View a markdown version of this page

Manage your Windows WorkSpaces in WorkSpaces Personal - Amazon WorkSpaces
Install the Group Policy administrative template files for DCVManage Group Policy settings for DCVInstall the Group Policy administrative template for PCoIPManage Group Policy settings for PCoIPSet the maximum lifetime for a Kerberos ticketConfigure device proxy server settings for internet accessEnable Zoom Meeting Media Plugin support

Manage your Windows WorkSpaces in WorkSpaces Personal

You can use Group Policy Objects (GPOs) to apply settings to manage Windows WorkSpaces or users that are part of your Windows WorkSpaces directory.

Note

Amazon recommends that you create an organizational unit for your WorkSpaces Computer Objects and an organizational unit for your WorkSpaces User Objects.

To use the Group Policy settings that are specific to Amazon WorkSpaces, you must install the Group Policy administrative template for the protocol or protocols that you are using, either PCoIP or DCV.

Warning

Group Policy settings can affect the experience of your WorkSpace users as follows:

  • Implementing an interactive logon message to display a logon banner prevents users from being able to access their WorkSpaces. The interactive logon message Group Policy setting is not currently supported by PCoIP WorkSpaces. The logon message is supported on DCV WorkSpaces, and users have to login again after accepting the logon banner. Logon messages are not supported when Certificate-Based Logon is enabled.

  • Disabling removable storage through Group Policy settings causes a login failure that results in users being logged in to temporary user profiles with no access to drive D.

  • Removing users from the Remote Desktop Users local group through Group Policy settings prevents those users from being able to authenticate through the WorkSpaces client applications. For more information about this Group Policy setting, see Allow log on through Remote Desktop Services in the Microsoft documentation.

  • If you remove the built-in Users group from the Allow log on locally security policy, your PCoIP WorkSpaces users won't be able to connect to their WorkSpaces through the WorkSpaces client applications. Your PCoIP WorkSpaces also won't receive updates to the PCoIP agent software. PCoIP agent updates might contain security and other fixes, or they might enable new features for your WorkSpaces. For more information about working with this security policy, see Allow log on locally in the Microsoft documentation.

  • Group Policy settings can be used to restrict drive access. If you configure Group Policy settings to restrict access to drive C or to drive D, users can't access their WorkSpaces. To prevent this issue from occurring, make sure that your users can access drive C and drive D.

  • The WorkSpaces audio-in feature requires local logon access inside the WorkSpace. The audio-in feature is enabled by default for Windows WorkSpaces. However, if you have a Group Policy setting that restricts users' local logon in their WorkSpaces, audio-in won't work on your WorkSpaces. If you remove that Group Policy setting, the audio-in feature is enabled after the next reboot of the WorkSpace. For more information about this Group Policy setting, see Allow log on locally in the Microsoft documentation.

    For more information about enabling or disabling audio-in redirection, see Configure audio-in redirection for PCoIP or Configure audio-in redirection for DCV.

  • Using Group Policy to set the Windows power plan to Balanced or Power saver might cause your WorkSpaces to sleep when they're left idle. We strongly recommend using Group Policy to set the Windows power plan to High performance. For more information, see My Windows WorkSpace goes to sleep when it's left idle.

  • Some Group Policy settings force users to log off when they are disconnected from a session. Any applications that users have open on their WorkSpaces are closed.

  • "Set time limit for active but idle Remote Desktop Services sessions" is currently not supported on DCV WorkSpaces. Avoid using it during DCV sessions as it causes a disconnect even when there is activity and the session is not idle.

For information about using the Active Directory administration tools to work with GPOs, see Set up Active Directory Administration Tools for WorkSpaces Personal.

Install the Group Policy administrative template files for DCV

To use the Group Policy settings that are specific to WorkSpaces when using DCV, you must add the Group Policy administrative template wsp.admx and wsp.adml files for DCV to the Central Store of the domain controller for your WorkSpaces directory. For more information about .admx and .adml files, see How to create and manage the Central Store for Group Policy Administrative Templates in Windows.

The following procedure describes how to create the Central Store and add the administrative template files to it. Perform the following procedure on a directory administration WorkSpace or Amazon EC2 instance that is joined to your WorkSpaces directory.

To install the Group Policy administrative template files for DCV

  1. From a running Windows WorkSpace, make a copy of the wsp.admx and wsp.adml files in the C:\Program Files\Amazon\WSP directory.

  2. On a directory administration WorkSpace or an Amazon EC2 instance that is joined to your WorkSpaces directory, open Windows File Explorer, and in the address bar, enter your organization's fully qualified domain name (FQDN), such as \\example.com.

