Rolling out Horizon with Instant Clones and App Volumes

Australian organisations have accelerated desktop virtualisation, with hybrid work now permanent across Sydney, Melbourne, Brisbane and beyond. Rolling out a digital workspace demands a tightly engineered combination of VMware Horizon, Instant Clones and App Volumes. Getting the architecture right from day one saves hundreds of hours later.

Instant Clones changed how VDI fleets are built. Where linked clones required manual image recomposition, Instant Clones fork a running parent VM in seconds using VMware's vFork technology, delivering ready-to-use desktops with negligible storage overhead. Pair that with App Volumes, which separates applications from the base image using AppStacks and Writable Volumes, and you have a genuinely modular delivery model.

This walkthrough pulls together the pieces a sysadmin actually configures: laying the groundwork on vSphere, building Connection and Composer services, publishing pools, attaching AppStacks, and tuning the result for Australian bandwidth realities. It assumes working familiarity with vCenter but not prior Horizon experience.

Before diving in, decide where the workload lives. Some push everything to a local VMware Cloud on AWS region in Sydney, others keep infrastructure on-prem in a colocation facility such as NextDC or Equinix. The choice influences latency and licensing.

Minimum infrastructure prerequisites

A Horizon deployment is only as stable as the vSphere underneath it. Most Australian customers run Horizon on vSAN stretched clusters or all-flash arrays, and storage design directly affects Instant Clone boot storms. Aim for at least 5,000 IOPS per desktop at peak.

Networking deserves equal attention. Blast Extreme is more forgiving than PCoIP over lossy links. If your organisation spans sites such as the Sydney CBD and a regional Perth office, deploy Cloud Pod Architecture so users connect to the closest pod. AEST and AEDT shifts also mean maintenance windows must account for daylight saving boundaries.

Before installing Horizon services, confirm the following:

• vSphere 7.0 U3 or later with Enterprise Plus licensing for distributed switches and vSAN
• SQL Server 2016 or higher for Composer, sized at 4 vCPUs and 16GB RAM minimum
• Active Directory with delegated control over the Instant Clone OU and a service account with Reset Password rights
• A certificate authority issuing certs trusted by Workspace ONE Access and the Unified Access Gateway

Building Connection and Composer services

The Connection Server is the gateway every Horizon client talks to. In a single-region deployment, install one standard Connection Server and two replicas behind a load balancer. Cloud Pod Architecture lets you federate up to 50,000 desktops across pods, useful for ASX-listed enterprises needing geographic separation.

View Composer is the engine behind Instant Clones, co-locating with SQL Server. After installing Composer, register it through the Horizon Console and validate SQL connectivity. Australian sysadmins often hit SSL handshake errors when migrating from older View environments where SHA1 certificates are still floating around; replace those early.

For the Connection Server tier, watch these ports:

• TCP 4172 and 8443 for PCoIP and Blast External Access through UAG
• TCP 22389 for the Blast Secure Gateway when using HTML Access
• TCP 9427 for the Connection Server Management Console from the LAN
• TCP 32111 for the JMS channel between Connection Server replicas

Provisioning Instant Clone desktop pools

Instant Clone pools can be floating or dedicated. For most Australian organisations supporting knowledge workers, a floating pool tied to a single golden image is the simplest starting point. Build the parent VM with VMware OSOT, then shut it down cleanly. The Instant Clone process forks that parent into ready-to-use child VMs in five to ten seconds per desktop.

Use a descriptive naming scheme such as HZN-IC-{pool}-{seq} to keep Active Directory tidy. Set the refresh interval based on how aggressively you patch; many local IT teams align their Instant Clone refresh with Patch Tuesday cycles.

Tying Horizon entitlements to a compliant device posture is becoming standard practice among Australian banks and government agencies responding to the Essential Eight maturity model promoted by the Australian Cyber Security Centre.

Adding App Volumes for application delivery

App Volumes decouples application lifecycle from the base image, the single biggest time saver for any desktop team. An AppStack is a virtualised package captured once with AppCapture and delivered at logon. Writable Volumes give each user a persistent disk attached to their Instant Clone, allowing personal data and settings to survive pool refreshes.

Avoid bundling everything into a single monolithic stack; group apps by business function such as Marketing, Finance, and Engineering. This lets you target assignment at AD groups without forcing every user to inherit unused software. Cold-start behaviour depends on SAN or vSAN performance.

For Australian licensing considerations, some vendors (notably Microsoft Office and certain Adobe packages) need to know which user is consuming the entitlement. App Volumes handles this through Dynamic Environment Manager, which can drive login scripts and environment variables based on group membership.

Securing the deployment

Once desktops are live, security becomes the priority. The Unified Access Gateway should sit behind a DDoS mitigation layer, and configuring Radware DefensePro DDoS protection keeps malicious traffic away from UAG nodes before it reaches the desktop fleet. Enforce multi-factor authentication through Workspace ONE Access inside the perimeter.

The Australian Signals Directorate's Essential Eight framework recommends application control, application patching, and multi-factor authentication as the baseline for any organisation exposing remote access services. Horizon's integration with Workspace ONE Access satisfies the MFA requirement, while Carbon Black Cloud covers application control for the Windows guest.

Logging and audit trails should be forwarded to a central SIEM. A common Australian pattern is to send Horizon events into Microsoft Sentinel or Splunk, where they correlate with identity events from on-prem domain controllers for a single timeline of authentication and desktop launch activity.

Monitoring, scaling and local tuning

VMware Aria Operations for Horizon gives out-of-the-box dashboards for connection failures, Blast latency, and login storms. Set up alerts for sustained CPU pressure on Connection Servers and for storage latency spikes. Investigate events where Blast latency exceeds 150 milliseconds for more than five minutes during business hours.

Capacity planning is the last habit worth building. Run boot storm simulations using Login VSI or LoadRunner, and keep a documented growth runway. Australian bandwidth pricing is favourable, but uplink contention still bites when half of Sydney logs in between 8:30 and 9:00 AM.

When expanding beyond a single region, Cloud Pod Architecture is the cleanest path. Federating pods between Sydney and Melbourne gives users local breakouts and survives regional outages. Combined with App Volumes, a new regional office can be productive on day one with the same applications and policies as head office.