(As an aside, this post is only talking to VDI and in particular as a desktop replacement and not other use cases that may include, but are not limited to training rooms, war rooms, remote access, etc.)

Licensing is confusing and expensive

The finger is first pointed at Microsoft and their ever changing (confusing) licensing scheme for VDI.   A quick browse of the VDI licensing guide details seven scenarios and the licensing implications for using VDI with respect to each.  Does it really need to be this confusing?  Can’t Microsoft license VDI in the same way they license Terminal Servers to simplify this?  The other hindrance here is the essential requirement that an organization purchase Software Assurance for desktops or purchase a VDA for each user/device connecting to a VDI desktop.  This is a cost of about $100 per user/desktop that some firms have not been used to shelling out.  Most of the firms that I have worked with (specifically the SMBs) don’t purchase Software Assurance for Windows desktops as they purchase Windows OEM licenses from Dell, HP, etc.

Let’s now point the finger at Citrix.  I have a law firm client at the moment that currently leverages XenApp as a desktop replacement and owns a XenApp license for every user in the firm.  “Upgrading” these licenses to XenDesktop using Citrix’s trade up calculator results in the firm paying $20,000 (retail) to convert their existing (140) concurrent use XenApp licenses to named user/device XenDesktop licenses.  Should they want to continue to leverage CCU licenses for XenDesktop, they would have to shell out almost $50,000….  ‘Yes’, they are technically now getting XenDesktop and XenApp as part of the upgrade, but I would contend that if Citrix allowed a 1:1 conversion from XenApp CCU licenses to XenDesktop  CCU licenses (and did not give XenApp for “free” as part of it), it would be more palpable for customers (but clearly less profitable for Citrix) to make the conversion.

Citrix and VMware’s Offline VDI solutions are not there yet

Let me start by acknowledging there are less and less scenarios in which a user is “offline” the days.  However there are still scenarios in which users are offline or have a degraded connection that require a functional offline VDI solution.  Specifically, airplanes, spotty WiFi in hotels (my personal pet peeve) and public spots along with low bandwidth/high latency air cards among other scenarios.  VMware’s botched approach with its Type II hypervisor with checking in/out VMs would not meet expectations of law firm users.  Citrix’s approach with its Type I hypervisor, XenClient, is promising but is still a 1.0 product one year later.  The HCL for XenClient is also limited to a subset of machines and the server piece (Synchronizer) of XenClient is also only available for Citrix XenServer, which also makes it a non starter.  The bottom line is that the current offerings by Citrix and VMware are just not good enough from a usability/manageability perspective for law firms to accept it.

Organization politics and delegation of responsibilities

This section is very specific to the legal space as most firms are structured such that there are “Infrastructure” folks and “Applications” folks that work in individual silos.  The Infrastructure folks are primarily responsible for networking, security, messaging, virtualization, shared storage, sometimes Citrix XenApp, etc. while the “Applications” folks are responsible for Windows desktops, user profile management, software distribution, application integration and the overall user experience.  My experience has been that most Applications folks don’t want to touch the Infrastructure, and Infrastructure folks definitely don’t want to deal with anything user facing.  If a firm were to embark on a VDI initiative, it would require tight collaboration between the two different silos as a successful VDI implementation requires careful infrastructure planning as well as application integration for good user experience.  Of course, fighting organizational politics and contention of responsibilities is left up to a CIO, but I see this is another reason why VDI goes nowhere in law firms.

User Experience is not as good as local desktops

Isn’t this what a desktop is all about?  If a firm invests hundreds of thousands of dollars in a new VDI desktop, and the user perception is that it doesn’t perform as well as the traditional desktop it was replacing, is the project a success?  PCoIP and ICA protocols have improved significantly along with some of the HDX and user experience improvement with the latest versions of XenDesktop and View, however designing a VDI desktop to perform as well as a typical local desktop (4 cores/4 GB RAM) with Windows 7 is still difficult to impossible.  Specifically when it comes to media (audio and video) and resource intensive applications.

The local desktop is still required

Ideally, a VDI environment would leverage a BYOPC or Thin Terminal model in which the local corporate desktop is obsolete and not required.  Users would have their own PC and Thin Terminals to access their “managed” corporate VDI desktop in which all their applications were available to them.  Unfortunately, its not that black and white at law firms.  To start, law firms have hundreds of applications and making them all available through a VDI desktop is very challenging even with application virtualization solutions.  Additionally, the local desktop in some way provides an “insurance policy” for firms to allow for local applications (outside the VDI desktop) in some facet.  This could be business applications such as a browser toolbar required for collaboration, or  Adobe PDF reader to view large PDF files a user brings in on a DVD.  These local applications could also be non-business applications such as DVD video software and iTunes.  The point is that law firms have knowledge workers who have an array of IT demands with respect to their applications and user experience and the local desktop would not get replaced
even with VDI.  I am not saying it is impossible, it would just be very hard.

