We’ve seen many compelling announcements emanating from Microsoft Ignite this week. One measure of the significance of where Microsoft is headed can be seen in the jump in their stock price! Another measure is the resonance with what customers want. Windows 10 first became available 18 months ago on Azure, and Workspot was there on day 1, working with thought leaders to deploy cloud PCs on any of the Azure regions around the world. Today, with so many organizations going to the cloud, it’s very clear that one of the things customers really want is a cloud PC service. That’s why Workspot is excited to announce day 1 support for Windows Virtual Desktop, Microsoft’s new cloud-hosted service that delivers virtual desktops and apps.

Workspot is an RDP Protocol Partner

Our Remote Desktop Protocol (RDP) partner relationship allows us to stay completely aligned with new Microsoft technology and to deeply integrate Workspot solutions with Azure. This means we can build on the best of the best and continue to provide unprecedented value to our customers. That’s where the rubber meets the road: Customer value. Here are some of the ways we leverage this technology in Workspot Desktop Cloud, Workstation Cloud, and Disaster Recovery Cloud today to deliver that value:

• Deep integration with Azure compute, networking and storage technologies on both Azure Commercial and Azure Government regions
• Support for fast, multi-region cloud PC and GPU workstation deployments
• Support for multiple identity options including Azure Active Directory, Azure Active Directory Domain Services, and on-premises Active Directory integration
• Support for multi-user Windows 10 and Windows Virtual Desktop when available from Microsoft in early 2019

Accelerating Cloud PC Momentum

Workspot is a proud Microsoft Cloud Service Provider (CSP); we achieved this important designation more than a year ago, and we have continued to deepen our engagement with Microsoft product, technology and field teams as we help companies make the move to Azure.

Recently, Workspot was recognized by Microsoft when they honored us with their 2018 US Partner Award for Partner Seller. What’s the significance of that? In bestowing the award, the Microsoft executive team noted Workspot for having “shown leadership in customer impact, solution innovation, deployment and exceptional use of advanced features in Microsoft technologies.”

All of this is available to you today to pursue your possibilities. Ready for a demo? We’d be happy to show you how it all works.

Don’t miss the Microsoft & Workspot webinar!

Watch it on-demand now!

 

 

When an organization considers moving their desktops to the cloud, data security becomes a primary concern. The prospect of relinquishing control of IT assets and possibly introducing risk to the business makes everyone pretty uncomfortable – to say the least. When it comes to virtual desktops in the cloud, the art is in balancing security and control on the one hand, with deployment speed, management simplicity, and cost containment on the other. At the end of the day, however, data security is paramount. When adopting cloud desktops, you essentially have two options, and there are trade-offs to consider:

Option A: DIY: Implement virtual desktops in the cloud on-your-own. You’ll have full control, but the deployment will take longer, be more difficult to maintain, and the related cloud compute costs can be wildly variable. Significantly, this option also comes with somewhat scary security trade-offs.

Option B: Turnkey Service: Workspot offers a turnkey service for deploying your virtual desktops and workstations in the cloud. We do it for you, so in that sense, you don’t have as much control (although we work side-by-side throughout the deployment process) but your deployment is faster, easier to manage, and you’ll have predictable costs each month. Plus you have complete control to add desktops, remove desktops, and otherwise manage your entire implementation through a single management console. And though it’s counterintuitive, you will get stronger security than any other cloud desktop provider. And that’s where the secret sauce comes in, but more on that later!

Philosophical & Practical Differences Around Security

When comparing virtual desktop solutions, it’s important that you really drill down on the vendor’s approach to security. Workspot has a multi-pronged approach that no other vendor can approximate. The first aspect of security stems from our cloud-native architecture. Unlike other vendors, we developed our cloud virtual desktop solution from the ground-up. The Workspot Desktop Cloud architecture completely separates the configuration and provisioning control signals from the flow of data. Here’s what that looks like:

In a traditional VDI/DaaS solution, both data and control flow through the same paths – they are not separated as they are with Workspot. With these legacy solutions, the user has to connect to a broker to authenticate and the broker contacts a VM to provide the user with a virtual desktop. If the broker is managed by a 3rd party, that 3rd party can see all of the traffic flowing between the user and the virtual desktop. That is scary!

