Hi My company have implemented Secure Admin Workstations . These are locked down workstations running Windows 10 enterprise that serves as hosts for local shielded Hyper-V VMs for privileged access to our internal systems and local "User Desktops" for unprivileged access. To connect to these virtual machines we are currently using VMConnect with enhanced session, this is an OK solution in most cases. There are drawbacks however that we are looking at solutions for, one of this are that VMConnect only supports maximizing a session on one or all monitors. To go around this limitation we have some user that wish to maximize the windows over a couple of monitors borderless. The job of resizing and stripping away the menu and border is easy using the user32.dll methods RemoveMenu DrawMenuBar SetWindowLong MoveWindow/SetWindowPos The issue is that VMConnect does not update the resolution of the VM but instead cuts the window or leaves the new areal empty: Is there any way to make VMConnect send the new windows size to the vm? I have tried all of the uFlags for SetWindowPos dockumented here , bRepaint for MoveWindow and UpdateWindow but from what I can see VMConnect has some other logic to determine that the size of the window has changed. Selecting some but not all of the monitors is possible using the build in RDP client, but I have found solution to use it to connect to VMs over VMbus (or over the HvSocket that enhanced session seems to use) without needing to authenticate two times (once to connect to localhost and then to the vm) - this also requires the user to have remote desktop users membership on the host.

Have you tried using a remote desktop connection to the VMs instead of VMconnect? VMconnect makes use of RDS capabilities, but it does not have access to all the capabilities that are available to a remote desktop connection. Generally if you want the full desktop capabilities, that can be accomplished with a Remote Desktop Services connection.

Hello, There are 2 requirements for dynamic resizing to work: running in Enhanced session mode fully logged in to the guest OS (it won't work on the lockscreen) As far as I understand, this feature now only supports one or all monitors, not some. Hope this will be implemented in future. VMConnect dynamic resize: https://learn.microsoft.com/en-us/virtualization/community/team-blog/2017/20170127-introducing-vmconnect-dynamic-resize You can post your suggestion in Remote Desktop Services for user voice ---------- If the Answer is helpful, please click "Accept Answer" and upvote it. Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. Best Regards Karlie

VMConnect enhanced session dynamic resizing not updating when resized by MoveWindow

Atle Corneliussen 6

My company have implemented Secure Admin Workstations. These are locked down workstations running Windows 10 enterprise that serves as hosts for local shielded Hyper-V VMs for privileged access to our internal systems and local "User Desktops" for unprivileged access.

To connect to these virtual machines we are currently using VMConnect with enhanced session, this is an OK solution in most cases.
There are drawbacks however that we are looking at solutions for, one of this are that VMConnect only supports maximizing a session on one or all monitors.

To go around this limitation we have some user that wish to maximize the windows over a couple of monitors borderless. The job of resizing and stripping away the menu and border is easy using the user32.dll methods

RemoveMenu
DrawMenuBar
SetWindowLong
MoveWindow/SetWindowPos

The issue is that VMConnect does not update the resolution of the VM but instead cuts the window or leaves the new areal empty:

Is there any way to make VMConnect send the new windows size to the vm?

I have tried all of the uFlags for SetWindowPos dockumented here, bRepaint for MoveWindow and UpdateWindow but from what I can see VMConnect has some other logic to determine that the size of the window has changed.

Selecting some but not all of the monitors is possible using the build in RDP client, but I have found solution to use it to connect to VMs over VMbus (or over the HvSocket that enhanced session seems to use) without needing to authenticate two times (once to connect to localhost and then to the vm) - this also requires the user to have remote desktop users membership on the host.

2 answers

TimCerling(ret) 1,156 Reputation points

2020-09-16T12:48:06.927+00:00

Have you tried using a remote desktop connection to the VMs instead of VMconnect? VMconnect makes use of RDS capabilities, but it does not have access to all the capabilities that are available to a remote desktop connection. Generally if you want the full desktop capabilities, that can be accomplished with a Remote Desktop Services connection.
Please sign in to rate this answer.

1 person found this answer helpful.
Atle Corneliussen 6 Reputation points

2020-09-16T13:11:37.163+00:00

Hi, Tim.

We have tried using the full Remote Desktop app but this requires us to do one of the following changes

Open up the network between the host and the local VMs

Add the user to the hosts "Remote Desktop Users" group and Connect over VMBus

Both solutions have drawbacks that have made us want to avoid using them

For nr. 1 this breaks the main point of a Secure Admin Workstation, separation of workspaces. Both the host and all the local virtual machines are connected to separate forced always on VPNtunnels.

Option nr 2 is also undesirable in that we need to provide additional permissions on the host and it requires the user to first connect and reauthenticate to the host and then to the virtual machine.

If we cant find another solution this might still be our best bet though.

