Take Control of Virtual Desktops across the Enterprise

VMware ACE addresses the challenge of deploying, maintaining and controlling complex desktop environments—from managed company-owned PCs to difficult to reach employee-owned and third-party PCs.

With ACE, IT administrators can design once and deploy PC environments to desktops, laptops and portable media devices. The policy-based management of ACE lets administrators configure, control and establish the security parameters for a virtual machine—packaged with all the software needed for an easy and secure desktop deployment . Once deployed, ACE clients can be tracked, modified and deactivated at any time via the ACE Management Server.

IT organizations can utilize ACE in a number of usage scenarios, including:

• Virtual Laptops – Deploy an IT managed “virtual laptop” to remote workers and third-party, unmanaged PCs for a lower cost and easier to manage solution than an additional fully-configured laptop.
• Sandbox Environments – Provide end-users with an isolated, secure virtual machine for accessing corporate resources, while providing another more open, configurable environment that requires less control.
• Training and Education – Enable students to access applications and data in secure, isolated virtual machines that can be rapidly configured and reconfigured for time and cost savings.
• Legacy OS Support – Run legacy applications and operating systems on a single PC. Safely contain access from these “old OSes” with security and isolation policies.

Create, Package & Deploy: With VMware ACE 2, IT administrators use VMware Workstation 6 to create and package a hardware-independent, IT-managed PC within a secured virtual machine and deploy it to a properly licensed physical PC or portable media device such as a USB flash drive.

Manage: VMware ACE Management Server delivers easy control and management of virtual desktop image from a centralized console. It supports dynamic policy updates, including the ability to activate or deactivate a virtual desktop at any time.

The Step-By-Step Process for a VMware ACE Deployment

Step 1: Create a virtual machine using Workstation 6, complete with the desired OS, data and applications.

Step 2: With the ACE Option Pack enabled on Workstation 6, you can wrap that virtual machine with security and control options by configuring policy settings for:

• Network access by port and traffic type
• Device Control by device type or ID
• Copy protection
• Expiration
• Password protection

Step 3: Package the configured virtual machine for secure and easy deployment. Some of the packaging features to make this process simpler include:

• Inclusion of ACE Player runtime in an .msi (Windows) or .tar (Linux) installer for seamless deployment
• Automation of Sysprepping Windows guest OS to enable single to many deployment capability
• Remote domain joining with the ACE Management Server and VPN integration to allow remote ACE clients to be controlled by domain tools
• Full integration with Active Directory for authentication

Step 4: Deploy the VMware ACE to a properly licensed PC or portable media device. A wide variety of platforms and devices are supported, including Windows (Vista, too!) and Linux on desktops, laptops, and portable devices. Refer to the ACE 2 Manual for a complete list.

Step 5: Manage VMware ACE clients from your ACE Management server. Track, dynamically update or deactivate a VMware ACE client at any time.

IT organizations can utilize ACE in a number of usage scenarios, including:

• Virtual Laptops – Deploy an IT managed “virtual laptop” to remote workers and third-party, unmanaged PCs for a lower cost and easier to manage solution than an additional fully-configured laptop.
• Sandbox Environments – Provide end-users with an isolated, secure virtual machine for accessing corporate resources, while providing another more open, configurable environment that requires less control.
• Training and Education – Enable students to access applications and data in secure, isolated virtual machines that can be rapidly configured and reconfigured for time and cost savings.
• Legacy OS Support – Run legacy applications and operating systems on a single PC. Safely contain access from these “old OSes” with security and isolation policies.
• Disaster Recovery – To ensure business continuity during a pandemic, for example, enable users to access their corporate desktop from home with an ACE virtual machine that has been deployed to portable flash media, using the Pocket ACE feature.

Virtual Rights Management (VRM) is new VMware technology that enables policies to be applied to virtual machines that govern:

• Who can access the virtual machine
• When the virtual machine can be used
• What network resources can be accessed
• What hardware on the host computer can be accessed
• What copy protection and encryption will be enforced

Through VRM, IT security administrators can control PC environment expiration dates, secure enterprise data through authentication, encryption, and copy protection controls, and ensure compliance with IT policies through rules-based network access.