The fact that the local desktop is still required creates multiple management points for IT as they have to not only manage a VDI desktop, they have to continue to maintain, service, patch, etc. a local Windows desktop.  Citrix and VMware would contend that the capital costs of VDI is not where the savings are, but the operational costs are where all the savings come from.  I am sure there are some fancy marketing charts or Gartner charts that attempt to prove this, but let’s take them at their word.  The challenge here is that most law firm’s would not be replacing their local desktops (with Thin Terminals) should they move forward with a VDI solution.

Honorable Mention

Capital costs for shared storage and virtualization infrastructure, Thin environments with XenApp/Terminal Servers can be built for a fraction of the cost of VDI.

Conclusions

I am going to end this post by saying the success to any VDI environment (or any technology project for that matter) is knowing your use case and business requirements.  This has been drilled into me by my colleague Matt Liebowitz who probably starts every VDI conversation with the phrase “know your use case”.  Too many times technologists lose sight of the business requirements and use cases for a particular technology before attempting to fit a square peg in a round hole.  VDI offers obvious benefits in some areas over a traditional desktop, but it isn’t a one size fits all model.   The use case I focus on in this post (VDI as a desktop replacements) relay my thoughts on why most firms see VDI as an non starter because the challenges associated with implementing VDI outweighs the firm’s business requirements for doing it.  Is VDI a non starter for all law firms?  Absolutely not. There are some scenarios in which a firm’s business requirements and existing desktop circumstances make VDI an attractive and potentially more cost effective approach than a traditional desktop.

First and foremost, XenClient has a very strict HCL.  It is specific to the most modern Dell, HP and Lenovo’s business series laptops with Intel Graphics.  This isn’t a surprise and is actually expected to some degree.  I know that Citrix is working closely with OEMs and Intel for compatibility, so this will expand as the product matures and if it finds a niche.  I was working with a test Dell Latitude E4300 as my XenClient laptop and was able to complete the install within 10 minutes.  It was very straightforward and went without a hitch.  The hypervisor takes about a minute to boot up and then you are presented with the main GUI (screenshot below).  The UI is pretty straightforward, and includes functional information like remaining battery life, gives the ability to connect to different wireless networks, and configuring some basic hypervisor’s properties.

Using the wizard driven menu, I created a Windows 7 desktop and that is what was presented at the center of the screen.

After Windows 7 was installed in a VM, I installed the XenTools, but still had an issue with audio playback.  This was resolved easily by installing the Realtek AC97 audio driver.  My test laptop only had 2 GB of RAM on it and although the hypervisor was utilizing 600+ MB of RAM, the 1 GB Windows 7 desktop ran pretty well.  I confirmed the hardware audio buttons worked and functions passed through to the VM and USB devices such as iPhones and aircards were also passed through without error.  Also, because the XenClient supports paravirtualization, it is able to directly pass through the Intel video card to the running VM.  This means Aero support, HD video playback among other functions that require video acceleration.  Check out the screenshot from the running VM.  The Intel GMA graphics driver is passed through into the virtual machine.

Finally, there is the “Synchronizer” piece that is the server backend that the XenClient can connect to.  It allows deploying, updating and managing virtual machine images centrally against connected XenClient hosts.  The Synchronizer Virtual Appliance only supports XenServer at the moment, so it has been a non-starter for me and expect it will be in most other environments as well.  It is rumored that a virtual appliance that supports ESX is slated for release later this year, so that should help make it easier to test.  I’ll do more testing when this is made available.

Anyway, the “1.0” release of XenClient should really be called an extended beta.  The product is very slick, but is far away from any production use.  I would go so far as to say that we are at least 12 months away from XenClient seeing a production environment.  Citrix has a interesting product, but has the challenge of figuring out specifically how XenClient fits into existing XenDesktop and Provisioning Server environments.  Will the Synchronizer be integrated into Provisioning Server in the future?  Will a Provisioning Server vDisk have the ability to be offline with XenClient?  XenClient introduces a lot of questions.

So why do I think is this rumor relevant again?  Last week, Citrix released the Citrix Access Gateway VPX 5.0.  Along with this release came a significant licensing change that cuts into the CSG’s value.  The Access Gateway’s “Platform License” ($995 retail) includes unlimited connections to XenApp/XenDesktop through the Access Gateway.  The “Universal” CALs (Access Gateway licenses) still exist, but now differentiate the VPN, Smart Access other traditional AG features.

