require images and desktop content to be built to a lossless state.

Clipboard redirection¶

This setting takes effect when you start the next session. Determines the direction in which clipboard redirection is allowed. You can select one of these values:

• Disabled in both directions
• Enabled in both directions (default setting)
• Enabled client to agent only (That is, allow copy and paste only from the client system to the host desktop.)
• Enabled agent to client only (That is, allow copy and paste only from the host desktop to the client system.)

Clipboard redirection is implemented as a virtual channel. If virtual channels are disabled, clipboard redirection does not function.

When this setting is disabled or not configured, the default value is Enabled in both directions.

Connection addresses¶

This setting takes effect when you start the next session. Configuring this allows you to control the IP address used by PCoIP sessions.

Connection address controls the IP used by the agent for the PCoIP session.

Client connection address controls the IP address that the client is told to use when establishing the PCoIP session.

Note that neither of these values should need to be set under normal circumstances.

Enable Disclaimer Authentication¶

This setting takes effect when you start the next session. When this setting is enabled, users connecting via direct connect will be presented a disclaimer prior to password based authentication. If the disclaimer is rejected, the user will not be able to connect.

Disclaimer files must be placed in %PROGRAMDATA%\Teradici\PCoIPAgent\disclaimers. Files must be named according to the locale, e.g. en_US.txt for en_US, ko_KR.txt for ko_KR, etc. If a file matching the negotiated locale is not present, en_US will be used as a fallback. If disclaimer text cannot be found, an blank disclaimer will be presented.

Enable PCoIP Ultra CPU optimization¶

This setting takes effect when you start the next session. When this setting is disabled or not configured PCoIP Ultra CPU optimization is not enabled. These optimizations require the CPU support for the AVX2 instruction set on both the agent and client and is not compatible with the PCoIP Zero client. CPU optimization is recommended for 4k resolutions with video playback requirements of 30 fps.

Enable PCoIP Ultra GPU optimization¶

This setting takes effect when you start the next session. When this setting is disabled or not configured PCoIP Ultra GPU optimization is not enabled. These optimizations require an NVidia graphics card on the agent VM capable of NVEnc. GPU optimization is recommended when minimal CPU impact of pixel encoding is desired. Enabling this setting will override enabling PCoIP CPU optimizations.

Enable the PCoIP control panel¶

This setting takes effect when the system is restarted. This policy enables or disables the PCoIP control panel. When enabled, the PCoIP control panel will be running, and when disabled the control panel will not be running. When not configured, will run by default.

Enable/disable USB in the PCoIP session¶

This setting takes effect when you start the next session. Determines whether USB support is enabled in PCoIP sessions. When this setting is not configured, USB is enabled by default. By default all devices are supported unless restrictions are configured through the USB device rules setting.

Enable/disable audio in the PCoIP session¶

This setting takes effect when you start the next session. Determines whether audio is enabled in PCoIP sessions. Both endpoints must have audio enabled. When this setting is enabled, PCoIP audio is allowed. When it is disabled, PCoIP audio is disabled. When this setting is not configured, audio is enabled by default.

Enable/disable relative mouse support¶

This setting takes effect when you start the next session. It determines whether relative mouse co-ordinates may be used, when appropriate, during the PCoIP session. By default, this setting is enabled.

Enable/disable trusted domain checks¶

This setting takes effect when you start the next session. Its purpose is to allow additional security checking of the domain provided during user authentication. By default, this setting is disabled, meaning provided domains are not verified to be trusted. When enabled, the domain used during user authentication is verified to be trusted.

Hide local cursor¶

This setting takes effect immediately. When this setting is enabled the local cursor on the client will be hidden. This may resolve duplicate cursor issues if there is a host rendered cursor within the host environment but may also result in no visible cursor. With this setting enabled there may be delays in mouse movements due to network latency and video processing times. By default, this setting is disabled, meaning that local cursors will be used, providing the most responsive user experience.

License server URL¶

This setting takes effect when you start the next session. This policy sets the license server path. Enter the license server path in ‘http://address:port/request’ format.

