Omnissa Horizon Advisor

Horizon Advisor is a PowerShell-driven management tool for Omnissa Horizon environments. Use this tool to validate your environment before installing or upgrading Horizon servers, install and upgrade Connection Servers, conduct AD LDS maintenance, and manage Secure Gateway services, from a graphical interface or the command line.

Prerequisites

Requirements Table

Note: Horizon Advisor must be run directly on the system where the precheck needs to be performed.

Launching the Tool

Open a PowerShell console and navigate to the folder where Horizon Advisor was extracted.
Then run:

.\Start-HorizonAdvisor.ps1

This opens the interactive main menu. You can also double-click HorizonAdvisor.bat in the extracted folder.

On first launch, a dialog asks whether to allow usage telemetry. To change this later, run .\Start-HorizonAdvisor.ps1 -TelemetryConsent enable|disable|reset|status.

Important: Every time you run Start-HorizonAdvisor.ps1, previously accepted TLS certificates are cleared. You will be re-prompted to accept any untrusted or self-signed certificates on each new run.

Main Menu Overview

After launching, select a tool from the Select a tool drop-down menu and click Launch, or double-click the item:

• Pre-Check Validations
• Manage Secure Gateway
• Omnissa Horizon Connection Server Lifecycle Management
• ADLDS Maintenance Tools

Closing a tool returns you to the main window.

Pre-Check Operations

Pre-Check validates your environment against Omnissa’s published requirements for a target Horizon version. It checks Active Directory settings, capacity providers, server prerequisites, and LDAP/API connectivity, then produces a detailed HTML and optionally PDF report.

Execution Modes

You can run Pre-Check against the following targets:

LDAP/API validation always runs from the machine that runs Horizon Advisor, against the Connection Server API endpoint, even when the other checks run on remote servers.

Validation Types

When you select Pre-Check Operations, you are presented with the following choices:

Note: LDAP Requirement Validation is only available on Horizon Server 2412 and later.

TLS Certificate Prompt

For LDAP and API validations, Horizon Advisor connects to the Horizon Connection Server over HTTPS. If the server uses a self-signed or untrusted TLS certificate, the following prompt appears:

Untrusted TLS certificate detected for https://<server>/rest/...
Subject   : CN=<server>
Issuer    : CN=<server>
Thumbprint: XXXX...
Valid From: ...
Valid To  : ...
Certificate appears to be self-signed.
Press '1' to accept this certificate for this run only
Press '2' to reject and stop the request
Select an option (1-2):

Press 1 to accept and continue. The certificate is trusted for the duration of this run only.

Press 2 to reject. The connection is aborted and the validation will not proceed.

This prompt appears on every run. Accepted certificates are never permanently stored.

To skip the prompt, select Accept self-signed / untrusted TLS certificate in the Pre-Check Validations window.

Understanding Reports

After a validation completes, an HTML report (and PDF if a supported browser is available) is automatically generated. The report includes:

Summary Section

Detailed Results Table

Row colors in the report correspond to status:

• Green: PASS
• Yellow/Orange: WARNING
• Red: FAIL
• Blue: SKIP

For items marked FAIL or WARNING, always review the Recommended column for the corrective action needed before proceeding with your Horizon installation or upgrade.

Report Location

Reports are saved to:

%ProgramData%\Omnissa\Horizon\logs\HorizonAdvisor\PreCheckReports\

File naming conventions

After the report is generated, the tool displays the full path to both the HTML and PDF files. You can open the HTML file in any web browser.

If Microsoft Edge or Google Chrome is not installed, the PDF will not be generated, but the HTML report will always be created.

Connection Server Lifecycle Management

Connection Server Lifecycle Management (LCM) installs new Connection Servers or upgrades existing ones. Horizon Advisor connects over WinRM, schedules the install or upgrade on each target, and then monitors the progress of each server until it succeeds, fails, or times out.

Important: Installs and upgrades affect running services. Run LCM during a maintenance window and take backups first.

