Deploying VMware Horizon Instant-Clone Desktops with App Volumes
Fast, consistent desktops come from creating Horizon Instant-Clone replicas, while App Volumes separates applications and user data from the disposable compute layer. The result is a practical non-persistent VDI platform suited to standardised offices, hybrid work and large fleets.
The design pairs Horizon Connection Servers and vSphere with a highly available App Volumes service for application entitlements, user files and synchronisation. This guide covers prerequisites, image preparation, pool creation, validation and day-two operations for on-premises, VMware Cloud on AWS and Azure VMware Solution deployments.
Architecture and prerequisites
Horizon needs AD, DNS, reliable time, vCenter, ESXi, a supported database and Connection Servers. App Volumes adds manager appliances behind a load balancer, application and file storage, and its supported data services. Install a Cloud Connector where the selected cloud architecture requires federation with on-premises resources. Allow the required HTTPS and directory traffic, and distribute a trusted TLS certificate to every agent and client.
Plan around Australian geography. Sydney and Melbourne are common primary and recovery locations, while Perth offices need deliberate WAN testing and Horizon Client bandwidth policies. States observe daylight saving differently, so authenticated hosts and appliances must use disciplined NTP rather than manually adjusted clocks. Cross-check the design against IT Diversified resources before locking the topology.
Build and seal the golden image
Start with a supported Windows release, apply current security updates and VMware Tools, then install the App Volumes agent. Import the App Volumes service certificate, confirm outbound connectivity and verify that the agent can register. Install required line-of-business software and configure Group Policy, printers, redirections and endpoint security, but leave user profiles and mutable application data out of the image.
Test the image through Horizon Client using Blast and, where still required, PCoIP. Run sysprep, shut down the VM and capture the approved snapshot as the golden image. Keep application packages and updates in App Volumes storage where practical. A sealed image should contain only baseline software, making every subsequent clone predictable and disposable.
Configure App Volumes
Create service accounts and import or synchronise the relevant AD groups. Build application packages, associate each application with an entitlement, and separately configure user-data entitlements, home directories, disk modes and file synchronisation. Grant access to pilot groups before production users, and test that each intended application appears after sign-in rather than giving broad access to everyone.
In the Instant-Clone pool settings, enable App Volumes assignment and select the entitlement method supported by the deployed Horizon release. Keep department-specific applications in dedicated AD groups so onboarding and offboarding remain controlled. An application entitlement controls launch access; it does not automatically grant access to separately defined user data or home-folder mappings.
Provision the Instant-Clone pool
In Horizon Console, create an Instant-Clone desktop pool, select the golden image, assign vCenter placement and networking, and define the initial clone count. Set App Volumes assignment for the pool, publish it to a pilot access group and start provisioning. Avoid static DHCP reservations tied to individual clones; reserve addresses for persistent appliances instead.
| Capability | Instant-Clone only | Instant-Clone with App Volumes |
|---|---|---|
| Desktop base | Replicas of a sealed golden image | Same immutable base |
| Application access | Apps installed in the image or delivered separately | Launch access controlled by AD-backed entitlements |
| User data | Separate redirection or persistence tooling | Managed user data and file synchronisation |
| Main dependency | Horizon and vSphere | Horizon, vSphere and the App Volumes service |
Review provisioning events for each replica and verify network placement, DNS and time settings before enrolling users. A clone can power on successfully while application assignment fails if the agent cannot reach its service, so check both Horizon events and App Volumes logs. Scale the pool gradually while watching service capacity, storage growth and sign-in queues.
Validate user experience
Run the pilot with staff working between a CBD office and home, using both managed thin clients and BYOD where these are supported. Test Blast or PCoIP performance, MFA, screen resizing, clipboard access, printing, USB policy and redirected drives. Capture latency and packet loss during peak business hours, especially for Perth connections; fast cloning does not guarantee a fast user experience.
Confirm that every application entitlement appears, launches and updates correctly. Write test files while disconnected, reconnect and verify synchronisation, then deliberately exercise a synchronisation conflict in a non-production profile. Review Horizon events, App Volumes agent logs, storage health, certificate validity and clock synchronisation. Do not dismiss time-related failures until NTP, time zones and daylight-saving changes have been ruled out.
Operate, refresh and scale
Treat the golden image and App Volumes packages as separate release streams. Pilot agent, package and operating-system changes with a small pool, then roll them out in waves. Image refreshes replace disposable clones while App Volumes-managed user data remains under entitlement. Keep a documented rollback point and verify that the Horizon, vCenter and App Volumes versions form a supported combination.
Scale clones and App Volumes nodes independently, with load-balanced service endpoints and tested database and storage capacity. For a Sydney-to-Melbourne recovery design, replicate only the data that policy requires and rehearse failover, user authentication and application access against defined RPO and RTO targets. Monitor clone failures, synchronisation errors, storage pressure, certificate expiry and supportability status before they become user incidents.
Secure the Australian deployment
Apply least privilege to Horizon and App Volumes administrators, require MFA where the identity infrastructure supports it, and encrypt service traffic and storage. Export audit events to the organisation’s SIEM, review entitlement changes and remove departed users from AD groups promptly. Back up App Volumes configuration and package sources, and ensure temporary desktops and synchronised files follow defined retention and destruction rules.
For covered organisations, the Privacy Act 1988 and Australian Privacy Principles govern personal information stored in App Volumes. Victorian requirements such as the Privacy Act 2014, NSW’s Privacy and Personal Information Protection Act 1998 and sector rules for health information may add further obligations. Australian cloud choices include AWS regions in Sydney and Melbourne and Microsoft’s Australia East region, subject to current service availability. Verify data residency, subprocessors, support terms and the exact Horizon and App Volumes features offered before selecting a region. The ACSC Essential Eight provides a useful control baseline for the resulting identity, logging and data-governance controls.