Maximum PCoIP session bandwidth¶

This setting takes effect when you start the next session. Specifies the maximum bandwidth, in kilobits per second, in a PCoIP session. The bandwidth includes all imaging, audio, virtual channel, USB, and control PCoIP traffic.

Set this value based on the overall capacity of the link to which your endpoint is connected, taking into consideration the number of expected concurrent PCoIP sessions. For example, with a single user VDI configuration (e.g. a single PCoIP session) that connects through a 4Mbit/s Internet connection, set this value to 4Mbit (or 10% less than this value to leave some allowance for other network traffic).

Setting this value prevents the agent from attempting to transmit at a higher rate than the link capacity, which would cause excessive packet loss and a poorer user experience. This value is symmetric. It forces the client and agent to use the lower of the two values that are set on the client and agent side. For example, setting a 4Mbit/s maximum bandwidth forces the agent to transmit at a lower rate, even though the setting is configured on the client.

When this setting is disabled or not configured on an endpoint, the endpoint imposes no bandwidth constraints. When this setting is configured, the setting is used as the endpoint’s maximum bandwidth constraint in kilobits per second.

The default value when this setting is not configured is 900000 kilobits per second.

This setting applies to the agent and client. If the two endpoints have different settings, the lower value is used.

PCoIP Security Certificate Settings¶

This setting takes effect when you start the next session. This policy dictates the handling of certificates.

A certificate is used to secure PCoIP related communications. The way PCoIP components choose a certificate is based on the certificate type, the name of the Certificate Store (referred to as “certificate storage”) and the key length. Without a certificate being generated or selected, a PCoIP Session cannot be established.

Depending on the value chosen for the option, ‘How the PCoIP agent chooses the certificate…’ and the availability of appropriate certificates, PCoIP components may acquire a CA signed certificate from the Windows Certificate Store or generate an in-memory self-signed certificate.

Name the Windows Certificate Store where the CA signed certificate is stored. The default is the “MY” store (shown as “Personal” in Management Console). Set the friendly name of the CA signed certificate to be PCoIP, in the Windows Certificate Store.

CA certificate(s) must be stored in the “Trusted Root Certification Authorities” store (sometimes referred to as “ROOT”).

Select a minimum key length (in bits) for choosing a CA signed certificate from the Windows Certificate Store. Longer length certificates will require more computing resources and may reduce performance, but will increase security. Shorter length certificates will provide better performance at the cost of lower security.

Note: Please refer to Teradici documentation for instructions on creating and deploying certificates.

PCoIP Security Settings¶

This setting takes effect when you start the next session. Controls the cryptographic cipher suites and encryption ciphers used by PCoIP endpoints.

The endpoints negotiate the actual cryptographic cipher suites and encryption ciphers based on the settings configured here. Newer versions of TLS and stronger cipher suites will be preferred during negotiation between endpoints.

If this setting is not configured or disabled, the TLS Security Mode will be set to Maximum Compatibility, and the PCoIP Data Encryption Ciphers will be set to AES-256-GCM, AES-128-GCM.

TLS Security Mode

Maximum Compatibility offers TLS 1.1, 1.2 and a range of cipher suites including those that support Perfect Forward Security (PFS) and SHA-1. Supported cipher suites:

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_RSA_WITH_AES_256_GCM_SHA384
• TLS_RSA_WITH_AES_128_GCM_SHA256
• TLS_RSA_WITH_AES_256_CBC_SHA256
• TLS_RSA_WITH_AES_128_CBC_SHA256
• TLS_RSA_WITH_AES_256_CBC_SHA
• TLS_RSA_WITH_AES_128_CBC_SHA

Blacklisted Cipher Suites

Provides the ability to block specific cipher suites from being offered during negotiation. Must be entered as a semi-colon separated list of cipher suites.

PCoIP Data Encryption Ciphers

Encryption ciphers used for PCoIP UDP data encryption. “AES-256-GCM, AES-128-GCM” is the default setting. AES-256-GCM will get negotiated if the client supports it, otherwise, AES-128-GCM will get negotiated.

