Limited Availability: Troubleshoot Horizon Agent for macOS

Horizon Agent Log Files

Horizon Agent for macOS writes log files to the following locations:

• /var/log/omnissa/*.log
• /Users/<username>/Library/Logs/Omnissa/*.log
• /var/root/Library/Logs/Omnissa/*.log

Collect these logs when troubleshooting connection problems, session failures, or permission issues. To stream the most recent log entries:

tail -f /var/log/omnissa/viewagent-debug.log

Verify Horizon Agent Services

To confirm Horizon Agent services are running:

sudo launchctl list | grep omnissa

All Horizon Agent daemon entries should appear in the output with an exit code of zero. A non-zero exit code indicates a service failure.

Verify Connection Server Connectivity

To verify that the macOS machine can reach Horizon Connection Server:

nc -zv <connection-server-fqdn> 443

A successful connection indicates TCP port 443 is reachable. Blast sessions require additional ports to be open. Verify that required Horizon ports are open between the macOS machine and Connection Server.

Common Problems and Solutions

Black Screen After Session Connect

Cause: Horizon Agent does not have the Screen Recording permission..

Resolution: Grant Screen Recording permission manually in System Settings > Privacy & Security > Screen Recording, or deploy a PPPC MDM profile.

Keyboard and Mouse Input Not Working

Cause: Horizon Agent does not have the Accessibility or Input Monitoring permission.

Resolution: Review and grant the following permissions manually in System Settings > Privacy & Security:

Alternatively, deploy a PPPC MDM profile to grant these permissions automatically.

Horizon Agent Not Registering with Connection Server

Check the following:

• Confirm the macOS machine hostname resolves correctly through DNS.
• Confirm TCP port 443 is open between the macOS machine and Horizon Connection Server.
• Review Horizon Agent log files at /var/log/omnissa/viewagent-debug.log for specific error messages.

Blast Connection Failure

Cause: macOS Firewall or a network firewall blocks required Blast ports.

Resolution: Configure firewalls to permit the required Horizon Blast ports. Refer to the Horizon 8 Network Ports documentation for the required port list.

Permission Prompts Appearing Despite MDM Profile Deployment

• Input Monitoring and Screen & System Audio Recording prompts are expected. Apple does not allow MDM to silently grant these permissions, regardless of the PPPC profile configuration.
• Accessibility can be silently granted. If an Accessibility prompt appears, the PPPC profile is misconfigured.

If an Accessibility prompt continues to appear, or if the Input Monitoring or Screen Recording prompts do not appear at all — indicating that the profile failed to register the Allow Standard User to Set System Service setting — verify the following.

1. Confirm that the PPPC profile shows as Installed, not only Assigned, on the device in the UEM Console. Navigate to Devices > [device] > Profiles and Verify that the installation status is Installed. Confirm that the device has checked in with UEM after the profile was assigned.

2. Confirm the PPPC profile contains three separate app entries with the correct bundle identifiers:

   • com.omnissa.horizon.blastworker (Accessibility + Input Monitoring)
   • com.omnissa.horizon.agent (Screen & System Audio Recording)
   • com.omnissa.horizon.jre (Input Monitoring)

   To verify each binary on a reference machine, run the following commands.

   codesign --display -r - /path/to/BlastWorker
   codesign --display -r - /path/to/CaptureAgent
   codesign --display -r - /path/to/HorizonJRE
   

   Note: Do not run this command against the top-level /Applications/Omnissa\ Horizon\ Agent.app. The code requirement differs per sub-binary.

3. Confirm that the Access level is set correctly for each service:

   • Accessibility → Allow
   • Screen Capture → Allow Standard User to Set System Service
   • Listen Event → Allow Standard User to Set System Service

   Note: Setting Screen Capture or Listen Event to Allow does not silently grant the permission. Apple ignores this setting for these two services. The correct value is Allow Standard User to Set System Service, which ensures that the user receives the approval prompt on first VDI launch.

4. If all of the preceding settings are correct and the user still does not receive the prompt, force a device check-in from the UEM Console.

   • In the UEM Console, navigate to Devices > [device] > More Actions > Query > Device Profile.
   • Have the user log out and log back in to trigger a fresh session.

Collect Diagnostic Information

To collect a full diagnostic bundle for Omnissa Support, run the Horizon Agent diagnostic collection tool:

sudo /Library/Omnissa/horizonagent/support/dct-debug.sh

The diagnostic bundle saves to /tmp/. Provide this bundle when contacting Omnissa Support.

Known Limitations

The following limitations apply to Horizon Agent for macOS in the 2606 Limited Availability release.

• Physical machines only: Virtual machine deployments are not supported.
• Apple Silicon only: Intel-based Mac hardware is not supported.
• Single-session only: Each macOS machine supports one concurrent Horizon session. Multi-session (RDSH) is not supported.
• No Instant Clone support: Automated clone-based desktop provisioning is not available.
• No Published Applications: Only full desktop sessions are supported; individual app publishing is not available.
• No USB Redirection: USB devices connected to the client cannot be redirected to the macOS desktop.
• No Smart Card Redirection: Smart card authentication via redirected devices is not supported.
• Manual desktop pools only: Automated and floating assignment pools are not supported.
• User consent required on unmanaged devices: Users must manually approve macOS privacy permissions if the machine is not enrolled in an MDM solution.
• No Screen Recording support: Screen Recording is not supported.
• No hardware-accelerated encoding: Hardware-accelerated video encoding is not supported.