  3. Open the sysvol folder.

  4. Open the folder with the FQDN name.

  5. Open the Policies folder. You should now be in \\FQDN\sysvol\FQDN\Policies.

  6. If it doesn't already exist, create a folder named PolicyDefinitions.

  7. Open the PolicyDefinitions folder.

  8. Copy the wsp.admx file into the \\FQDN\sysvol\FQDN\Policies\PolicyDefinitions folder.

  9. Create a folder named en-US in the PolicyDefinitions folder.

  10. Open the en-US folder.

  11. Copy the wsp.adml file into the \\FQDN\sysvol\FQDN\Policies\PolicyDefinitions\en-US folder.

To verify that the administrative template files are correctly installed

  1. On a directory administration WorkSpace or an Amazon EC2 instance that is joined to your WorkSpaces directory, open the Group Policy Management tool (gpmc.msc).

  2. Expand the forest (Forest:FQDN).

  3. Expand Domains.

  4. Expand your FQDN (for example, example.com).

  5. Expand Group Policy Objects.

  6. Select Default Domain Policy, open the context (right-click) menu, and choose Edit.

    Note

    If the domain backing the WorkSpaces is an AWS Managed Microsoft AD directory, you cannot use the Default Domain Policy to create your GPO. Instead, you must create and link the GPO under the domain container that has delegated privileges.

    When you create a directory with AWS Managed Microsoft AD, Directory Service creates a yourdomainname organizational unit (OU) under the domain root. The name of this OU is based on the NetBIOS name that you typed when you created your directory. If you didn't specify a NetBIOS name, it will default to the first part of your Directory DNS name (for example, in the case of corp.example.com, the NetBIOS name is corp).

    To create your GPO, instead of selecting Default Domain Policy, select the yourdomainname OU (or any OU under that one), open the context (right-click) menu, and choose Create a GPO in this domain, and Link it here.

    For more information about the yourdomainname OU, see What Gets Created in the AWS Directory Service Administration Guide.

  7. In the Group Policy Management Editor, choose Computer Configuration, Policies, Administrative Templates, Amazon, and DCV.

  8. You can now use this DCV Group Policy object to modify the Group Policy settings that are specific to WorkSpaces when using DCV.

Manage Group Policy settings for DCV

To use Group Policy settings to manage your Windows WorkSpaces that use DCV

  1. Make sure that the most recent WorkSpaces Group Policy administrative template for DCV is installed in the Central Store of the domain controller for your WorkSpaces directory.

  2. Verify the administrative template files are correctly installed. For more information, see To verify that the administrative template files are correctly installed.

By default, WorkSpaces enables Basic remote printing, which offers limited printing capabilities because it uses a generic printer driver on the host side to ensure compatible printing.

Advanced remote printing for Windows clients connecting to Windows WorkSpaces lets you use specific features of your printer, such as double-sided printing, but it requires installation of the matching printer drivers on the host side and the client side.

You can use Group Policy settings to configure printer support as needed.

Basic vs. Advanced Printing
Aspect Basic Printing Advanced Printing
Driver Used Generic XPS driver Printer-specific driver
Driver Installation Automatic Manual (host and client)
Features Standard printing only Full printer features (duplex, paper tray selection, finishing, etc.)

When to use Advanced Printing: - Double-sided (duplex) printing - Specific paper tray selection - Finishing options (stapling, hole-punching) - Label printing (e.g., Zebra printers) - Color management and other advanced features of a printer.

Configure Printer Support

To configure printer support

  1. In the Group Policy Management Editor, choose Computer Configuration, Policies, Administrative Templates, Amazon, and WSP.

  2. Open the Configure remote printing setting.

  3. In the Configure remote printing dialog box, do one of the following:

    • For Basic Printing: choose Enabled. To automatically use the client computer's current default printer, select Map local default printer to the remote host.

    • For Advanced Printing: Choose Enabled, then choose Enable Advanced Printing.To automatically use the client computer's current default printer, select Map local default printer to the remote host. Once the policy is enabled, you will need to install matching printer drivers on the host and client side.

    • To disable printing, choose Disabled.

  4. Choose OK.

  5. The Group Policy setting change takes effect after the next Group Policy update for the WorkSpace and after the WorkSpace session is restarted. To apply the Group Policy changes, do one of the following:

    • Reboot the WorkSpace (in the Amazon WorkSpaces console, select the WorkSpace, then choose Actions, Reboot WorkSpaces).

    • In an administrative command prompt, enter gpupdate /force.