PCoIP USB allowed and unallowed device rules¶

This setting specifies the USB devices that are authorized and unauthorized for use in a PCoIP session. Any changes to this setting only takes effect after you start the next session.

If this setting is left Not Configured or set to Disabled, then the default behavior is all devices are allowed.

When this setting is enabled, only devices listed in the USB authorization table are permitted in PCoIP sessions, provided they are not subsequently excluded by an entry in the USB unauthorization table.

If this setting is enabled with an empty USB authorization string, this means that no USB devices are allowed. An empty USB unauthorization string means that only USB devices in the authorization list are allowed.

You can define a maximum of 10 USB authorization rules and a maximum of 10 USB unauthorization rules. Separate multiple rules with the vertical bar (|) character.

Each rule can be a combination of a Vendor ID (VID) and a Product ID (PID), or a rule can describe a class of USB devices. A class rule can allow or disallow an entire device class, a single subclass or a protocol within a subclass.

The format of a combination VID/PID rule is 1xxxxyyyy, where xxxx is the VID in hexadecimal format and yyyy is the PID in hexadecimal format. For example, the rule to allow or block a device with VID=0x1a2b and PID=0x3c4d is 11a2b3c4d.

For class rules, use one of the following formats:

Allow All USB Format: 23XXXXXX Allow All Devices Example: 23XXXXXX

Allow USB Format: 22classXXXX Class Example: 22aaXXXX

Allow a Specific Format: 21class-subclassXX Subclass Example: 21aabbXX

Allow a Specific Format: 20class-subclass-protocol Protocol Example: 20aabbcc

For example, the USB authorization string to allow USB HID (mouse and keyboard) devices (class ID 0x03) and mass storage devices (class ID 0x08) is 2203XXXX|2208XXXX. The USB unauthorization string to disallow USB Mass Storage devices (class ID 0x08) is 2208XXXX.

PCoIP event log verbosity¶

This setting takes effect immediately. This policy enables the configuration of the PCoIP event log verbosity ranging from 0 (least verbose) to 3 (most verbose).

When this policy is Disabled or Not Configured, the default event log verbosity setting is 2. When this policy is Configured, the setting controls the verbosity level as described above.

PCoIP image quality levels¶

This setting takes effect immediately. Controls how PCoIP renders images during periods of network congestion. The Minimum Image Quality, Maximum Initial Image Quality, and Maximum Frame Rate values interoperate to provide fine control in network-bandwidth constrained environments.

Use the Minimum Image Quality value to balance image quality and frame rate for limited-bandwidth scenarios. You can specify a value between 30 and 100. The default value is 40. A lower value allows higher frame-rates, but with a potentially lower quality display. A higher value provides higher image quality, but with potentially lower frame rates when network bandwidth is constrained. When network bandwidth is not constrained, PCoIP maintains maximum quality regardless of this value.

Use the Maximum Initial Image Quality value to reduce the network bandwidth peaks required by PCoIP by limiting the initial quality of the changed regions of the display image. You can specify a value between 30 and 100. The default value is 80. A lower value reduces the image quality of content changes and decreases peak bandwidth requirements. A higher value increases the image quality of content changes and increases peak bandwidth requirements. Unchanged regions of the image progressively build to a lossless (perfect) quality regardless of this value. A value of 80 or lower best utilizes the available bandwidth.

The Minimum Image Quality value cannot exceed the Maximum Initial Image Quality value.

Use the Frame Rate vs Image Quality value to favor image sharpness over smooth motion during a PCoIP session when network bandwidth is limited. Lower values favor smoothness, higher values favor sharpness of image.

Use the Maximum Frame Rate value to manage the average bandwidth consumed per user by limiting the number of screen updates per second. You can specify a value between 1 and 120 frames per second. The default value is 30 for PCoIP Standard Agent and 60 for PCoIP Graphics Agent. A higher value can use more bandwidth but provides less jitter, which allows smoother transitions in changing images such as video. A lower value uses less bandwidth but results in more jitter.

YUV chroma subsampling is set to 4:4:4 by default for maximum image quality. Setting YUV chroma subsampling to 4:2:0 is only supported in combination with PCoIP Ultra GPU optimization. This setting will enable chroma subsampling to further compress the imaging to reduce bandwidth usage at the cost of reduced color accuracy.

