After activating several computers on VDI infrastructure, all those machines seem to be managed by a single entry on the DSM with different IP addresses.
It is not clear how a proper configuration and deployment is usually set up for VDI clones of the Master Image. Citrix Xen App and VMware View are some examples of such infrastructure. These computers are protected by Deep Security Agent (DSA), but not by Deep Security Virtual Appliance (DSVA). Also, these machines may also be non-persistent causing a need for re-activation every startup.
In such cases, you can use agent-initiated activation with specific settings on the DSM to perform an automatic deployment. A PowerShell startup script will be used to install the agent on the machine, which can also function on non-persistent computers.
To enable the agent-initiated activation:
- Keep the Golden Image (Master Image) template without any Deep Security Agent installed. If needed, clean up the uninstallation as well to ensure that no drivers are left. For the list of files to check, refer to this article: Manually uninstalling Deep Security Agent, Relay, and Notifier from Windows.
- Set up the DSM to allow re-activation from known computers.
- On the DSM console, navigate to Administration > System Settings.
- Click the Agents tab.
- Tick Allow Agent-Initiated Activation checkbox and select For Any Computers radio button.
- Enable Allow Agent to specify hostname checkbox.
- For the section If a computer with the same name already exists, choose Re-activate the existing computer.
- Tick Allow reactivation of cloned VMs checkbox.
- Create a deployment script for your machines.
- At the upper-right corner of the DSM console, click Support > Deployment Scripts.
- Select the appropriate platform (e.g. Microsoft Windows 64-bit).
- Tick the Activate Agent automatically after installation checkbox.
- Select the Security Policy you need for Citrix machines (e.g. Base Policy > Windows).
- Choose the target Computer Group.
- Select the Relay Group.
The PowerShell script will be generated as seen below:
- At the upper-right corner of the DSM console, click Support > Deployment Scripts.
- Copy all contents of generated PowerShell script and save it as .ps1 file in the startup scripts folder. Afterwards, set it as a startup script.
The script downloads the DSA MSI package, then installs and activates it. This will always generate a different ID while keeping the deployment automatic. While re-activating the hosts based on their hostname, this procedure ensures that a new entry will be created for each new computer you deploy from your VDI.