Before You Start

• Place the Connection Server installer where the target servers can reach it: an SMB share path or an HTTPS URL that points directly at the installer file, for example Omnissa-Horizon-Connection-Server-x86_64-...-8.20.0-....exe. A link to a metadata file or other file is rejected.
• Make sure WinRM is reachable on every target server.
• Have an account in DOMAIN\user or user@domain form that is a domain user and a member of the local Administrators group on each target. This account runs the scheduled install or upgrade task.
• For an install, have the Connection Server recovery password and, for replica servers, the FQDN of the primary Connection Server.

Install a New Connection Server

1. Select Omnissa Horizon Connection Server Lifecycle Management and click Launch, then select Install new Connection Server.

2. Leave Run Pre-Check (all validations) before proceeding selected unless you have a reason to skip it. See Pre-Check Gate.

3. Under Build, enter the Build source (SMB/URL). For example:

   • smb://myserver/build/Omnissa-Horizon-Connection-Server-x86_64-2609-8.20.0-xxxxxx.exe
   • https://mywebserver/builds/Omnissa-Horizon-Connection-Server-x86_64-2609-8.20.0-xxxxxx.exe

   The version is read from the installer file name, so there is no version drop-down menu. The size, checksum, and build number come from the signed build catalog built into Horizon Advisor.

   Important: Do not rename the installer. Use the installer file name exactly as published by Omnissa. Horizon Advisor reads the version and build number from the file name and validates the file against them, so a renamed installer is rejected.

4. Under Target servers, enter a Server FQDN, select its install type, and click Add. Repeat for each server. To delete entries, select them and click Remove.

5. Edit the MSI arguments for each install type in the list. Placeholder values are shown in red. You must replace the recovery password, reminder, and primary Connection Server placeholders before you can start.

6. Under Credentials, enter the Username (DOMAIN\user) and Password.

7. Click Start. If the Pre-Check gate is on, it runs first.

8. Confirm the prompt to begin.

If you add a replica server whose primary server is in the same batch, Horizon Advisor installs the primary server first and waits for it to finish successfully before it schedules the replica. If the primary server install fails, the replica is skipped.

Connection Server Lifecycle Management

Connection Server Lifecycle Management (LCM) installs new Connection Servers or upgrades existing ones. Horizon Advisor connects over WinRM, schedules the install or upgrade on each target, and then monitors the progress of each server until it succeeds, fails, or times out.

Important: Installs and upgrades affect running services. Run LCM during a maintenance window and take backups first.

Before You Start

• Place the Connection Server installer where the target servers can reach it: an SMB share path or an HTTPS URL that points directly at the installer file, for example Omnissa-Horizon-Connection-Server-x86_64-...-8.20.0-....exe. A link to a metadata file or other file is rejected.
• Make sure WinRM is reachable on every target server.
• Have an account in DOMAIN\user or user@domain form that is a domain user and a member of the local Administrators group on each target. This account runs the scheduled install or upgrade task.
• For an install, have the Connection Server recovery password and, for replica servers, the FQDN of the primary Connection Server.

Install a New Connection Server

1. Select Omnissa Horizon Connection Server Lifecycle Management and click Launch, then select Install new Connection Server.

2. Leave Run Pre-Check (all validations) before proceeding selected unless you have a reason to skip it. See Pre-Check Gate.

3. Under Build, enter the Build source (SMB/URL). For example:

   • smb://myserver/build/Omnissa-Horizon-Connection-Server-x86_64-2609-8.20.0-xxxxxx.exe
   • https://mywebserver/builds/Omnissa-Horizon-Connection-Server-x86_64-2609-8.20.0-xxxxxx.exe

   The version is read from the installer file name, so there is no version drop-down menu. The size, checksum, and build number come from the signed build catalog built into Horizon Advisor.

   Important: Do not rename the installer. Use the installer file name exactly as published by Omnissa. Horizon Advisor reads the version and build number from the file name and validates the file against them, so a renamed installer is rejected.

4. Under Target servers, enter a Server FQDN, select its install type, and click Add. Repeat for each server. To delete entries, select them and click Remove.

5. Edit the MSI arguments for each install type in the list. Placeholder values are shown in red. You must replace the recovery password, reminder, and primary Connection Server placeholders before you can start.