Configure Advanced Printer Redirection

Prerequisites

  1. WorkSpaces Host Agent: Version 2.2.0.2116 or later

  2. Windows Client: Version 5.31.0 or later

  3. Printer drivers: Matching printer drivers must be installed on both the WorkSpace and the client device

Note

Advanced printing is only supported on Windows clients connecting to Windows WorkSpaces. MacOS, Linux, and Web clients will use basic printing.

Driver Version Matching

When Advanced printing is selected, three driver validation modes are supported:

Driver Validation Modes
Mode Behavior Use When
Name Only (Default) Matches driver name only, ignores version Maximum compatibility needed
Partial Match Matches Major.Minor version (e.g., 10.6.x.x) Balancing compatibility and features
Exact Match Requires exact version match Specialized printers (e.g., Zebra label printers)

To configure validation mode, set name only, partial match, or exact match in the printer driver validation dropdown in the GPO.

Note

When driver validation fails, WorkSpaces automatically falls back to basic printing.

Verify Configuration

  1. Connect to the WorkSpace.

  2. Open Settings > Devices > Printers & scanners.

  3. Verify your local printer appears with "Redirected" prefix.

  4. Print a test document and click Printer Properties to verify advanced options are available.

Troubleshooting

Advanced features not available: - Verify "Enable Advanced Printing" is selected in the GPO - Check driver versions match according to your validation mode - Consider using partial validation mode instead of exact. Make sure to restart for any changes on the GPO to take effect.

Printer not appearing: - Verify Configure remote printing is Enabled - Ensure printer is connected to client device - Restart WorkSpace session

Print jobs fail: - Check driver versions on both client and WorkSpace - Review logs at: C:\ProgramData\Amazon\WSP\Logs\agentsession.log - Look for "Advanced print is enabled" in logs

Enable detailed logging: In Group Policy, set Configure log verbosity to debug under Computer Configuration > Policies > Administrative Templates > Amazon > WSP.

By default, WorkSpaces supports two-way (copy/paste) clipboard redirection. For Windows WorkSpaces, you can use Group Policy settings to disable this feature or configure the direction where clipboard redirection is allowed.

To configure clipboard redirection for Windows WorkSpaces

  1. In the Group Policy Management Editor, choose Computer Configuration, Policies, Administrative Templates, Amazon, and WSP.

  2. Open the Configure clipboard redirection setting.

  3. In the Configure clipboard redirection dialog box, choose Enabled or Disabled.

    When Configure clipboard redirection is Enabled, the following Clipboard redirection options will become available:

    • Choose Copy and Paste to allow two-way clipboard copy and paste redirection.

    • Choose Copy Only to allow copying data from the server clipboard to the client clipboard only.

    • Choose Paste Only to allow pasting data from the client clipboard to the server clipboard only.

  4. Choose OK.

  5. The Group Policy setting change takes effect after the next Group Policy update for the WorkSpace and after the WorkSpace session is restarted. To apply the Group Policy changes, do one of the following:

    • Reboot the WorkSpace (in the Amazon WorkSpaces console, select the WorkSpace, then choose Actions, Reboot WorkSpaces).

    • In an administrative command prompt, enter gpupdate /force.

Known limitation

With clipboard redirection enabled on the WorkSpace, if you copy content that is larger than 890 KB from a Microsoft Office application, the application might become slow or unresponsive for up to 5 seconds.

When you lose network connectivity, your active WorkSpaces client session is disconnected. WorkSpaces client applications for Windows and macOS attempt to reconnect the session automatically if network connectivity is restored within a certain amount of time. The default session resume timeout is 20 minutes (1200 seconds), but you can modify that value for WorkSpaces that are controlled by your domain's Group Policy settings.

To set the automatic session resume timeout value

  1. In the Group Policy Management Editor, choose Computer Configuration, Policies, Administrative Templates, Amazon, and WSP.

  2. Open the Enable/disable automatic reconnect setting.

  3. In the Enable/disable automatic reconnect dialog box, choose Enabled, and then set Reconnect timeout (seconds) to the desired timeout in seconds.

  4. Choose OK.

  5. The Group Policy setting change takes effect after the next Group Policy update for the WorkSpace and after the WorkSpace session is restarted. To apply the Group Policy changes, do one of the following:

    • Reboot the WorkSpace (in the Amazon WorkSpaces console, select the WorkSpace, then choose Actions, Reboot WorkSpaces).

    • In an administrative command prompt, enter gpupdate /force.

By default, WorkSpaces supports redirecting data from a local camera. If needed for Windows WorkSpaces, you can use Group Policy settings to disable this feature.

