Abstract: A smart card stub and a smart card proxy can be employed to enable a redirected smart card reader to be accessed within a remote session. To isolate a redirected smart card to a remote session, the smart card stub can be configured to process a response to an application's request to enumerate smart card readers. This processing can include obtaining a session identifier for each enumerated smart card reader and removing any smart card reader from the response if the session identifier of the smart card reader does not match the session identifier of the requesting application. The smart card stub can communicate with a filter driver to obtain the session identifiers employed in this process.

Abstract: Examples of methods, systems, apparatus, and machine-readable storage media are provided to facilitate access and control of a remote desktop of a remote machine by a web browser at a client device through a transcoding server without installing proprietary plug-ins or protocols on the client device. A transcoding server may translate user input requests from a web browser into input calls compatible with a remote desktop display protocol. The transcoding server may receive remote desktop drawing commands from the remote machine and translate the remote desktop drawing commands into web browser drawing updates compatible with the web browser. A transcoding server may communicate with a web browser via HTTP and communicate with a remote machine via a remote desktop display protocol. A web browser may be an HTML5 browser. A transcoding server may send drawing coordinates to the web browser via an HTTP header and may use long polling.

Abstract: Analytics driven update notifications can be provided. An agent on a managed device can monitor which applications are being used on the managed device and can provide a report of these application usage details along with other details of components on the managed device to a management server. The management server can evaluate reports received from a number of agents to generate rankings of applications and components that are based at least partially on usage. The management server can then identify available updates and present recommendations for deploying the updates based on the rankings.

Abstract: WPD devices can be managed at the device capability level. When a WPD device is connected to a computer, a filter driver can be employed to examine communications with the WPD device. During initialization, the WPD device will provide a list of its capabilities. The filter driver can intercept this list and compare it against any applicable policies to determine whether any capabilities should be blocked. When it is determined that a capability should be blocked, the filter driver can remove the capability from the list while retaining any non-blocked capabilities. The filter driver can also cause device initialization to fail in some scenarios. In this way, an administrator can block specific capabilities of a WPD device rather than blocking the entire device.

Abstract: Peer assisted updates can be provided in a device management environment. When it is desired to deploy an update to a group of managed devices, an update command can be sent to a first set of managed devices in the group instructing these managed devices to download the update. Once these managed devices have downloaded and installed the update, they will notify the management server. In response, the management server can instruct these managed devices to remain awake so that they may each function as a master device or repository for deploying the update to other managed devices in the group. The management server can then send update commands to the other managed devices instructing them to download the update from one of the managed devices that is now acting as a master device. This process can be repeated until all managed devices in the group have been updated.

Abstract: A security solution can be implemented using a layering system. By using a layering system, any changes that are made to a computing system can be isolated within a separate write layer. Due to this isolation, the changes, which may even be malicious, can be evaluated without fear that the resources in other layers will be negatively affected. In this way, even security threats that are still unknown to antivirus solutions (so-called zero-day attacks) can be prevented from harming the system.

Abstract: Live imaging of a device can be performed. A client device can include at least two drives that are alternately employed to store the active OS partition. An imaging solution that executes on the active OS partition on a first drive can perform a live imaging process in which a second drive is fully imaged while the user continues to use the client device. Then, once the imaging of the second drive has been completed, the client device can be rebooted to cause the client device to boot from the second drive. In this way, the only downtime that a user may experience due to the imaging process is during the reboot. In a similar manner, when a client device includes only a single available drive, the drive can be divided into two or more sets of one or more partitions that are alternately employed as the active OS partition(s).

Abstract: Session reliability for a redirected mass storage device can be improved by delaying a device removal process when a redirected mass storage device is disconnected. Whenever a session employed to redirect a mass storage device is disconnected, the agent on the server can send a device removal notification to a virtual disk enumerator. Rather than immediately initiating the device removal process, the virtual disk enumerator can pause I/O requests pertaining to the mass storage device and wait a specified amount of time to allow the mass storage device to be reconnected. If the mass storage device is reconnected during the specified amount of time, the paused I/O requests can be resumed. Otherwise, the device removal process can be commenced after the specified amount of time has elapsed.