6. Under Credentials, enter the Username (DOMAIN\user) and Password.

7. Click Start. If the Pre-Check gate is on, it runs first.

8. Confirm the prompt to begin.

If you add a replica server whose primary server is in the same batch, Horizon Advisor installs the primary server first and waits for it to finish successfully before it schedules the replica. If the primary server install fails, the replica is skipped.

AD LDS Operations

This module provides maintenance operations for the Horizon AD LDS (Active Directory Lightweight Directory Services) partition on the Connection Server.

Note: Starting in the 2606 release, the Connection Server installer automatically stops and disables Active Directory Web Services (ADWS) by default, since ADWS is not required for normal Connection Server operation. If your environment relies on ADWS for AD LDS maintenance or other purposes, you can temporarily re-enable it from this menu.

Available Operations

Using the Cleanup Operation

1. Select Clean Up Stale Client User Preference Data from the AD LDS Operations menu (or run the cleanup script directly).
   The tool displays the detected Horizon partition DN.

2. Choose your operation:

• Option 1: Show count of stale entries (no deletion) - safe preview
• Option 2: Delete stale entries - performs actual cleanup

3. Enter the staleness threshold:

• Specify the number of months to consider data as stale
• Press Enter to accept the default of 3 months
• Only data not modified within this period will be affected

4. Review the stale entry count:

• The tool scans AD LDS and displays how many stale objects were found
• If Option 1 was selected, the operation completes here with no deletions

5. Confirm deletion (Option 2 only):

• Review the count of entries to be deleted
• Type 1 to confirm deletion.
• Type anything else or press Escape to cancel the operation.

6. Deletion process:

• The tool deletes matching objects in batches (2,000 per batch).
• Progress is reported after each batch.

7. Completion:

• A total count of deleted objects is displayed

• The deletion report shows:

  • Total objects deleted
  • Cleanup completion status

Caution: This operation permanently deletes user preference data from AD LDS. Before proceeding with deletion:

• Verify that a backup of your AD LDS database exists
• Confirm with your team that old preferences can be safely removed
• Run Option 1 first to preview
• Consider running during a maintenance window with minimal user activity

Using ADWS State Management

Navigate to ADWS State Management

Open ADWS State Management in one of the following ways:

• In the ADLDS Maintenance Tools workspace, select Admin Ops.
• From the command line, run .\Start-HorizonAdvisor.ps1 -Flow 'ADLDS Operation' -Validation adws.

Then select the scope level and choose the required action.

Select Scope Level (Required)

Before running Verify, Enable, or Disable, choose one scope:

• Single pod

- Targets Connection Servers only in the selected pod.
- Use **Select Pod** to choose the specific pod.

• Cluster level (CPA Federation)

- Targets all discovered pods in the CPA federation.
- Use when the change must apply federation-wide.

If only one pod is discovered, cluster-level behavior is not applicable and operations run against the available pod scope.

Option 1: Verify ADWS State

What it does

• Checks ADWS status on discovered Connection Servers.
• Shows current service state, startup type, firewall state, and ADWS registry flag.
• Makes no configuration changes.

When to use

• Before enabling or disabling ADWS.
• After making changes, to confirm the final state.

Steps

1. Select Single pod or Cluster level (CPA Federation).

2. If Single pod is selected, choose the target pod in Select Pod.

3. Select Verify ADWS State

4. Wait for discovery and status collection to complete.

5. Review the output table for each server:

• Service state
• Startup type
• Firewall status
• EnableADWS value

Option 2: Enable ADWS

What it does

• Sets ADWS service startup to Automatic.
• Starts ADWS service if not running.
• Enables or creates the ADWS inbound firewall rule (TCP 9389).
• Sets EnableADWS registry value to 1.

Security warning

• ADWS is disabled by default to reduce security exposure.
• Enable ADWS only when required to complete a specific task (for example, troubleshooting or a legacy integration).
• After the task is complete, disable ADWS manually.

