Omnissa Horizon Advisor

Horizon Advisor is a PowerShell-driven management tool for Omnissa Horizon environments. Use this tool to validate your environment before installing or upgrading Horizon servers, conduct AD LDS maintenance, and manage Secure Gateway services, all from one interactive console interface.

Prerequisites

Requirements Table

Note: Horizon Advisor must be run directly on the system where the precheck needs to be performed.

Launching the Tool

Open a PowerShell console and navigate to the folder where Horizon Advisor was extracted.
Then run:

.\Start-HorizonAdvisor.ps1

This opens the interactive main menu.

Important: Every time you run Start-HorizonAdvisor.ps1, previously accepted TLS certificates are cleared. You will be re-prompted to accept any untrusted or self-signed certificates on each new run.

Main Menu Overview

After launching, you will see the following menu:

================================================================
            Welcome to Omnissa Horizon Advisor
         Your Comprehensive Horizon Management Tool
================================================================
Main Menu - Please select an option:
  1. Pre-Check Operations for Horizon Server Install / Upgrade
  2. AD LDS Operations
  3. Manage Secure Gateway Service
  4. Exit

Select a numbered option and press Enter.

Pre-Check Operations

Pre-Check validates your environment against Omnissa’s published requirements for a target Horizon version. It checks Active Directory settings, vCenter connections, server prerequisites, and LDAP/API connectivity, then produces a detailed HTML and optionally PDF report.

Validation Types

When you select Pre-Check Operations, you are presented with the following choices:

Note: LDAP Requirement Validation is only available on Horizon Server 2412 and later.

Running Validations Interactively

After selecting a validation type, the tool will prompt you for the required inputs:

Active Directory Validation

• Active Directory FQDN (e.g., dc.corp.example.com)
• Target Horizon version (e.g., 2503)

vCenter Validation

• vCenter FQDN (e.g., vcenter.corp.example.com)
• vCenter version (e.g., 8.0.2)
• Target Horizon version

Server Validation

• Target Horizon version

LDAP Validation

• Horizon Administrator username
• Horizon domain
• Horizon Administrator password (entered securely — input is hidden)

Run All Validations

• All of the above inputs are collected before execution begins.

TLS Certificate Prompt

For LDAP and API validations, Horizon Advisor connects to the Horizon Connection Server over HTTPS. If the server uses a self-signed or untrusted TLS certificate, the following prompt appears:

Untrusted TLS certificate detected for https://<server>/rest/...
Subject   : CN=<server>
Issuer    : CN=<server>
Thumbprint: XXXX...
Valid From: ...
Valid To  : ...
Certificate appears to be self-signed.
Press '1' to accept this certificate for this run only
Press '2' to reject and stop the request
Select an option (1-2):

Press 1 to accept and continue. The certificate is trusted for the duration of this run only.

Press 2 to reject. The connection is aborted and the validation will not proceed.

This prompt appears on every run. Accepted certificates are never permanently stored.

Understanding Reports

After a validation completes, an HTML report (and PDF if a supported browser is available) is automatically generated. The report includes:

Summary Section

Detailed Results Table

Row colors in the report correspond to status:

• Green: PASS
• Yellow/Orange: WARNING
• Red: FAIL
• Blue: SKIP

For items marked FAIL or WARNING, always review the Recommended column for the corrective action needed before proceeding with your Horizon installation or upgrade.

Report Location

Reports are saved to:

%ProgramData%\Omnissa\Horizon\logs\HorizonAdvisor\PreCheckReports\

File naming conventions

After the report is generated, the tool displays the full path to both the HTML and PDF files. You can open the HTML file in any web browser.

If Microsoft Edge or Google Chrome is not installed, the PDF will not be generated, but the HTML report will always be created.

AD LDS Operations

This module provides maintenance operations for the Horizon AD LDS (Active Directory Lightweight Directory Services) partition on the Connection Server.

Note: Starting in the 2606 release, the Connection Server installer automatically stops and disables Active Directory Web Services (ADWS) by default, since ADWS is not required for normal Connection Server operation. If your environment relies on ADWS for AD LDS maintenance or other purposes, you can temporarily re-enable it from this menu.

Available Operations

Using the Cleanup Operation

1. Select option 2 from the AD LDS Operations menu (or run the cleanup script directly).
   The tool displays the detected Horizon partition DN.
   

2. Choose your operation:

   • Option 1: Show count of stale entries (no deletion) - safe preview
   • Option 2: Delete stale entries - performs actual cleanup

3. Enter the staleness threshold:

   • Specify the number of months to consider data as stale
   • Press Enter to accept the default of 3 months
   • Only data not modified within this period will be affected

4. Review the stale entry count:

   • The tool scans AD LDS and displays how many stale objects were found
   • If Option 1 was selected, the operation completes here with no deletions

5. Confirm deletion (Option 2 only):

   • Review the count of entries to be deleted
   • Type 1 to confirm deletion.
   • Type anything else or press Escape to cancel the operation.