Workspot is different because of our architecture. When a user comes in from anywhere in the world from their laptop to connect to their virtual desktop, their data never traverses through the Workspot Cloud. Once the encrypted VMs are configured, users authenticate (via AD or MFA) and connect from any location (on-site or remote) to get a direct connection to their virtual desktops and resources; in other words, the client connects directly to the virtual Windows 10 desktop running in Azure, never through Workspot Control.

The second aspect of security is that we believe in the Principle of Least Privilege (PoLP). PoLP ensures the absolute minimum amount of access necessary to do the job. In this context, it’s about “access control”. Since there is no such thing as “fully secure”, what we can do is limit the plane of attack. See that tiny little white box on the left in the diagram below?  That’s the plane of attack with Workspot. By following the PoLP and requiring the minimum access privileges to our customer’s corporate resources, Workspot has minimized the surface of attack to that tiny little white box while also providing the customer with full access to their AD, networking, firewalls, OS, VMs/Disk, data, and GPOs – along with the ability to control their own environment. In practice, this means that when we deploy your desktops in Microsoft Azure, we do it while having the absolute minimum admin access. This access is limited to configuring, deploying and managing the Windows 10 desktop VMs. Because we handle this for you, you get fast deployment (a few days, usually) and reliability (we’re always monitoring & we boast 99.95% uptime). All this WITHOUT having any ability to even peek into your VMs.

Conversely, see that big white box on the right side of the diagram? That’s all the other VDI/DaaS vendors; they can access your entire environment – the OS, disk, files, AD, data traffic. That’s a pretty big attack surface.

 

Workspot has no access to the customer’s corporate resources (left), whereas other VDi/DaaS providers have full visibility into these sensitive corporate resources.

When you talk to those other cloud VDI vendors, ask these important questions :

– How much access to my environment will you have?
– Where is my data?

The third aspect of security is top-secret! It’s our Secret Sauce. All you security experts reading this don’t expect us to reveal that in a blog do you? For that, we’ll need to talk!

Workspot Benefits

• Deploy in days, in any Azure region in the world!
• Robust enterprise security
• Better-than PC performance
• Flat rate subscription pricing
• 99.95% Desktop Cloud uptime and availability

With Workspot Desktop Cloud on Azure, your IT team retains full control of all corporate assets and has the ability to define granular user access controls according to the use case.

Now, how about some secret sauce? Schedule a live demo and we’ll show you how it works!

Workspot’s raison-d’être is to improve the lives of everyone involved in the “virtual desktops” food chain, whether it’s the CIO, the CISO, the hands-on IT staff, IT leadership or the end-users using virtual desktops, apps, and workstations. Among the many innovations, Workspot has introduced to the VDI and Desktop as a Service (DaaS) industry over the last few years is our cloud-based monitoring capabilities.

Top 3 Support Calls

The following are the top 3 issues that generate most help desk calls, based on our interactions with thousands of VDI customers over the last decade:

• User is not able to connect to the virtual desktop

• Desktop login takes a long time

• User complains that the performance is not good for desktop applications

Too Many Moving Parts in Legacy VDI

So what happens when the help desk phone rings and a user reports one of these issues? A legacy VDI solution has tens of components to the solution: servers, storage, networking, databases, hypervisor, provisioning servers, brokers, portals, load balancers, VPNs, end points, and thin clients. Our experience has been that no tool provides a good, holistic view of the end user problem. So every support call becomes a multi-faceted hunt for the truth; networking, storage, hypervisor, desktop, broker and server teams all need to collaboratively debug problems. And often the problems are in the white spaces between these teams where there is even less useful forensic data to be found.

Troubleshooting Skills Can Be Learned

As customers move to cloud solutions, all the infrastructure becomes invisible. There are no hypervisors, SANs, hyper-converged nodes, switches or firewalls. The elegance of cloud software is automation and moving up the stack! In the cloud, the infrastructure is completely abstracted away from the customers, and not only are there fewer operational issues and therefore fewer support calls, but now, (with the right tools), help desk personnel can handle the calls they do get themselves. There’s no more need for valuable and expensive IT personnel to spend their time troubleshooting support calls.