To configure video-in redirection for Windows WorkSpaces

  1. In the Group Policy Management Editor, choose Computer Configuration, Policies, Administrative Templates, Amazon, and WSP.

  2. Open the Enable/disable video-in redirection setting.

  3. In the Enable/disable video-in redirection dialog box, choose Enabled or Disabled.

  4. Choose OK.

  5. The Group Policy setting change takes effect after the next Group Policy update for the WorkSpace and after the WorkSpace session is restarted. To apply the Group Policy changes, do one of the following:

    • Reboot the WorkSpace (in the Amazon WorkSpaces console, select the WorkSpace, then choose Actions, Reboot WorkSpaces).

    • In an administrative command prompt, enter gpupdate /force.

By default, WorkSpaces supports redirecting data from a local microphone. If needed for Windows WorkSpaces, you can use Group Policy settings to disable this feature.

To configure audio-in redirection for Windows WorkSpaces

  1. In the Group Policy Management Editor, choose Computer Configuration, Policies, Administrative Templates, Amazon, and WSP.

  2. Open the Enable/disable audio-in redirection setting.

  3. In the Enable/disable audio-in redirection dialog box, choose Enabled or Disabled.

  4. Choose OK.

  5. The Group Policy setting change takes effect after the next Group Policy update for the WorkSpace and after the WorkSpace session is restarted. To apply the Group Policy changes, do one of the following:

    • Reboot the WorkSpace (in the Amazon WorkSpaces console, select the WorkSpace, then choose Actions, Reboot WorkSpaces).

    • In an administrative command prompt, enter gpupdate /force.

By default, WorkSpaces redirects data to a local speaker. If needed for Windows WorkSpaces, you can use Group Policy settings to disable this feature.

To configure audio-out redirection for Windows WorkSpaces

  1. In the Group Policy Management Editor, choose Computer Configuration, Policies, Administrative Templates, Amazon, and WSP.

  2. Open the Enable/disable audio-out redirection setting.

  3. In the Enable/disable audio-out redirection dialog box, choose Enabled or Disabled.

  4. Choose OK.

  5. The Group Policy setting change takes effect after the next Group Policy update for the WorkSpace and after the WorkSpace session is restarted. To apply the Group Policy changes, do one of the following:

    • Reboot the WorkSpace. In the Amazon WorkSpaces console, select the WorkSpace, then choose Actions > Reboot WorkSpaces.

    • In an administrative command prompt, enter gpupdate /force.

By default, the time within a Workspace is set to mirror the time zone of the client that is being used to connect to the WorkSpace. This behavior is controlled through time zone redirection. You might want to turn off time zone direction for various reasons. For example:

  • Your company wants all employees to work in a certain time zone (even if some employees are in other time zones).

  • You have scheduled tasks in a WorkSpace that are meant to run at a certain time in a specific time zone.

  • Your users who travel a lot want to keep their WorkSpaces in one time zone for consistency and personal preference.

If needed for Windows WorkSpaces, you can use Group Policy settings to disable this feature.

To disable time zone redirection for Windows WorkSpaces

  1. In the Group Policy Management Editor, choose Computer Configuration, Policies, Administrative Templates, Amazon, and WSP.

  2. Open the Enable/disable time zone redirection setting.

  3. In the Enable/disable time zone redirection dialog box, choose Disabled.

  4. Choose OK.

  5. The Group Policy setting change takes effect after the next Group Policy update for the WorkSpace and after the WorkSpace session is restarted. To apply the Group Policy changes, do one of the following:

    • Reboot the WorkSpace (in the Amazon WorkSpaces console, select the WorkSpace, then choose Actions, Reboot WorkSpaces).

    • In an administrative command prompt, enter gpupdate /force.

  6. Set the time zone for the WorkSpaces to the desired time zone.

The time zone of the WorkSpaces is now static and no longer mirrors the time zone of the client machines.

For DCV, data in transit is encrypted using TLS 1.2 encryption. By default, all of the following ciphers are allowed for encryption, and the client and server negotiate which cipher to use:

  • ECDHE-RSA-AES128-GCM-SHA256

  • ECDHE-ECDSA-AES128-GCM-SHA256

  • ECDHE-RSA-AES256-GCM-SHA384

  • ECDHE-ECDSA-AES256-GCM-SHA384

  • ECDHE-RSA-AES128-SHA256

  • ECDHE-RSA-AES256-SHA384

For Windows WorkSpaces, you can use Group Policy settings to modify the TLS Security Mode and to add new or block certain cipher suites. A detailed explanation of these settings and the supported cipher suites is provided in the Configure security settings Group Policy dialog box.