Steps

1. Select Single pod or Cluster level (CPA Federation).

2. If Single pod is selected, choose the target pod in Select Pod.

3. Select Enable ADWS.

4. Review the security warning.

5. Confirm the action when prompted.

6. Wait for execution to finish on all reachable servers.

7. Run Verify ADWS State to confirm ADWS is enabled where expected.

Option 3: Disable ADWS

What it does

• Stops ADWS service.
• Sets ADWS startup type to Disabled.
• Disables the ADWS inbound firewall rule.
• Sets EnableADWS registry value to 0.

When to use

• After completing the temporary task that required ADWS.
• To return to the secure default posture.

Steps

1. Select Single pod or Cluster level (CPA Federation).

2. If Single pod is selected, choose the target pod in Select Pod.

3. Select Disable ADWS.

4. Confirm the action when prompted.

5. Wait for execution to complete.

6. Run Verify ADWS State to confirm ADWS is disabled.

Servers already in the requested state are skipped. Servers not reachable over WinRM are reported and skipped.

ADLDS Maintenance Tools

The ADLDS Maintenance Tools are a workspace for viewing and maintaining the AD LDS data that Horizon uses. You can preview all changes to AD LDS with Dry Run first.

Note: The REST API connection from the ADLDS tools is a beta feature, has not been fully tested, and is not supported in this release.

Caution: Many operations delete or modify AD LDS data. Take a backup of the local and global AD LDS data, run each operation with Dry Run first, review the output, and then run it for real during a maintenance window.

Opening the Tools

• From the main window, select ADLDS Maintenance Tools and click Launch. The workspace opens in its own window.
• From the command line, run .\Start-HorizonAdvisor.ps1 -Flow 'ADLDS Tools'.
• Stand-alone, run HorizonADLDSTools.bat in the ADLDS Tools folder.

The workspace has a navigation tree on the left with four groups: Data Visualizer (shown by default), Admin Ops, Local Tools, and CPA Tools.

Common behavior across the workspace:

• Operations run in the background. Click Stop to end the active operation.
• A shared Script Output log shows progress for each operation.
• Output is written to %ProgramData%\Omnissa\Horizon\logs\adlds-out by default. To change the location, click Settings (the gear icon). Each session uses a timestamped subfolder.
• Local AD LDS uses port 389 and global AD LDS uses port 22389.
• Passwords are held in memory only and are not written to disk.
• Click ? Help for a description of the selected group.

Data Visualizer

Browse AD LDS data in a list with a detail pane, in one of two modes:

• LIVE queries AD LDS directly.
• FILE reads LDIF files that you load, so you can inspect an export offline.

• Use the search box to filter rows, the contextual drop-down menus (for example, machine State or pool Type) to narrow a view, and the column headers to sort.
• Select a row to see all of its attributes in the detail pane.
• In the Machines view, click Refresh Sessions to update session counts without reloading the full list.

Admin Ops

Admin Ops has a shared ADLDS Host box (default localhost) and a Query button. When opened, it queries both local and global AD LDS. Admin Ops also includes ADWS State Management.

FSMO Roles Manager

• Shows the Schema Master and Naming Master owners and the Connection Server inventory in the configuration partition, for local and global AD LDS.
• Shows how many configuration entries are unknown, meaning there is no matching active Connection Server in either partition. Click Remove CS to review and remove those stale entries.
• To move a role, select a live Connection Server and click Transfer Schema Master or Transfer Naming Master.

Decommission CS

Removes decommissioned Connection Servers from local and global AD LDS.

1. Load the server list. Either add the exported LDIF files (one per pod, plus the global export) and click Parse, or click Reload Live to query AD LDS directly.
2. In the Connection Servers grid, select each server to remove. Click a row to select it as the FSMO transfer target.
3. Set the Output Folder and the local and global target servers, and select Dry Run.
4. Click Generate to produce the removal LDIF files, then click Apply Local LDIF and Apply Global LDIF.
5. Review the Dry Run output, then deselect Dry Run and apply the files again.

Replication Status

• Discover Connection Servers by pod, select a scope (selected server, selected pod, or all discovered pods), and run repadmin /showrepl or repadmin /syncall.
• Each run writes a timestamped repadmin_status_<time> folder with per-server CSV and text files and a summary CSV, and lists the servers that need attention.