How is it different? There are fewer moving parts in a DaaS solution. DaaS vendor is responsible for the infrastructure and management components. The Workspot solution holistically captures all the data required to fix incoming support calls. Our monitoring features are both comprehensive and less noisy, which means it’s a huge improvement over other solutions. Let’s look at some of the Workspot features that address the problems highlighted above and make troubleshooting a problem much easier than ever before.

 

Comprehensive Events Feed

One of the reasons customers are surprised by our monitoring dashboard is that for years they’ve been dealing with an incomplete view of the end user’s interaction with the VDI product. Workspot Client runs on the user’s device; it’s heavily instrumented and captures all relevant interactions when the user launches it on her device.

For example, let’s consider the following common issue: The user calls and reports that she is not able to connect to her virtual desktop. Here are the steps the help desk staff can use to troubleshoot the issue:

1. Find the user profile: Use the search box to find the user

2. Check if the user has an active desktop or app entitlement

3. Check if the user has an active session

 

4. Look up event information to see if the user unlocked the client application and tried to connect to the application.

Notice that in this example, we simulated a problem with the gateway. The error shown below shows code: 50331670. We provide our customers with a rich list of error codes and support collateral to deal with the most common software and infrastructure issues. The error code suggests that “It’s an issue related to RD Gateway”. The actual error message shown to the end user is also captured in the event feed.

 

The steps above a) confirm that the end user has a valid problem and b) quickly helps the support person to get to the root cause.

The actual reason why the user is not able to connect could vary based on the client device, network connectivity, network topology of the DaaS deployment, DMZ setup with the RD Gateway, or anything related to authentication. The event feed captures the relevant information like “the user activated the client”, “the user opened or clicked on an application icon”, “the user got an error”, etc.

The causality of events is integral to the troubleshooting process.

The richness and quality of events for all the users across thousands of tenants running on the same cloud service is only possible because of Workspot’s unique cloud architecture.  

It takes just 1-click in Workspot to get to the user profile, with all the details required for troubleshooting presented in a single view. 

Performance Monitoring

When the user calls and complains about performance, the most important factor is to check the network conditions. If the user is connecting from a bad network with high latency and low bandwidth, the sluggish performance issues are well understood. In the user dashboard, Workspot displays the most important performance metrics, and high latency or jitter is typically the #1 culprit for lag seen by the user. High load on the desktop or RD Host can also cause common application performance issues.

User session view displays latency, bandwidth, memory & CPU usage

A detailed view of the user, shown below, includes logon speed, session duration, current session state duration, session state, client device, and more are also captured and presented on the same page. The drill-down of logon duration along with the snapshot of granular performance data captures all the relevant information IT needs on a single page.

 Vroom! Remote Assist or End the User Session

The ability to start a remote assistance session (one-click Microsoft Remote Assist) or reboot the user desktop is also a time tested trick in the arsenal. Inline support and the ability to send messages directly to the user inside the virtual desktop further simplifies the round trips involved in closing the ticket.

As shown above, Workspot provides a user-focused monitoring and troubleshooting console without any confusing product SKUs. All customers get the same features with simple pricing. The data is also aggregated and presented across pools, user-groups, and geographies for summary reports.

What would be really cool is to be able to ask: “How does the average login time across all the users in ACME corp look compared to all the other customers managed by Workspot on Azure?” With anonymized and opt-in global comparisons, customers can leverage the power of cloud-based data insights. Imagine the key performance questions that you’d like to ask other DaaS customers and have them answered in the Workspot dashboard right away. We are excited to announce that we will be shipping global comparison features in Q2, 2018!

There’s no doubt that the future of VDI is cloud-delivered. Fewer moving parts and a cloud-native architecture will deliver better reliability, security, and scalability, and our holistic monitoring solution enables you to quickly debug any issues your end users may have.

It’s amazing how fast the VDI market is changing and exciting because with these changes customers will finally realize some really great cost reduction and business agility benefits that have thus far been elusive. As the industry transitions to cloud deployments, we believe it will be helpful for IT execs to have a framework for comparing virtual desktop solutions in the market, but that’s easier said than done. Where to start? On-prem VDI? Virtual apps? Desktop-as-a-Service (DaaS)?  And what constitutes a “real” desktop cloud service?