To configure DCV security settings

  1. In the Group Policy Management Editor, choose Computer Configuration, Policies, Administrative Templates, Amazon, and WSP.

  2. Open Configure security settings.

  3. In the Configure security settings dialog box, choose Enabled. Add cipher suites that you want to allow and remove cipher suites that you want to block. For more information about these settings, see the descriptions provided in the Configure security settings dialog box.

  4. Choose OK.

  5. The Group Policy setting change takes effect after the next Group Policy update for the WorkSpace, and after you restart the WorkSpace session. To apply the Group Policy changes, do one of the following:

    • To reboot the WorkSpace, in the Amazon WorkSpaces console, select the WorkSpace, then choose Actions, Reboot WorkSpaces.

    • In an administrative command prompt, enter gpupdate /force.

By default, support for WorkSpaces extensions is disabled. If needed, you can configure your WorkSpace to use extensions in the following ways:

  • Server and client – Enable extensions for both server and client

  • Server only – Enable extensions for server only

  • Client only – Enable extensions for client only

For Windows WorkSpaces, you can use Group Policy settings to configure the use of extensions.

To configure extensions for DCV

  1. In the Group Policy Management Editor, choose Computer Configuration, Policies, Administrative Templates, Amazon, and WSP.

  2. Open the Configure extensions setting.

  3. In the Configure extensions dialog box, choose Enabled and then set the desired support option. Choose Client Only, Server and Client, or Server only.

  4. Choose OK.

  5. The Group Policy setting change takes effect after the next Group Policy update for the WorkSpace and after you restart the WorkSpace session. To apply the Group Policy changes, do one of the following:

    • Reboot the WorkSpace. In the Amazon WorkSpaces console, select the WorkSpace, then choose Actions, Reboot WorkSpaces.

    • In an administrative command prompt, enter gpupdate /force.

By default, Amazon WorkSpaces are not enabled to support the use of smart cards for either pre-session authentication or in-session authentication. Pre-session authentication refers to smart card authentication that's performed while users are logging in to their WorkSpaces. In-session authentication refers to authentication that's performed after logging in.

If needed, you can enable pre-session and in-session authentication for Windows WorkSpaces by using Group Policy settings. Pre-session authentication must also be enabled through your AD Connector directory settings by using the EnableClientAuthentication API action or the enable-client-authentication AWS CLI command. For more information, see Enable Smart Card Authentication for AD Connector in the AWS Directory Service Administration Guide.

Note

To enable the use of smart cards with Windows WorkSpaces, additional steps are required. For more information, see Use smart cards for authentication in WorkSpaces Personal.

To configure smart card redirection for Windows WorkSpaces

  1. In the Group Policy Management Editor, choose Computer Configuration, Policies, Administrative Templates, Amazon, and WSP.

  2. Open the Enable/disable smart card redirection setting.

  3. In the Enable/disable smart card redirection dialog box, choose Enabled or Disabled.

  4. Choose OK.

  5. The Group Policy setting change takes effect after the WorkSpace session is restarted. To apply the Group Policy change, reboot the WorkSpace (in the Amazon WorkSpaces console, select the WorkSpace, then choose Actions, Reboot WorkSpaces).

By default, Amazon WorkSpaces enables WebAuthn redirection, allowing users to use their local FIDO2-compatible security keys and biometric authenticators with applications running inside their WorkSpace. This feature securely redirects authentication requests from applications in the WorkSpace to the user's local device, providing seamless access to authentication methods including Yubikeys and Windows Hello.

Amazon WorkSpaces supports two versions of WebAuthn redirection:

  • Standard WebAuthn - Requires a browser extension, supported on Windows and Linux WorkSpaces, for browser-based apps

  • Enhanced WebAuthn - No browser extension required, with additional native application support, supported on Windows WorkSpaces only

Standard WebAuthn redirection

Standard WebAuthn redirection requires a browser extension to facilitate the redirection of WebAuthn prompts to the client device.

Version requirements

  • Windows WorkSpaces: DCV host agent version 2.0.0.1425 or higher

  • Client versions:

    • Windows client: 5.19.0 or above

    • Mac client: 5.19.0 or above

    • Linux client: 2024.0 or above

Supported browsers on WorkSpaces

  • Google Chrome 116+

  • Microsoft Edge 116+

Enhanced WebAuthn redirection

Enhanced WebAuthn redirection eliminates the need for a browser extension and provides support for WebAuthn authentication in native Windows applications that support WebAuthn authentication.