Local Tools

The Stale User Finder writes StaleUsers_<timestamp>.log, .csv, and .ldif files. Review the LDIF file, then apply it with Apply LDIF File.

CPA Tools

Command-Line Tools

These tools open in a console window and use your current Windows session for AD LDS access.

• Find Stale Users (Find-StaleUsers.ps1): scans local and global AD LDS for stale users and writes LDIF files for cleanup. It can optionally remove associated machines through the REST API.
• Apply ADLDS LDIF (Apply-AdldsLdif.ps1): applies a cleanup LDIF file using ldifde. Supports -WhatIf for a preview with no AD LDS contact, and -ContinueOnError.
• Remove Horizon User (Remove-HorizonUser.ps1): removes one user from local and global AD LDS, including FSP references, entitlements, pool memberships, and global assignments.
• Replication operations (Invoke-ReplicationOps.ps1): -Operation showrepl|syncall|scanall with -Scope SelectedCS|PodLevel|AllDiscoveredPods. Run with -Usage for examples.

Partition Migration

Partition Migration moves Horizon AD LDS from the legacy partition to the new Horizon partition. It supports migrating pods independently in separate maintenance windows, so Cloud Pod Architecture (CPA) keeps working in large multi-pod deployments. It is available from the ADLDS Maintenance Tools landing page and from the AD LDS Operations console menu.

Important: Read the following before you start.

• Upgrade the Connection Servers to version 2606 or later. In a CPA environment, upgrade the Connection Servers in all pods first.
• If you use Omnissa Access, upgrade the Access Connector to 24.12 or later, and apply the required patch unless you are on 24.12.1 or later.
• Migrate during a maintenance window. Avoid pool and entitlement changes and desktop or application launches while a migration is in progress.
• During local migration, all Connection Servers in the pod are put in Disabled mode and new connections are blocked until it completes.
• Confirm that there are no replication issues in the Horizon Console dashboard, that there are no stale Connection Server entries in the local or global configuration partitions, and that all Connection Servers in all pods stay up and healthy.
• Back up both local and global LDAP data before you begin.

Run a Partition Migration

1. Select the migration type: Local Partition Migration, Global Partition Migration, or Old Partition Cleanup, and enter the Horizon administrator credentials.
2. Click Run Pre-checks. The result appears in the log.
3. If the pre-checks pass, the step buttons appear. Run them in order, from top to bottom. Each step logs its progress.

If your API session expires during a step, you are prompted to update your credentials and click Reconnect. The operation then continues.

Local partition migration (per pod)

1. Validate prerequisites and prepare for migration.
2. Prepare the current pod for migration and disable the pod.
3. Initiate pod migration.
4. Switch the pod to the Horizon local partition.
5. Validate and enable the current pod.

Global partition migration (federation)

1. Initiate global partition migration for the federation.
2. Switch the federation to the Horizon global partition.
3. Validate that the Horizon global partition is in use.
4. If necessary, revert the federation to the old global partition (recovery). You are asked to confirm. Any answer other than Yes cancels the revert without changes.
5. After a revert, validate that the old global partition is in use.

Old partition cleanup

After a migration is validated, use Old Partition Cleanup to remove the legacy partition data. Select the confirmation check box before you run it.

Manage Secure Gateway Service

This module enables or disables the PCoIP Secure Gateway and BLAST Secure Gateway services on a Horizon Connection Server.

To use it, select Manage Secure Gateway in the main window and click Launch. Select an operation, click Execute, and review the log. The relevant services are stopped and started as part of the change. From the command line, run .\Start-HorizonAdvisor.ps1 -Flow 'Manage Security Gateway' to open the numbered menu below.

Available Operations

Secure Gateway management must be run directly on the Horizon Connection Server where the gateway services are installed. The tool will validate that a Horizon Connection Server installation is detected before proceeding.

Command-Line (Non-Interactive) Mode

Horizon Advisor supports non-interactive execution for use in scripts or automation pipelines. Pass parameters directly to Start-HorizonAdvisor.ps1 from the command line.