VDI and DaaS solutions can be evaluated through the lens of people in the “food chain” of virtual app and desktop evaluation, selection, deployment, use and management:

• Who is the primary sponsor? CIO or the Application Owner?
• Who are the end users? E-Staff, Power-Users, Knowledge Users, Remote Developers, Field Users, Contractors, Partners, Others?
• What does the solution do for the CFO and CISO? Does it increase or decrease security, agility and cost?
• Who are the people managing the solution? Generic IT Staff, VDI Specialists, Datacenter Specialists, Cloud Experts, Security Ninjas or Expensive Consultants?

Each has her/his special interests and goals when it comes to participating in the decision-making process, and from those special interests, we can derive a framework for evaluation.

But before I dive into that, let me ask a question: Does anyone know why the VDI vendors never agreed on a common benchmark for comparing the various protocols in the market?

Where’s the benchmark?

Let’s look at the database industry. The term transaction is commonly understood in the technology world. A typical transaction, as defined by the Transaction Processing Council (TPC), would include “an update to a database system for things like airline reservations (services), e-commerce (goods) or banking (money)”. TPC produces benchmarks that measure transaction processing and database performance in terms of how many transactions a given system and database can perform per unit of time, e.g., transactions per second or transactions per minute. How do you compare two full stack systems in the market to run your database? You look at the TPC score and the cost of the full system and make a judgment based on your needs. All the vendors in the industry use the same framework to present the results. It’s super helpful to buyers to be able to compare apples to apples.

As the database industry evolved, a single benchmark was not sufficient to capture the “quality” of the software for all possible use-cases. If you look at the TPC website, you will notice that there are several “flavors” of TPC benchmark; each measure different parameters:

• TPC-C (the benchmark is centered around the principal activities of an order-entry environment)
• TPC-DI (Data Integration, also known as ETL, is the analysis, combination, and transformation of data from a variety of sources and formats into a unified data model representation)
• TPC-DS (PC-DS is the de-facto industry standard benchmark for measuring the performance of decision support solutions including, but not limited to, Big Data systems)
• TPCx-V (The TPCx-V benchmark was developed to measure the performance of servers running database workloads in virtual machines)

and there are more!

The primary reason for not having a standard benchmark in the VDI industry is that there is no standard definition of a what a “transaction” could mean for a remote user experience.

What does it all mean?

Remote protocols transfer graphical frames or bitmaps from a machine running in the datacenter to a client device. There are various techniques of sending updates to the client side. For example, it could be commands or raw bitmaps. If the number of frames transferred is used as a metric, all vendors can compromise the quality of the frames. Unless a frame is captured on the client side and the quality of the frame is observed, it is impossible to quantify whether the fidelity of the frame has changed between the server and the client. An Excel sheet with heavy text and a web page full of pictures may require different encoding schemes. Does it really matter if the server is sending 30 frames/sec to the client but the client is showing lossy frames to the end user or dropping frames on the client side? The quality of the frame is one dimension for evaluating remote protocols.

The amount of bandwidth used is another vector. If hundreds of users are on a T1 line in a branch office, the density of users the line can accommodate is an important cost factor for the deployment. At the same time, if your deployment has all the users connecting from home or if your business depends on already-provisioned big bandwidth pipes, incremental 200-300Kbps traffic per user is not a problem. For instance, does it really matter if the client is using only 200Kbps for the remote protocol traffic but the client has 1Mbps bandwidth available and the rest of the bandwidth is not utilized? Should the extra bandwidth be used to improve the user experience?

The experience is also dependent on the latency between the client and the server. The user experience will degrade as the latency increases between the end user and the virtual desktop. VDI is generally not recommended by specialists when the round trip latency goes beyond 300ms. It may work but end users will never be happy.  With modern cloud options and easy multi-region deployments, putting desktops closer to the end users will always result in better performance by reducing the latency between the end users and the virtual desktops.