So what does this mean?  This means that organizations that only want the SSL proxy functionality of the Access Gateway can do it at it a significantly lower price point than previously.  The price point is lowered because the (expensive) “Universal” licenses are no longer required for SSL XenApp/XenDesktop connections.  If Citrix were to stop supporting or developing the CSG, there is now a viable option from a price point perspective to its existing CSG customers.

Now that we have that squared away, someone would ask the obvious “Why should I pay for the Access Gateway VPX with a platform license, if the CSG is still free?  Free is still better.” – Fair question.  The value is in the new functionality included with the 5.0 platform of the Access Gateway.  The most obvious feature is the new High Availability feature on the 5.0 platform.  AG now supports running in an active/passive configuration on all appliances running 5.0 with the platform license.  This is something the CSG currently does not do and this reason alone is enough to consider moving to an AG 5.0 based appliance.

The other reason is to be forward thinking and understand that although the CSG serves a need today, it is obvious that Citrix is moving towards the AG platform.  While this might mean more of an investment now, the expectation is that it will pay off with newer features and functionality that comes with the AG platform going forward.

The Xenith isn’t out yet, but seems very promising with HDX support, thin firmware, minimal management and an attractive price point.  If a firm is considering a VDI environment with XenDesktop in the next 6 months, the Wyse Xenith is definitely worth a look.

XenClient 1.0 will be released later this week for download on MyCitrix and is being demoed and talked about at the conference.  After playing with it at one of the demo stations and talking with some Citrix Engineers, here are some details:

• Unlike VMware’s View, XenClient is a Type 1 hypervisor.  This means it lives above the client side OS (Windows).  Once installed, the user has the option to boot into whatever VMs are available on the laptop.
• At the moment, XenClient will only support a small subset of hardware types.  This includes Dell’s Latitude E series, Dell Optiplex 780, and  HP EliteBook laptops.  Full HCL to be published later in the week.
• Citrix Synchronizer is the server appliance that chats with the XenClient (over HTTP/SSL) to continuously sync and update the local running VM back to the Data Center.
• Synchronizer will be available as a virtual appliance running on XenServer.  According to Citrix, there is no planned version for ESX.  – I am sure this will change though.
• XenClient can be installed as a standalone or in conjunction with “Synchronizer”.
• XenClient supports paravirtualization to allow VMs direct access to hardware (using it’s native driver).  For example, a VM under XenClient can tap directly into a GPU for accelerated video playback and graphic intensive applications.  – This demoed very well with the engineer playing back an HD video file without skipping within a VM.
• At the moment, only a small subset of USB devices are supported through XenClient.

I am at Synergy all week, so I expect to learn more details about XenClient over the course of the week.  If you guys have questions, feel free to post them in the comments and I’ll try to get those questions answered while at the conference.

Citrix’s solution to the single image process is accomplished by a product called Provisioning Services (PVS). This software is the result of their purchase of a company called Ardence back in 2007. Provisioning Services is an often misunderstood piece of software, and its great benefits and potential are not necessarily apparent to everyone.

PVS works by streaming a master (read-only) image from the server to a target server or workstation. Any subsequent writes are then sent back to the PVS server and written to a cache file. The reads and writes are sent back and forth between the PVS server and target in a constant stream over the network. The easiest way to grasp this is to imagine that the cable connecting the hard disk inside of the server to the motherboard (and thus the CPU and RAM) is replaced by a network cable running back to the PVS server. The operating system sees the PVS disk as though it were a normal hard disk, and everything is done entirely transparent to the OS. The magic happens when the server is powered up; instead of booting from a local disk it is instead set to boot to the network card (PXE, BOOTP) which talks to a service on the PVS server, which streams the assigned operating system image to the target. The target device starts up immediately, as though it was booting from a local disk.

The beauty here is that this single read-only image can be simultaneously streamed to multiple diskless targets, both physical and virtual. This central image can now be maintained in one place. This makes tasks such as installing updates or new software quick and easy. After installing an update into the master image, all machines running that image will boot up into the updated image on next restart. To put that in perspective, think of the time and effort required to push out something such as a service pack to Windows or Microsoft Office to your entire firm. Now imagine simply installing that update once and having every machine in your environment receive that update on next reboot, without any additional effort.

Look for a follow-up post discussing the benefits that Provisioning Services can bring to a XenApp implementation.

Myth 1: Application compatibility is a huge problem on Terminal Servers.
There might have been some truth to this myth a decade ago, but in reality this is just not a big problem in the 2003/2008 world.  From my first hand experience, I can say that an application that works on XP will work on 2003, what works on Vista, will work on 2008, etc.  Are there some exceptions?  Of course.  However, these applications are few and far between, yet the “application compatibility” myth continues to circulate. This myth was probably true in the NT/2000 OS where applications did not do a good job of differentiating between “user” and “computer” parts of an installation.  Since Windows XP, application developers have done a better job writing “user” specific information in the user profile and “machine” specific information in Program Files, or HKLM.  I would probably attributed to the “Fast User Switching” feature introduced in XP.  Whatever the reason, this is just not a problem anymore.