To create ACE packages, Workstation 6 with the ACE Option Pack for Windows (2000 XP and Vista) is utilized. Linux host support is being evaluated and is a high priority. A wide variety of guest operating systems are supported, including most versions of Windows, Linux, and NetWare.

With Workstation 6, ACE authoring capabilities are enabled through the ACE Option Pack so that a single platform can be used by an IT administrator to not only test and develop applications with virtual machines, but also create and deploy secure and controlled ACE packages to end users. The addition of the VMware ACE 2 Management Server will provide the capability to track and dynamically activate/deactivate and update policies for these ACE clients.

No, ACE 2 contains significant functionality differences from ACE 1.0, and therefore is not compatible with ACE 1.0. The ACE 2 Management Server will not recognize ACE 1.0 clients. To obtain the benefits of ACE 2 functionality, please install Workstation 6 with ACE Option Pack for ACE authoring capabilities and upgrade to ACE 2 client licensing.

The Virtual Rights Management interface in VMware ACE provides a Network Quarantine Wizard. Through this wizard, Security administrators can set different network quarantine policies for virtual machines based on their build version. For example, security administrators can give out-of-date virtual machines access to the server that provides a required patch or software update but not to other parts of the network.

The Host Quarantine function can prevent the host PC from accessing the network while still allowing the ACE to connect to the network. This configuration does require the security administrator to use bridged networking for the virtual machine.

Through Virtual Rights Management, a security administrator can deny access to the host USB ports (as well as floppy drives and CD burners) from within the ACE environment. Therefore, an end user would not be able to copy information from within the ACE environment onto a USB memory device, floppy disk, or CD.

Security administrators can use existing system management tools such as those offered by Microsoft (SMS), Altiris, and LANDesk to push out operating system and application updates. If security administrators use the VMware ACE version-based network quarantine function, they should also patch the ACE project in ACE Manager and update the version number.

VMware ACE files are encrypted with the AES 128-bit algorithm. VMware has received approval from the US Department of Commerce to export VMware ACE internationally. FIPS 140-2 compliance testing has been completed and final certification is currently in-process.

The ACE virtual machine can use bridged networking to receive its own IP address (when available from a DHCP server), or it can use NAT and share the host's IP address.

Our support team is available to answer your questions and provide consulting services. For more information, go to the support section of our Web site.

You can evaluate the full working version of VMware ACE for free, for up to 30 days.

Please visit the product section of the VMware Web site. You can get more information about VMware products by contacting sales or by calling directly at 1-877-4VMWARE (1-877-486-9273) in the U.S. and Canada, +1-650-427-5000 elsewhere.

You can buy VMware ACE directly from the VMware online store, or contact sales, or call 1-877-4VMWARE (1-877-486-9273) in the U.S. and Canada, +1-650-427-5000 elsewhere. You can also search online for an authorized reseller.

VMware offers pay-per-request support for VMware ACE Starter Kit in one, three and five per incident support packs. It is highly recommended that you take advantage of our online knowledge base, documentation and discussion forums before deciding to pay for an individual incident.

VMware will be offering support for ACE 2.0 Standard and Enterprise Kits through our Platinum and Gold support and software subscription offerings. These programs are available on an annual or multi-year subscription basis. VMware Platinum Support is designed with mission-critical applications and production environments in mind. VMware Gold Support is designed for business-critical applications and platforms that require support during normal business hours. This service includes free updates and upgrades throughout the life of the contact. Support is delivered through VMware’s global support centers staffed 24x7 to provide access to our industry-leading expertise in virtualization.

Yes. If you have a support and subscription (SnS) contract on an earlier version of VMware ACE product, you can upgrade to SnS on ACE 2 for free for the duration of your contract. All qualifying ACE 1.0 customers will receive an email fulfillment with their ACE 2 upgrade license keys by May 21, 2007. Please contact VMware Support with any questions you have about your upgrade entitlement.

Upon general availability of VMware ACE 2, VMware will support VMware ACE 1.X for an additional 18 months.