If you combine the above three vectors (quality of frames, bandwidth used, latency), you will notice that capturing a TPS-like score for a generic workload will be challenging. Every business use-case will place a different weight on each vector. A call center use-case can not be compared with a hospital kiosk workload. Contractors accessing virtual desktops for security reasons should not be benchmarked with a trader using a Bloomberg application workload. There is no one-size-fits-all.

Let us consider what’s happening in the industry. You will find a lot of home grown micro-benchmarks and misleading results on the web comparing various protocols. A typical example is a benchmark with a video streaming workload. The benchmark author will compare the total amount of bandwidth used by the various clients. Based on the results, the author will describe that protocol A is better than protocol B because it uses less bandwidth. The author uses his magical insights to describe the quality of the frames and how sluggish or smooth the experience was when he was running the videos simultaneously. The author adds a disclaimer that the best test is with your own workload and the results are not reviewed by any third party.

Such results do not capture anything meaningful for buyers! It just adds confusion because it fails to connect the benchmarking exercise with business goals. It only focuses on one small part of what can be done inside a remote desktop session.

The key point is that benchmarking requires a scientific model to capture the frames on the client side and a well defined methodology agreed upon by experienced professionals. For example, this study sponsored by Microsoft compares RDP10 and PCoIP protocols and uses REX Analyzer to visualize the test results. Such studies take months of effort and the analysis does not provide a single score. It provides commentary on what the author observed in various network conditions. The above study says:

RDP 10 uses more aggressive compression algorithms which causes slight degradation of color quality under LAN conditions. Under the different WAN conditions, RDP 10 shows better quality in terms of frame rate and stuttering. This means that RDP 10 is better suited for network constrained connections than PCoIP.

It’s impossible to provide a definitive transactions-per-second-like score for comparing remote protocols. Even though the above study shows that RDP 10 is better suited than PCoIP for the common network constrained VDI use-cases, it is only capturing the experience of the end user in the overall system. The buyer will always need to consider the operational aspects of the solution before picking up a virtual desktop solution vendor. For instance:

• Who are the people in the solution food chain? Remote protocol performance is an important metric for the end users. What about the IT staff responsible for setting up, managing and monitoring the solution? What about the CIO? What about the CISO?
• What does the business demand to stay competitive? Agility to move to new countries, address new use-cases such as disaster recovery, the ability to acquire new companies and roll out VDI quickly?
• Cost of the solution? There is a market for Audi. There is also a market for Honda.
• Support and overall vendor engagement? It is unreasonable to assume that the solution will not break after the initial deployment. Plan for the worst-case scenario.

A scoring framework

With all that considered, here is a suggestion for a a simple framework to evaluate the overall “fitness” of the various cloud desktop products in the market. You’ll want to establish the following scores to compare the products:

• CIO Score:
  • Overall security
  • Cost
  • CapEx/OpEx
  • Service reliability
  • Solution agility
  • Thought-leadership/innovation provided by the vendor

• End User Score:
  • Performance for typical business applications when inside the desktop
  • Login speed
  • Flexibility: support for different client OS’s and form-factors
  • Performance in good network conditions
  • Performance in average network conditions
  • Performance in poor network conditions
  • Performance for 3D apps (GPU use-cases)
  • Performance under load (when 100’s of users are active on the same server and storage infrastructure)

• IT Staff Score:
  • What skills are required to deploy the solution
  • Does the solution offer easy multi-site deployments
  • What skills are required to monitor, maintain and upgrade the solution components
  • How to troubleshoot issues reported by end users
  • How to troubleshoot security alarms or events
  • Scalability of the solution
  • Availability of the solution. Historical uptime of the service.
  • Does the solution provide elasticity? How easy is it to add more users? Add more infrastructure capacity? Add more cloud locations?
  • Does the solution provide single pane of glass management? Is the solution a suite of badly assembled products or is it a coherent software-as-a-service offering?

A “sum of parts” evaluation methodology is always more comprehensive and meaningful than a single, magical score that is often misleading or irrelevant.

If you were looking at transportation options for your employees, you would want to understand the difference between “horsepower” and “mileage”. Why is the cloud desktop market growing so rapidly? Because CIO’s want the best mileage!