For activity monitoring to work, there are several required procedures that must be performed, including installation of the guest introspection driver, installation of guest introspection VMs, and enabling NSX activity monitoring. Optionally, you can also use service composer to control which VMs are monitored.


  • NSX must be installed and operational.

  • NSX Manager must be linked with the AD server where it will get groups to which to match Windows VMs users.

  • The vCenter inventory must contain one or more Windows desktop VMs.

  • VMware Tools must be running and current on your Windows desktop VMs.


  1. On the Windows VMs in your vCenter inventory, install the Guest Introspection driver if it is not already installed.
    1. Navigate to Control Panel\Programs\Programs and Features, right-click VMware Tools and select Change.

    2. Select Modify.
    3. Under VMCI Driver, click Guest Introspection Drivers > Will be installed on local hard drive.

    The guest introspection driver detects what applications are running on each Windows VM and sends this information to the guest introspection VM.

  2. Install the guest introspection VMs.

    When first launching the VMware Tools install, choose the Custom option. In the VMCI folder, select Guest Introspection Driver. The driver is not selected by default.

    To add the driver after VMware Tools is already installed:

    1. In the vCenter Web Client, navigate to Networking & Security > Installation > Service Deployments.
    2. Add a new service deployment.
    3. Select Guest Introspection.
    4. Select the host clusters that contain Windows VMs.
    5. Select the appropriate datastores, networks, and IP addressing mechanism. If you are not using DHCP for your guest introspection VMs, create and assign an IP pool.

    Two guest introspection VMs are installed, one on each host within each cluster.

  3. Enable activity monitoring on the Windows VMs.
    1. In the Hosts and Clusters view, select the Windows VM, and select the Summary tab.
    2. In NSX Activity Monitoring, click Edit and click Yes.

      Repeat this step for all Windows VMs that you want to monitor.

  4. (Optional) Modify the list of vCenter objects that are monitored, or define a dynamic membership rule.
    1. In the vCenter Web Client, navigate to Networking & Security > Service Composer.
    2. Edit the Activity Monitoring Data Collection security group.
    3. Define a dynamic membership rule so that as new Windows VMs are added to the cluster, the VM will automatically be monitored.
    4. Select vCenter objects to include or exclude in the activity monitoring security group.

      The VMs on which you enabled activity monitoring are automatically included in the activity monitoring security group.

    In this example, all VMs with names starting with "win" are automatically added to the activity monitoring security group. This means that activity monitoring will be automatically enabled on them.