You can select the security protocols and cryptographic algorithms that are used to encrypt communications between Horizon Client and Horizon servers or between Horizon Client and the agent in the remote desktop.

These security options are also used to encrypt the USB channel (communication between the USB service daemon and the agent).

With the default setting, cipher suites use 128- or 256-bit AES, remove anonymous DH algorithms, and then sort the current cipher list in order of encryption algorithm key length.

By default, TLS v1.0, TLS v1.1, and TLS v1.2 are enabled. SSL v2.0 and v3.0 are not supported.

Note: If TLS v1.0 and RC4 are disabled, USB redirection does not work when users are connected to Windows XP desktops. Be aware of the security risk if you choose to make this feature work by enabling TLS v1.0 and RC4.

If you configure a security protocol for Horizon Client that is not enabled on the View server to which the client connects, a TLS/SSL error occurs and the connection fails.

Important: At least one of the protocols that you enable in Horizon Client must also be enabled on the remote desktop. Otherwise, USB devices cannot be redirected to the remote desktop.

On the client system, you can use either a group policy setting or a Windows Registry setting to change the default ciphers and protocols. For information about using a GPO, see the setting called "Configures SSL protocols and cryptographic algorithms," in Security Settings for Client GPOs. For information about using the SSLCipherList setting in the Windows Registry, see Using the Windows Registry to Configure Horizon Client.