Version requirements

  • Windows WorkSpaces: DCV host agent version 2.1.0.2000 or higher

  • Client versions:

    • Windows client: 5.29.0 or above

    • Mac client: 5.29.0 or above

Key benefits

  • No browser extension required

  • Improved performance

  • Support for WebAuthn in native Windows applications

  • Seamless authentication experience across browsers and desktop applications

Supported browsers on WorkSpaces

  • Google Chrome 116+

  • Microsoft Edge 116+

Configure WebAuthn redirection

To configure WebAuthn redirection for Windows WorkSpaces

  1. In the Group Policy Management Editor, choose Computer Configuration, Policies, Administrative Templates, Amazon, and DCV.

  2. Open the Configure WebAuthn redirection setting.

  3. In the Configure WebAuthn redirection dialog box, choose Enabled or Disabled.

  4. Choose OK.

  5. The Group Policy setting change takes effect after the WorkSpace session is restarted. To apply the Group Policy changes, reboot the WorkSpace by going to the Amazon WorkSpaces console and selecting the WorkSpace. Then, choose Actions, Reboot WorkSpaces.

Note

This Group Policy setting enables WebAuthn redirection. The version used (Standard or Enhanced) depends on your host agent version and operating system support.

Configure WebAuthn process compatibility

When WebAuthn redirection is enabled, you can configure which applications and processes are allowed to use WebAuthn redirection through the WebAuthn Process Compatibility List.

Default process compatibility list

By default, the following processes are enabled for WebAuthn redirection:

['chrome.exe','msedge.exe','island.exe','firefox.exe','dcvwebauthnnativemsghost.exe','msedgewebview2.exe','Microsoft.AAD.BrokerPlugin.exe']
Required process for Standard WebAuthn

  • dcvwebauthnnativemsghost.exe - This process is required for Standard WebAuthn functionality and must remain in the compatibility list when using Standard WebAuthn.

To configure the WebAuthn process compatibility list

  1. In the Group Policy Management Editor, choose Computer Configuration, Policies, Administrative Templates, Amazon, and DCV.

  2. Open the Configure WebAuthn Redirection setting.

  3. Choose Enabled.

  4. In the WebAuthn process compatibility list field, specify the list of process names that are compatible with WebAuthn redirection.

    • Use the default list as a starting point

    • Add additional process names as needed for your environment

  5. Choose OK.

  6. The Group Policy setting change takes effect after the WorkSpace session is restarted.

Process compatibility list guidelines

  • For Standard WebAuthn: Always include dcvwebauthnnativemsghost.exe in the list

  • Custom Applications: Add any additional .exe process names that need WebAuthn support in your environment

  • Format: Use comma-separated process names enclosed in square brackets, with each process name in single quotes

Example custom process list
['chrome.exe','msedge.exe','firefox.exe','dcvwebauthnnativemsghost.exe','msedgewebview2.exe','Microsoft.AAD.BrokerPlugin.exe','myapp.exe','customapplication.exe']

Transitioning from Standard to Enhanced WebAuthn

When upgrading from Standard WebAuthn to Enhanced WebAuthn, users will need to uninstall or disable the Amazon DCV WebAuthn Redirection browser extension they previously installed for Standard WebAuthn before using Enhanced WebAuthn.

Why this step is important

  • Enhanced WebAuthn handles redirection natively without browser extensions

  • Leaving the extension enabled will default to Standard WebAuthn redirection

Installing the Amazon DCV WebAuthn Redirection Extension (Standard WebAuthn Only)

Note

This section only applies to Standard WebAuthn. Enhanced WebAuthn does not require browser extensions.

Users will need to install the Amazon DCV WebAuthn Redirection Extension to use Standard WebAuthn after the feature is enabled by doing either of the following:

  • Users will be prompted to enable the browser extension in their browser.

    Note

    This is a one-time browser prompt. Your users will get the notification when you update the DCV agent version to 2.0.0.1425 or higher. If your end users don't need the WebAuthn redirection, they can just remove the extension from the browser. You can also block the WebAuthn Redirection Extension installation prompt using GPO policy.

  • You can force install the redirection extension for your users using GPO policy. If you enable the GPO policy, the extension will automatically be installed when your users launch the supported browsers with internet access.

  • Users can install the extension manually with Microsoft Edge Add-ons or the Chrome Web Store.

Understanding WebAuthn Redirection Extension Native Messaging

WebAuthn redirection in Chrome and Edge browsers utilizes a browser extension and a native messaging host. The native messaging host is a component that allows communication between the extension and the host application. In a typical configuration, all native messaging hosts are permitted by the browser by default. However, you can choose to use a native messaging blocklist, where the value of * means that all native messaging hosts are denied unless explicitly allowed. In this case, you need to enable the Amazon DCV WebAuthn Redirection native messaging host by explicitly specifying the value com.dcv.webauthnredirection.nativemessagehost in the allow list.

For more information, follow the guidance for your browser:

Manage and install the browser extension using Group Policy

You can install the Amazon DCV WebAuthn Redirection Extension using Group Policy, either centrally from your domain for session hosts that are joined to an Active Directory (AD) domain or using the Local Group Policy Editor for each session host. This process will change depending on which browser you're using.

For Microsoft Edge

  1. Download and install the Microsoft Edge administrative template.

  2. On a directory administration WorkSpace or an Amazon EC2 instance that is joined to your WorkSpaces directory, open the Group Policy Management tool (gpmc.msc).

  3. Expand the forest (Forest:FQDN).

  4. Expand Domains.

  5. Expand your FQDN (for example, example.com).

  6. Expand Group Policy Objects.

  7. Select Default Domain Policy, open the context (right-click) menu, and choose Edit.

  8. Choose Computer Configuration , Administrative Templates, Microsoft Edge, and Extensions

  9. Open Configure extension management settings and set it to Enabled.

  10. Under Configure extension management settings, enter the following:

    {"ihejeaahjpbegmaaegiikmlphghlfmeh":{"installation_mode":"force_installed","update_url":"https://edge.microsoft.com/extensionwebstorebase/v1/crx"}}

  11. Choose OK.

  12. The Group Policy setting change takes effect after the WorkSpace session is restarted. To apply the Group Policy changes, reboot the WorkSpace by going to the Amazon WorkSpaces console and selecting the WorkSpace. Then, choose Actions, Reboot WorkSpaces).

Note

You can block the installation of the extension by applying the following configuration management setting:

{"ihejeaahjpbegmaaegiikmlphghlfmeh":{"installation_mode":"blocked","update_url":"https://edge.microsoft.com/extensionwebstorebase/v1/crx"}}
For Google Chrome

  1. Download and install the Google Chrome administrative template. For more information, see Set Chrome Browser policies on managed PCs.

  2. On a directory administration WorkSpace or an Amazon EC2 instance that is joined to your WorkSpaces directory, open the Group Policy Management tool (gpmc.msc).

  3. Expand the forest (Forest:FQDN).

  4. Expand Domains.

  5. Expand your FQDN (for example, example.com).

  6. Expand Group Policy Objects.

  7. Select Default Domain Policy, open the context (right-click) menu, and choose Edit.

  8. Choose Computer Configuration , Administrative Templates, Google Chrome, and Extensions

  9. Open Configure extension management settings and set it to Enabled.

  10. Under Configure extension management settings, enter the following:

    {"mmiioagbgnbojdbcjoddlefhmcocfpmn":{ "installation_mode":"force_installed","update_url":"https://clients2.google.com/service/update2/crx"}}

  11. Choose OK.

  12. The Group Policy setting change takes effect after the WorkSpace session is restarted. To apply the Group Policy changes, reboot the WorkSpace by going to the Amazon WorkSpaces console and selecting the WorkSpace. Then, choose Actions, Reboot WorkSpaces).

Note

You can block the installation of the extension by applying the following configuration management setting:

{"mmiioagbgnbojdbcjoddlefhmcocfpmn":{ "installation_mode":"blocked","update_url":"https://clients2.google.com/service/update2/crx"}}

WebRTC redirection enhances real-time communication by offloading audio and video processing from WorkSpaces to your local client, which improves performance and reduces latency. However, WebRTC redirection isn't universal and requires third-party application vendors to develop specific integrations with WorkSpaces. For integration guidance, see Integrate your web application with WebRTC redirection. By default, WebRTC redirection isn't enabled on WorkSpaces. To use WebRTC redirection, ensure the following:

  • Third-party application vendor integration

  • WorkSpaces extensions are enabled through Group Policy settings

  • WebRTC redirection is enabled

  • WebRTC redirection Browser extension is installed and enabled

Note

This redirection is implemented as an extension and requires you to enable support for WorkSpaces extensions using Group Policy settings. If the extensions are disabled, WebRTC redirection will not function.

Requirements

WebRTC redirection for DCV requires the following:

  • DCV host agent version 2.0.0.1622 or higher

  • WorkSpaces clients:

    • Windows 5.21.0 or higher

    • Web client

  • Web browsers installed on your WorkSpaces running the Amazon DCV WebRTC Redirection Extension:

    • Google Chrome 116+

    • Microsoft Edge 116+

Enabling or disabling WebRTC redirection for Windows WorkSpaces

If needed, you can enable or disable support for WebRTC redirection for Windows WorkSpaces by using Group Policy settings. If you disable or don't configure this setting, WebRTC redirection will be disabled.