Set the ‘Use image settings from client’ when you want to use the ‘Minimum Image Quality’, ‘Maximum Initial Image Quality’, ‘Maximum Frame Rate’, ‘Disable Build to Lossless’ values from the client instead of the host. Currently, only Zero Client Firmware 3.5 and above support these settings on the client side.

These image quality values apply to the soft host only and have no effect on a soft client.

When this setting is disabled or not configured, the default values are used.

PCoIP log retention¶

This setting takes effect immediately. This policy sets the retention period (in days) for PCoIP logs that have been archived. PCoIP log files are periodically archived to %PROGRAMDATA%\Teradici\logs\ROTATE. When this policy is Disabled or Not Configured, archived logs that have not been modified in 30 days are removed. When this policy is Configured, the setting controls the retention period as described above.

When configuring a retention period PowerShell 4.0 or newer is required. If an older PowerShell version is installed then the default retention period will be used, regardless of the configured setting.

PCoIP session MTU¶

This setting takes effect when you start the next session. Specifies the Maximum Transmission Unit (MTU) size for UDP packets for a PCoIP session.

The MTU size includes IP and UDP packet headers. TCP uses the standard MTU discovery mechanism to set MTU and is not affected by this setting. The maximum MTU size is 1500 bytes. The minimum MTU size is 500 bytes. The default value is 1200 bytes.

Typically, you do not have to change the MTU size. Change this value if you have an unusual network setup that causes PCoIP packet fragmentation.

This setting applies to the agent and client. If the two endpoints have different MTU size settings, the lowest size is used.

If this setting is disabled or not configured, the client uses the default value in the negotiation with the agent.

PCoIP session SSO access control¶

This setting takes effect when you start the next session. Enable/Disable the single sign on access control to a PCoIP session.

When this policy is Not Configured, the single sign on access control is enabled.

PCoIP session audio bandwidth limit¶

This setting takes effect immediately. Specifies the maximum audio bandwidth that can be used for audio output (sound playback) from the virtual desktop to the client in a PCoIP session. Note that the network transport overhead can add an additional 20-40% bandwidth to this number.

This setting does not apply to audio input (recording) from the client to the virtual desktop. This setting also has no effect on USB audio devices which are connected to the virtual desktop through USB redirection.

Audio processing monitors the bandwidth needed for audio and selects the audio compression algorithm that provides the best quality possible, without exceeding the bandwidth limit:

• 256 kbit/s or higher – stereo, high-quality, compressed audio
• 48 kbit/s to 255 kbit/s – stereo audio ranging between FM radio quality down to AM radio quality
• 32 kbit/s to 47 kbit/s – monaural AM radio or phone call quality
• Below 32 kbit/s – results in no audio playback

If this setting is disabled or not configured, a default audio bandwidth limit of 256 kbit/s is configured to constrain the audio compression algorithm selected. If the setting is configured, the value is measured in kilobits per second (kbit/s), with a default audio bandwidth limit of 256 kbit/s. (note that the actual value in the WMI counter will be 500, but the code is capped at 256).

Note that zero clients on older firmware have less efficient audio compression algorithms that may require setting this limit higher to achieve the same audio quality or upgrading the firmware.

PCoIP session bandwidth floor¶

This setting takes effect immediately. Specifies a lower limit, in kilobits per second, for the bandwidth that is reserved by the PCoIP session.

This setting configures the minimum expected bandwidth transmission rate for the endpoint. When you use this setting to reserve bandwidth for an endpoint, the session does not have to wait for bandwidth to become available, which improves session responsiveness.

Make sure that you do not over-subscribe the total reserved bandwidth for all endpoints. Make sure that the sum of bandwidth floors for all connections in your configuration does not exceed the network capability.

The default value is 0, which means that no minimum bandwidth is reserved. When this setting is disabled or not configured, no minimum bandwidth is reserved.

This setting applies to the agent and client, but the setting only affects the endpoint on which it is configured.