6. Deletion process:

   • The tool deletes matching objects in batches (2,000 per batch).
   • Progress is reported after each batch:

7. Completion:

   • A total count of deleted objects is displayed

   • The deletion report shows:

     • Total objects deleted
     • Cleanup completion status

Caution: This operation permanently deletes user preference data from AD LDS. Before proceeding with deletion:

• Verify that a backup of your AD LDS database exists
• Confirm with your team that old preferences can be safely removed
• Run Option 1 first to preview
• Consider running during a maintenance window with minimal user activity

Using ADWS State Management

Navigate to ADWS State Management

1. Open Horizon Advisor.

2. Select AD LDS Operations

3. Select ADWS State Management

4. Select the scope level and then choose the required action.

Select Scope Level (Required)

Before running Verify, Enable, or Disable, choose one scope:

• Single pod

  - Targets Connection Servers only in the selected pod.
  - Use **Select Pod** to choose the specific pod.
  

• Cluster level (CPA Federation)

  - Targets all discovered pods in the CPA federation.
  - Use when the change must apply federation-wide.
  

If only one pod is discovered, cluster-level behavior is not applicable and operations run against the available pod scope.

Option 1: Verify ADWS State

What it does

• Checks ADWS status on discovered Connection Servers.
• Shows current service state, startup type, firewall state, and ADWS registry flag.
• Makes no configuration changes.

When to use

• Before enabling or disabling ADWS.
• After making changes, to confirm the final state.

Steps

1. Select Single pod or Cluster level (CPA Federation).

2. If Single pod is selected, choose the target pod in Select Pod.

3. Select Verify ADWS State

4. Wait for discovery and status collection to complete.

5. Review the output table for each server:

   • Service state
   • Startup type
   • Firewall status
   • EnableADWS value

Option 2: Enable ADWS

What it does

• Sets ADWS service startup to Automatic.
• Starts ADWS service if not running.
• Enables or creates the ADWS inbound firewall rule (TCP 9389).
• Sets EnableADWS registry value to 1.

Security warning

• ADWS is disabled by default to reduce security exposure.
• Enable ADWS only when required to complete a specific task (for example, troubleshooting or a legacy integration).
• After the task is complete, disable ADWS manually.

Steps

1. Select Single pod or Cluster level (CPA Federation).

2. If Single pod is selected, choose the target pod in Select Pod.

3. Select Enable ADWS.

4. Review the security warning.

5. Confirm the action when prompted.

6. Wait for execution to finish on all reachable servers.

7. Run Verify ADWS State to confirm ADWS is enabled where expected.

Option 3: Disable ADWS

What it does

• Stops ADWS service.
• Sets ADWS startup type to Disabled.
• Disables the ADWS inbound firewall rule.
• Sets EnableADWS registry value to 0.

When to use

• After completing the temporary task that required ADWS.
• To return to the secure default posture.

Steps

1. Select Single pod or Cluster level (CPA Federation).

2. If Single pod is selected, choose the target pod in Select Pod.

3. Select Disable ADWS.

4. Confirm the action when prompted.

5. Wait for execution to complete.

6. Run Verify ADWS State to confirm ADWS is disabled.

Manage Secure Gateway Service

This module enables or disables the PCoIP Secure Gateway and BLAST Secure Gateway services on a Horizon Connection Server.

Available Operations

Secure Gateway management must be run directly on the Horizon Connection Server where the gateway services are installed. The tool will validate that a Horizon Connection Server installation is detected before proceeding.

Command-Line (Non-Interactive) Mode

Horizon Advisor supports non-interactive execution for use in scripts or automation pipelines. Pass parameters directly to Start-HorizonAdvisor.ps1 from the command line.

Syntax

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation <type> -TargetHorizonVersion <version> [options]

Parameters

Examples

Run server validation:

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation server -TargetHorizonVersion '2503'

Run Active Directory validation:

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation activedirectory -AdFqdn 'dc.corp.example.com' -TargetHorizonVersion '2503'

Run vCenter validation:

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation vcenter -VCenterFqdn 'vcenter.corp.example.com' -VCenterVersion '8.0.2' -TargetHorizonVersion '2503'

Run LDAP validation — password is prompted securely at runtime:

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation ldap -HorizonAdminUsername 'admin' -HorizonDomain 'corp'

Run LDAP validation and accept a self-signed certificate without being prompted:

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation ldap -HorizonAdminUsername 'admin' -HorizonDomain 'corp' -AcceptSelfSignedCertificate

Run all validations — password is prompted securely at runtime:

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation all -AdFqdn 'dc.corp.example.com' -VCenterFqdn 'vcenter.corp.example.com' -VCenterVersion '8.0.2' -TargetHorizonVersion '2503' -HorizonAdminUsername 'admin' -HorizonDomain 'corp'

Password Handling for Automated / Scripted Runs

When running Horizon Advisor as part of a scheduled task or automation pipeline where no interactive prompt is possible, you need to supply the password upfront using the -HorizonAdminPassword parameter as a PowerShell SecureString.

How you provision SecureString is up to your organization’s security practices, for example: from a secrets manager, credential vault, an encrypted file, or any other method. The only requirement is that the value passed to -HorizonAdminPassword must be a SecureString.

Example: passing a SecureString for automated execution:

# Obtain a SecureString by whatever method suits your environment
$securePassword = <your SecureString here>
.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation ldap `
    -HorizonAdminUsername 'admin' -HorizonDomain 'corp' `
    -HorizonAdminPassword $securePassword

Getting Help

To display command-line usage and examples directly from the console:

.\Start-HorizonAdvisor.ps1 -Help