Myth 2: Printing is a BIG problem on XenApp.
Historically, printing in XenApp was a big pain.  Managing driver versions, ensuring the appropriate client printer drivers are installed, distorted print jobs, crashing print spoolers.  It was difficult for a very long time… I guess this myth still has legs because of the bad taste left by those old versions of Metaframe and Metaframe XP.  However, since Citrix released the Universal Print Driver (UPD) in Presentation Server 4.0, there is less and less hard evidence that printing is still a “BIG” problem in XenApp.  Furthermore, with updates to the UPD in XenApp 4.5 and 5.0, Citrix has all but stamped out printing/driver problems in XenApp.  Do problems with the Citrix Print Manager service crashing and the print spooler still happen from time to time?  Yes, but not often enough to be concerned about.

Myth 3: The user experience on a Terminal server cannot be configured with the look and feel of a “desktop” OS.
This one is just unequivocally false. I am not sure where this one started, especially because most IT administrators know that Windows Server 2003 is built on the same code base as Windows XP, Windows Server 2008 is built on Vista, and now Windows 2008 R2 is built on Windows 7.  With that out of the way, the “look and feel” of the desktop OS is controlled by the Windows “Themes” service.  This service is disabled by default on Windows Server OS (for obvious reasons).  However, there is nothing preventing an administrator to configure Windows Server 2003 with the Windows XP “Luna” Theme once this “Themes” service is started.  And both Windows Server 2008 and 2008 R2 can be configured with the Aero theme by enabling the “Desktop Experience” Windows component.  Of course these visual upgrades would result in more resources being consumed by the Terminal Server and a slightly lower user density, but it is possible to do.  I have seen this done first hand in a production environment without error.

Myth 4: A crashing process for a user, will impact other users on the Terminal Server.
This myth still gets kicked around a lot.  Specifically, when decision makers are comparing the benefits of VDI over Terminal Servers.  It is typically described or understood to the administrator that “a program or process crashing for one user, will impact the other users running that application on the Terminal Server”.  I am going to say from firsthand experience, this is just not true, at least in the sense it is described above.  And if this was any thread of truth to this, I don’t think anyone would be running Terminal Servers.  Windows isolates processes for users running in their session, so that they don’t impact other users on the server when some process crashes.  For example, if I am logged into a terminal server and kill the Outlook.exe process running under my user context, no other users on the Terminal Server running Outlook.exe would be impacted.  So where does this myth originate from?  I think it is most likely stirred up from situations in which a specific Windows system service crashes or if a BSoD is generated by a kernel mode driver on the XenApp server, which would impact everyone on the server.  These can typically be averted by ensuring hardware drivers/firmware, Windows Server and XenApp are fully updated and patched.

Program Neighborhood (PN.EXE) was primarlily leveraged to create connections directly to XenApp servers (as opposed to connecting through a Web Interface or the PNAgent).  With the removal of the Program Neighborhood, Citrix has made it very clear that they do not want support this functionality.  Fortunately, there IS a way to work around this issue if you decide to upgrade to 11.2 client and are still required to make a connection directly to a XenApp server.  The trick is to create an ICA file. Copy and paste the template below into notepad and substitute the approriate server name denoted below as “servername.domain.com”.  Save the file with a .ICA extension and voilà.  You can now connect directly to a XenApp server with the 11.2 client.

Primarily, the 11.0 plug-in finally enables seamless functionality of published applications on Macs.  Seamless published applications (opposed from the desktop) present themselves to the user as if they are running locally.  This in turn allows the user to run published and local applications side-by-side for an improved experience.  More importantly, this seamless functionality opens the door for corporate environments who serve applications through the Program Neighborhood Agent or Citrix Web Interface to give Mac clients a user experience that is in line with what Windows clients have supported for years. 

Also included in this update is the introduction of Citrix’s Dazzle interface.  It looks like Citrix has larger plans for Dazzle suite, but from a client perspective, applications served through the Program Neighborhood website are presented in an iTunes like interface.  I think the logic Citrix is following is that users would be acclimated easily to an application delivery interface that mimics iTunes on the assumption that most users are already familiar with iTunes. The interface is clean, intuitive and even gives the user the ability to add the application to the OS X dock. The “Add” function threw an error for me when I was testing testing the client , but in theory it *should* work.  I’ll post the fix when I come across it, but this bug doesn’t takeaway from the huge functionality upgrade in this client.

It is unfortunate Citrix took years to finally give Macs the same support that the Windows client has had for years, but better late then never, right?  Download it here.

Dazzle interface of the 11.0 Mac plug-in: