Horizon Advisor

Quick Start

Get up and running in just a few steps:

.\Start-HorizonAdvisor.ps1

System Requirements

Before you get started, make sure your system meets these minimum requirements:

Using the Graphical Interface

The Main Menu Window

When you launch Horizon Advisor without parameters, you see the main menu with a dropdown list of three tools. Pick a tool, read its description, then click Launch:

How to Use the UI

Launching Tools Directly from PowerShell

You can skip the main menu and launch tools directly using command-line parameters:

# Open the Pre-Check Validations tool
.\Start-HorizonAdvisor.ps1 -Flow precheck

# Open the AD LDS Operations menu
.\Start-HorizonAdvisor.ps1 -Flow 'ADLDS Operation'

# Open the Secure Gateway Manager menu
.\Start-HorizonAdvisor.ps1 -Flow 'Manage Security Gateway'

Pre-Check Validations

Use Pre-Check to validate that your infrastructure meets all requirements for Omnissa Horizon before you install or upgrade. It checks your Active Directory configuration, vCenter compatibility, server settings, LDAP connectivity, and API access, then generates a detailed report with pass/fail/warning results.

Validation Types

Execution Modes

Pre-Check can run against the local machine or fan out to other servers. The Execution Mode (top of the form) controls where the checks run:

Active Directory Module (RSAT-AD-PowerShell)

The domain-level AD checks (forest/domain functional level, read-write domain controller, DC operating system) use the ActiveDirectory PowerShell module, which needs RSAT-AD-PowerShell and a Kerberos ticket to reach the domain controller's ADWS endpoint.

• Local mode (interactive): if the module is missing, the tool offers to install it (Yes/No). Choose Yes to install it and continue.
• Remote / multi-server modes: the domain-level checks run on the orchestrator (the box you launched from, which has direct AD access) and are installed automatically only when you are an administrator; otherwise those specific rows are skipped with a clear message. Remote target servers do not have RSAT — they run only DNS reachability checks.

TLS Certificate Prompt

For LDAP and API validations, Horizon Advisor connects to the Connection Server over HTTPS. If the server uses a self-signed or untrusted certificate, a prompt shows the certificate details:

Untrusted TLS certificate detected for https://<server>/rest/...
Subject   : CN=<server>
Issuer    : CN=<server>
Thumbprint: XXXX...
Valid From: ...   Valid To: ...

Certificate appears to be self-signed.
[1] Accept this certificate for this run only
[2] Reject and stop the request

Understanding Reports

After a validation completes, an HTML report (and PDF if a supported browser is available) is generated automatically.

Summary Section

Detailed Results Table

Report Location

%ProgramData%\Omnissa\Horizon\logs\HorizonAdvisor\PreCheckReports\

AD LDS Operations

Maintain your Horizon AD LDS partition and manage related services. Selecting AD LDS Operations from the main menu opens a submenu with three operations:

Cleaning Up Stale User Preference Data

This operation allows you to preview and optionally delete stale user preference objects from AD LDS. Here's how it works:

Partition Migration

Partition Migration updates your Horizon AD LDS application partition from the legacy naming scheme to the new scheme introduced in recent Horizon releases. It is a guided, step-by-step operation you run directly on a Horizon Connection Server.

Before you begin

• Upgrade Horizon to 2606 or later before running.
• If you use Omnissa Access, upgrade the connector so it supports the new partition name.
• Run during a maintenance window — avoid pool changes, entitlement changes, and desktop/app launches while migration is in progress.
• Confirm there are no replication issues (check the Horizon Console dashboard).
• Sign in with a domain user that is a local administrator on the Connection Server and a Horizon Full Administrator.

Using the Partition Migration screen (3 phases)

The three tasks

Local Partition Migration steps

Once pre-checks pass for the Local task, the five steps unlock. Run them top to bottom:

Global Partition Migration steps

Global migration is only for environments with CPA enabled, and only after the local migration is complete and in use. The screen groups the forward-migration steps and the recovery (revert) steps under a distinct Revert heading:

ADWS State Management

This operation verifies, enables, or disables AD Web Services (ADWS) across the Connection Servers discovered from Horizon LDAP. ADWS (port 9389) is what the tool's Active Directory checks rely on. Hosts that can't be reached are reported and skipped rather than failing the whole run.

Manage Secure Gateway Service

Use this tool to enable or disable the PCoIP Secure Gateway and BLAST Secure Gateway services on your Horizon Connection Server. Secure Gateways allow clients to connect securely from untrusted networks.

How to Use

Automation & Scripting (Command-Line Mode)

For automated runs in scripts, scheduled tasks, or CI/CD pipelines, you can run Horizon Advisor entirely from the command line without any interactive prompts using the -Flow precheck option.

Syntax

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation <type> -TargetHorizonVersion <version> [options]

Parameters

Examples

Server validation:

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation server -TargetHorizonVersion '2503'

Active Directory validation:

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation activedirectory `
    -AdFqdn 'dc.corp.example.com' -TargetHorizonVersion '2503'

vCenter validation:

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation vcenter `
    -VCenterFqdn 'vcenter.corp.example.com' -VCenterVersion '8.0.2' -TargetHorizonVersion '2503'

LDAP validation — password prompted securely at runtime:

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation ldap `
    -HorizonAdminUsername 'admin' -HorizonDomain 'corp'

LDAP validation — accept self-signed certificate without prompt:

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation ldap `
    -HorizonAdminUsername 'admin' -HorizonDomain 'corp' -AcceptSelfSignedCertificate

Run all validations:

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation all `
    -AdFqdn 'dc.corp.example.com' `
    -VCenterFqdn 'vcenter.corp.example.com' -VCenterVersion '8.0.2' `
    -TargetHorizonVersion '2503' `
    -HorizonAdminUsername 'admin' -HorizonDomain 'corp'

Capacity Provider validation (Nutanix Prism Central):

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation capacityprovider `
    -CapacityProviderType 'Nutanix_PrismCentral' -CapacityProviderFqdn 'prism.corp.example.com' `
    -CapacityProviderVersion 'pc.7.5' -TargetHorizonVersion '2606'

Run all validations against remote servers (over WinRM):

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation all -ExecutionMode Remote `
    -AdFqdn 'dc.corp.example.com' `
    -VCenterFqdn 'vcenter.corp.example.com' -VCenterVersion '8.0.2' `
    -TargetHorizonVersion '2606' `
    -HorizonAdminUsername 'admin' -HorizonDomain 'corp'

Open AD LDS Operations menu:

.\Start-HorizonAdvisor.ps1 -Flow 'ADLDS Operation'

Open Secure Gateway Manager menu:

.\Start-HorizonAdvisor.ps1 -Flow 'Manage Security Gateway'

Password Handling for Scheduled/Automated Tasks

When running Horizon Advisor automatically (in a scheduled task or CI/CD pipeline), you usually can't provide an interactive password prompt. Use the -HorizonAdminPassword parameter with a PowerShell SecureString to automate password entry.

Example: If you have a SecureString stored in a variable called $securePassword, run:

.\Start-HorizonAdvisor.ps1 -Flow precheck -Validation ldap `
    -HorizonAdminUsername 'admin' -HorizonDomain 'corp' `
    -HorizonAdminPassword $securePassword

Getting Help & Troubleshooting

Getting Command-Line Help

To see all available command-line options, parameters, and examples directly from PowerShell:

.\Start-HorizonAdvisor.ps1 -Help

Where to Find Logs and Reports

When Horizon Advisor runs, it creates detailed logs and saves reports to:

%ProgramData%\Omnissa\Horizon\logs\HorizonAdvisor\

This folder contains:

• PreCheckReports/ — HTML and PDF validation reports
• Logs/ — Operation logs and debug information

Common Issues

❌ "Horizon Connection Server installation not detected"

You're trying to run AD LDS or Secure Gateway operations on a non-Connection Server machine. These tools must be run directly on the Connection Server.

❌ "Certificate verification failed" during LDAP validation

The Connection Server is using a self-signed or untrusted certificate. This is normal in lab/test environments. When prompted, select option [1] Accept this certificate. To suppress the prompt in automated runs, use the -AcceptSelfSignedCertificate flag.

❌ "Access denied" or permission errors

Horizon Advisor requires administrative privileges on the local machine. Run PowerShell as Administrator and try again.

❌ PowerShell execution policy blocks the script

If you see a "cannot be loaded because running scripts is disabled" error, run this command in PowerShell (as Administrator):

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

Questions or Issues?

For additional help:

• Consult the logs in %ProgramData%\Omnissa\Horizon\logs\HorizonAdvisor\
• Review the -Help output for command-line usage
• Check the Omnissa documentation or support resources