When feature is enabled, web applications that have integration with Amazon WorkSpaces will be able to redirect WebRTC API calls to the local client.

To configure WebRTC redirection for Windows WorkSpaces

  1. In the Group Policy Management Editor, choose Computer Configuration, Policies, Administrative Templates, Amazon, and WSP.

  2. Open the Configure WebRTC Redirection setting.

  3. In the Configure WebRTC Redirection dialog box, choose Enabled or Disabled.

  4. Choose OK.

  5. The Group Policy setting change takes effect after the WorkSpace session is restarted. To apply the Group Policy changes, reboot the WorkSpace by going to the Amazon WorkSpaces console and selecting the WorkSpace. Then, choose Actions, Reboot WorkSpaces).

Installing the Amazon DCV WebRTC Redirection Extension

Users install the Amazon DCV WebRTC Redirection Extension to use WebRTC redirection after the feature is enabled by doing either of the following:

  • Users will be prompted to enable the browser extension in their browser.

    Note

    As a one-time browser prompt, users will get the notification when you enable WebRTC redirection.

  • You can force install the redirection extension for users using the following GPO policy. If you enable the GPO policy, the extension will automatically be installed when users launch the supported browsers with internet access.

  • Users can install the extension manually with Microsoft Edge Add-ons or the Chrome Web Store.

Manage and install the browser extension using Group Policy

You can install the Amazon DCV WebRTC Redirection Extension using Group Policy, either centrally from your domain, for session hosts joined to an Active Directory (AD) domain, or using the Local Group Policy Editor for each session host. This process will be different depending on which browser you're using.

For Microsoft Edge

  1. Download and install the Microsoft Edge administrative template.

  2. On a directory administration WorkSpace or an Amazon EC2 instance that is joined to your WorkSpaces directory, open the Group Policy Management tool (gpmc.msc).

  3. Expand the forest (Forest:FQDN).

  4. Expand Domains.

  5. Expand your FQDN (for example, example.com).

  6. Expand Group Policy Objects.

  7. Select Default Domain Policy, open the context (right-click) menu, and choose Edit.

  8. Choose Computer Configuration , Administrative Templates, Microsoft Edge, and Extensions

  9. Open Configure extension management settings and set it to Enabled.

  10. Under Configure extension management settings, enter the following:

    {"kjbbkjjiecchbcdoollhgffghfjnbhef":{"installation_mode":"force_installed","update_url":"https://edge.microsoft.com/extensionwebstorebase/v1/crx"}}

  11. Choose OK.

  12. The Group Policy setting change takes effect after the WorkSpace session is restarted. To apply the Group Policy changes, reboot the WorkSpace by going to the Amazon WorkSpaces console and selecting the WorkSpace. Then, choose Actions, Reboot WorkSpaces).

Note

You can block the installation of the extension by applying the following configuration management setting:

{"kjbbkjjiecchbcdoollhgffghfjnbhef":{"installation_mode":"blocked","update_url":"https://edge.microsoft.com/extensionwebstorebase/v1/crx"}}
For Google Chrome

  1. Download and install the Google Chrome administrative template. For more information, see Set Chrome Browser policies on managed PCs.

  2. On a directory administration WorkSpace or an Amazon EC2 instance that is joined to your WorkSpaces directory, open the Group Policy Management tool (gpmc.msc).

  3. Expand the forest (Forest:FQDN).

  4. Expand Domains.

  5. Expand your FQDN (for example, example.com).

  6. Expand Group Policy Objects.

  7. Select Default Domain Policy, open the context (right-click) menu, and choose Edit.

  8. Choose Computer Configuration , Administrative Templates, Google Chrome, and Extensions

  9. Open Configure extension management settings and set it to Enabled.

  10. Under Configure extension management settings, enter the following:

    {"diilpfplcnhehakckkpmcmibmhbingnd":{ "installation_mode":"force_installed","update_url":"https://clients2.google.com/service/update2/crx"}}

  11. Choose OK.

  12. The Group Policy setting change takes effect after the WorkSpace session is restarted. To apply the Group Policy changes, reboot the WorkSpace by going to the Amazon WorkSpaces console and selecting the WorkSpace. Then, choose Actions, Reboot WorkSpaces).

Note

You can block the installation of the extension by applying the following configuration management setting:

{"diilpfplcnhehakckkpmcmibmhbingnd":{ "installation_mode":"blocked","update_url":"https://clients2.google.com/service/update2/crx"}}