Syntax

.\Start-HorizonAdvisor.ps1 -Flow 'Precheck Validation' -Validation <type> -TargetHorizonVersion <version> [options]

Parameters

Examples

Run server validation:

.\Start-HorizonAdvisor.ps1 -Flow 'Precheck Validation' -Validation server -TargetHorizonVersion '2503'

Run Active Directory validation:

.\Start-HorizonAdvisor.ps1 -Flow 'Precheck Validation' -Validation activedirectory -AdFqdn 'dc.corp.example.com' -TargetHorizonVersion '2503'

Run vCenter validation:

.\Start-HorizonAdvisor.ps1 -Flow 'Precheck Validation' -Validation vcenter -VCenterFqdn 'vcenter.corp.example.com' -VCenterVersion '8.0.2' -TargetHorizonVersion '2503'

Run capacity provider validation (OpenShift):

.\Start-HorizonAdvisor.ps1 -Flow 'Precheck Validation' -Validation capacityprovider -CapacityProviderType OpenShift -CapacityProviderFqdn 'openshift.example.com' -CapacityProviderVersion '4.19' -TargetHorizonVersion '2606'

Run LDAP validation — password is prompted securely at runtime:

.\Start-HorizonAdvisor.ps1 -Flow 'Precheck Validation' -Validation ldap -HorizonAdminUsername 'admin' -HorizonDomain 'corp'

Run LDAP validation and accept a self-signed certificate without being prompted:

.\Start-HorizonAdvisor.ps1 -Flow 'Precheck Validation' -Validation ldap -HorizonAdminUsername 'admin' -HorizonDomain 'corp' -AcceptSelfSignedCertificate

Run all validations — password is prompted securely at runtime:

.\Start-HorizonAdvisor.ps1 -Flow 'Precheck Validation' -Validation all -AdFqdn 'dc.corp.example.com' -VCenterFqdn 'vcenter.corp.example.com' -VCenterVersion '8.0.2' -TargetHorizonVersion '2503' -HorizonAdminUsername 'admin' -HorizonDomain 'corp'

Run all validations against a list of servers:

.\Start-HorizonAdvisor.ps1 -Flow 'Precheck Validation' -Validation all -ExecutionMode Remote -RemoteServersCSV 'C:\servers.csv' -AdFqdn 'dc.corp.example.com' -VCenterFqdn 'vcenter.corp.example.com' -VCenterVersion '8.0.2' -TargetHorizonVersion '2503' -HorizonAdminUsername 'admin' -HorizonDomain 'corp'

Install or upgrade Connection Servers from a configuration file:

.\Start-HorizonAdvisor.ps1 -Flow lcm -Task install -Config lcm_install.json
.\Start-HorizonAdvisor.ps1 -Flow lcm -Task upgrade -Config lcm_upgrade.json

Open ADWS State Management or the ADLDS Maintenance Tools:

.\Start-HorizonAdvisor.ps1 -Flow 'ADLDS Operation' -Validation adws
.\Start-HorizonAdvisor.ps1 -Flow 'ADLDS Tools'

Password Handling for Automated / Scripted Runs

When running Horizon Advisor as part of a scheduled task or automation pipeline where no interactive prompt is possible, you need to supply the password upfront using the -HorizonAdminPassword parameter as a PowerShell SecureString.

How you provision SecureString is up to your organization’s security practices, for example: from a secrets manager, credential vault, an encrypted file, or any other method. The only requirement is that the value passed to -HorizonAdminPassword must be a SecureString.

Example: passing a SecureString for automated execution:

# Obtain a SecureString by whatever method suits your environment
$securePassword = <your SecureString here>
.\Start-HorizonAdvisor.ps1 -Flow 'Precheck Validation' -Validation ldap `
    -HorizonAdminUsername 'admin' -HorizonDomain 'corp' `
    -HorizonAdminPassword $securePassword

Getting Help

To display command-line usage and examples directly from the console:

.\Start-HorizonAdvisor.ps1 -Help