Encrypt and Restrict a Virtual Machine

You can encrypt a virtual machine to secure it from unauthorized use. You can also enable restrictions to prevent users from changing configuration settings.

Depending on the size of the virtual machine, the encryption process can take several minutes or several hours.

Prerequisites

• Power off the virtual machine.

• Familiarize yourself with the encryption feature limitations. See Virtual Machine Encryption Limitations.

• Familiarize yourself with restricted virtual machine expiration behavior. See Restricted Virtual Machine Expiration.

Procedure

1. Select the virtual machine and select VM > Settings.
2. On the Options tab, select Access Control.
3. Click Encrypt.
4. Click Encrypt, type an encryption password, and click Encrypt.

   The encryption password is required to gain access to the virtual machine. It does not prevent the user from changing the virtual machine configuration. Turn on restrictions and enter a password to prevent the user from changing the virtual machine configuration.

   Important:

   Record the encryption password you use. If you forget the password, Workstation Pro does not provide a way to retrieve it.

   Workstation Pro begins encrypting the virtual machine. After the encryption process is complete, you can optionally set a restrictions password.

5. (Optional) To enable restrictions, select the Enable restrictions check box and configure restrictions options.

   Option	Action
   Restrictions password	Set the restrictions password. The restrictions password prevents users of the virtual machine from changing the virtual machine configuration. Important: Record the restrictions password you use. If you forget the password, Workstation Pro does not provide a way to retrieve it.
   Restrictions type	Select a restriction type. Fixed - Enables you to set specific restrictions for the individual virtual machine. Managed - Enables restrictions for the virtual machine to be managed by a Horizon FLEX Policy Server. If you select this option, you must provide the server address of a Horizon FLEX server in the Management server text box. Do not select this option unless you have a Horizon FLEX installation.
   Require the user to change the encryption password when this virtual machine is moved or copied	(Optional) Select this check box to require the user to change the encryption password for the virtual machine if the virtual machine is moved or copied.
   Allow USB devices to be connected to this virtual machine	(Optional) Select this check box to allow USB device connections in the virtual machine.
   Expire the virtual machine after	(Optional) If you selected the Fixed restriction type, set a date and time for the virtual machine to expire. Click the down arrow to select an expiration date. Click in the time field and enter the expiration time. To enter an alert message, perform these steps: Click Advanced. Enter text to be displayed when the virtual machine expires. Select the check box to show a message when the virtual machine is about to expire and enter message text. Set the number of days before expiration that the message is displayed. Click OK.
   Management server	(Optional) If you selected the Managed restriction type, type the URL of the Horizon FLEX server on which you intend to host the virtual machine with Horizon FLEX.
   Check server	(Optional) If you selected the Managed restriction type, click this button to verify the Horizon FLEX server URL.
   Manage certificates	(Optional) If you selected the Managed restriction type, click this button and then click Add to navigate to the location of each certificate file to add. If you add certificates to the virtual machine, the Horizon FLEX Client uses the certificates in the virtual machine and does not use the certificates on the host. To control certificates for all virtual machines from the Horizon FLEX Policy Server, leave the Manage Certificates box blank.

6. Click OK in the Virtual Machine Settings dialog box.