PCoIP statistics interval¶

This setting takes effect immediately. Configuring this allows you to set an interval in seconds for logging performance statistics to the PCoIP server log. When not configured, logging is disabled by default.

PCoIP transport header¶

This setting takes effect when you start the next session. Configures the PCoIP transport header.

PCoIP transport header is a 32-bit long header which is added to all PCoIP UDP packets (only if the transport header is enabled/supported by both sides). PCoIP transport header allows network devices to make better prioritization/Qos decisions when dealing with network congestions. The transport header is enabled by default.

The transport session priority determines the PCoIP session priority reported in the PCoIP Transport Header. Network devices make better prioritization/Qos decisions based on the specified transport session priority. The transport session priority value is negotiated by the PCoIP agent and client. If agent has specified a transport session priority value (high, medium, or low), then the session uses the agent specified session priority. If only the client has specified a transport session priority (high, medium, or low), then the session uses the client specified session priority. If neither agent nor client has specified a transport session priority (or specified ‘undefined priority’), then the session uses/defaults to the medium session priority.

PCoIP virtual channels¶

This setting takes effect when you start the next session. Specifies the virtual channels that can or cannot operate over a PCoIP session.

There are two modes of operation:

• Enable all virtual channels except for <list> (default setting)
• Disable all virtual channels except for <list>

When specifying which virtual channels to include or not include in the list, the following rules apply:

• An empty list is allowed
• Multiple virtual channel names in the list must be separated by the vertical bar (|) character. For example: channelA|channelB
• Vertical bar or backslash () characters in virtual channel names must be preceded by a backslash. For example: the channel name “awk|ward\channel” must be specified as “awk|ward\channel” (without the double quotes)
• A maximum of 15 virtual channels are allowed in a single PCoIP session

The virtual channel must be enabled on both agent and client for it to be used.

Primary display resolution¶

This setting takes effect when you start the next session. Configuring this value will override the display resolution of the primary monitor for connections to the host. The value applies only to the PCoIP Standard Agent for Windows.

Proxy Access to a remote License Server¶

This setting takes effect when you start the next session. If a proxy is required to access a local License Server or the Cloud License Server, enter those parameters here. These parameters are loaded only during agent startup.

Remote printing¶

This setting takes effect when you start the next session, and applies on the host only. Basic Remote printing will only offer limited printing but has the advantage of using a generic printer driver on the host side. This ensures compatible printing but does not offer all features of the printer.

Advanced remote printing for Windows clients requires installation of the matching printer driver on the host side of the solution. In some cases the matching printer driver cannot be found for the host OS and/or the printer driver is not compatible with the printer. In those cases changing the printer setting to “Basic” should allow printing to those printers.

Remote printing is implemented as a virtual channel. If virtual channels are disabled, remote printing does not function.

When this setting is disabled or not configured, the default value of Basic remote printing is enabled.

The default value of unchecked for ‘Automatically set default printer’ will not change the default printer on the host when the client connects; the default printer, if set on the host, will be a host local/network printer. When checked, the default printer on the host will match the client’s default printer within a session and will be reset to a host local/network printer upon client disconnection. This can allow for a user experience where printing can naturally occur close to the location of the client computer.

Session Automatic Reconnection Policy¶

This setting takes effect when you start the next session. This policy configures the automatic reconnection period, that is the amount of time a PCoIP Client and Server will attempt to reconnect an interrupted session without requiring the user to re-enter their logon credentials.

A session may be interrupted through network loss, for instance through pulling a network cable, disabling a network interface or moving away from a WiFi hotspot. In the case of portable computing devices closing a laptop lid or similar actions have the same effect. By default, when network connectivity returns within the specified time period, the session will be restored with no further user action being required.

If this setting is disabled or not configured, the default reconnect period is 20 minutes.

Setting this value to 0 disables the session automatic reconnection feature but allows for session reconnection as a result of intermittent short term network loss (between 30 and 60 seconds).

Timezone redirection¶

This setting takes effect when you start the next session. Configuring this allows you to enable or disable timezone redirection. When not configured, timezone redirection is enabled by default.