TimCerling(ret) 1,156 Reputation points

2020-09-17T13:18:44.71+00:00

"Open up the network between the host and the local VMs"

There is no need to open the network between the host and the local VMs. When you create an external virtual switch to allow access to the VMs, the network on the VMs can be a completely separate network from the one on the host. They can exist in completely different VPNs for access.

"Add the user to the hosts "Remote Desktop Users" group and Connect over VMBus"

No need to add the user to host remote desktop users. User just needs to be added to the VM's remote desktop users. The host and the VMs running on the host can run completely isolated from each other. That is a very common configuration.

Maybe I am missing something in your configuration, but I regularly set up VMs on completely different networks from the host and managed/accessed them separately.

Atle Corneliussen 6 Reputation points

2020-09-18T05:35:51.137+00:00

Hi Tim,

The Secure Admin Workstations are laptops running Win10 with Hyper-V installed. These both work as hosts for the VMs and the desktop to were they access them from.
This article describes the concept, this follow up describes how to connect.

From what I understand, If we use the full RDS protocol we do need a network connection (RDP ports) between were we connect from, to were we connect to?

It is possible to configure the mstsc.exe client to connect over the VMBus, this way its possible to avoid having to open for full RDP between the SAW and the VMs the SAW is hosting but as described earlier we then need RDP membership (be allowed to connect remotely to the local host)

It might be that our best solution is to create our own RDP.

TimCerling(ret) 1,156 Reputation points

2020-09-18T12:58:31.96+00:00

Yes, if you plan to access the VMs running on the host via RDS from the host operating system, it is necessary to have a network path between the two. But that does not mean that the user using RDS to connect to the VM has to be a member of the remote desktop user group on the host. The user accessing the VM needs to be a member of a remote desktop user group on the VM being accessed. You can maintain separate remote desktop user groups for the host and for the VMs, so different groups of users can access the host and hosted VMs.

Creating your own RDP would be a massive undertaking. It would be possible, but it would be very, very expensive.

Atle Corneliussen 6 Reputation points

2020-09-18T13:17:37.58+00:00

RDP supports connection over the Hyper-V VMBUS as an alternative to connecting over network. This is the two separate connection methods I described.
I am well aware that connecting over the network don't rec the user to have RDUsers membership. Our current setup is not suited to use network as it would send all traffic into our datacenter and then back again to the VM because both have always-on VPN.

Only connection over VMbus requires adding the user to the hosts "Remote Desktop Users", this connection method works like this.
The user that is logged into the physical hosts (Win10 Laptop) RDPs from this device in to itself (127.0.0.0), and then to the vmbus using the vm's name (ID/GUID).
If you know of another way to connect to the VMbus I would like to hear!

Atle Corneliussen 6 Reputation points

2020-09-18T13:18:04.713+00:00

I am sorry there was an error in my last reply. I did not mean that we should develop a new RDP. What I meant was to develop an RDP client using the available Remote Desktop ActiveX controller or another of the open APIs.

TimCerling(ret) 1,156 Reputation points

2020-09-19T13:30:38.347+00:00

"From what I understand, If we use the full RDS protocol we do need a network connection (RDP ports) between were we connect from, to were we connect to?"

Yes, you need a network connection, but it does not have to be on the same network subnet. It can be a routed connection.

RDP connections are managed by user account, not by machine. So there is nothing special about an RDP connection from the host or a different source.

Again, I may be missing your concern. Accessing a VM does not require any sort of access to the host, but, if needed, a user on the host can make a network connection to the VM.

Writing your own RDP would be a massively complex and expensive undertaking.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Karlie Weng 18,531 Reputation points Microsoft Vendor

2020-09-17T07:17:25.173+00:00
Hello,

There are 2 requirements for dynamic resizing to work:

running in Enhanced session mode

fully logged in to the guest OS (it won't work on the lockscreen)

As far as I understand, this feature now only supports one or all monitors, not some.
Hope this will be implemented in future.

VMConnect dynamic resize:
https://learn.microsoft.com/en-us/virtualization/community/team-blog/2017/20170127-introducing-vmconnect-dynamic-resize

You can post your suggestion in Remote Desktop Services for user voice

----------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best Regards
Karlie
Please sign in to rate this answer.
Atle Corneliussen 6 Reputation points

2020-09-17T12:46:27.343+00:00

Hi Karlie!

The screenshot you provided is related to the startup size, this works as expected - and I know that VMConnect currently only supports One or all monitors.

What I am looking for is a way to trigger the update resolution function in VMConnect.
Dynamic resizing works fine when the windows size is modified by either double-clicking on the title bar to maximize or by dragging on the borders.

The issue occurs when the window size is modified by another application.
From what I can see the issue seems to be that VMConnect is programmed in a way that the dynamic resize function is tied to something else than the normal window controls native to Windows and therefor not noticing that the window have been resized.

// Atle
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

VMConnect enhanced session dynamic resizing not updating when resized by MoveWindow

Is there any way to make VMConnect send the new windows size to the vm?

2 answers

Your answer