Abstract: Examples of methods, systems, apparatus, and machine-readable storage media are provided to facilitate access and control of a remote desktop of a remote machine by a web browser at a client device through a transcoding server without installing proprietary plug-ins or protocols on the client device. A transcoding server may translate user input requests from a web browser into input calls compatible with a remote desktop display protocol. The transcoding server may receive remote desktop drawing commands from the remote machine and translate the remote desktop drawing commands into web browser drawing updates compatible with the web browser. A transcoding server may communicate with is web browser via HTTP and communicate with a remote machine via a remote desktop display protocol. A web browser may be an HTML5 browser. A transcoding server may send drawing coordinates to the web browser via an HTTP header and may use long polling.

Abstract: A secure access client can be employed to enforce limitations on a user's access to a file while also allowing the user to access the file using an application of choice. To provide this functionality, the secure access client can implement an RDP client that is configured to create an RDP session with an RDP service executing on the same computing device. The RDP service can allow the secure access client to display the user interface of an application employed to open a file. The secure access client can be configured to selectively apply access limitations on a per file basis. This selective enforcement can be accomplished by only implementing a virtual channel extension to provide a particular type of access to the file when the file's access limitations would allow such access.

Abstract: When a USB device that supports multiple streams is redirected, a multi-channel environment can be established in which each USB stream is associated with a separate network connection. As a result, each USB stream will be transferred over the network in its own connection and therefore the data transfer can be carried out in an out-of-order fashion and with speeds that better approximate those provided by the USB SuperSpeed feature. To handle the routing of URBs to the appropriate network connection, the virtual desktop infrastructure can implement a lookup table to associate a stream's handle with a particular network connection.

Abstract: Session reliability can be improved when a USB device is redirected over a remote session. If a remote session is disconnected while a USB device is redirected over the remote session, a server-side agent and a client-side proxy will both receive a session disconnection notification. In response to this session disconnection notification, the agent and the proxy can each queue any I/O requests pertaining to a USB device that was being redirected over the now-disconnected remote session and commence waiting for a specified period of time. If the disconnected remote session is restored within the specified period of time, the agent and the proxy can send the queued I/O requests over the remote session. Otherwise, the agent and proxy can cause the queued I/O requests to be completed with the proper error status or discarded and can take appropriate steps to remove the device from the server and connect the device to the client.

Abstract: Examples of methods, systems, apparatus, and machine-readable storage media are provided to facilitate access and control of a remote desktop of a remote machine by a web browser at a client device through a transcoding server without installing proprietary plug-ins or protocols on the client device. A transcoding server may translate user input requests from a web browser into input calls compatible with a remote desktop display protocol. The transcoding server may receive remote desktop drawing commands from the remote machine and translate the remote desktop drawing commands into web browser drawing updates compatible with the web browser. A transcoding server may communicate with a web browser via HTTP and communicate with a remote machine via a remote desktop display protocol. A web browser may be an HTML5 browser. A transcoding server may send drawing coordinates to the web browser via an HTTP header and may use long polling.

Abstract: A non-USB device can be virtualized as a USB device. When a non-USB device is connected to a client terminal, a filter driver can be employed to cause the non-USB device to be treated as a USB device to thereby allow the device to be redirected using USB device redirection techniques. When an I/O request is sent to the redirected device, the request will be in USB format since the server-side components will view the redirected device as a USB device. Then, the I/O request can be converted from the USB format into a format suitable for the non-USB device. Any response generated by the non-USB device can be converted to USB format in a similar manner. As a result, non-USB devices can be redirected without altering any of the existing server-side VDI components.

Abstract: Manual discovery of devices in a device management environment can be performed from a management server. The manual discovery process can enable the discovery process to be initiated at the management server and can be performed without requiring an administrator or other user to manually configure each device to initiate and perform the discovery process. To discover devices to be managed, the management server, which can be a cloud based server or Software as a Service based server, can send a registration request to an on-premise server. The on-premise server can then relay this registration request to all devices on the same network infrastructure. The agent on each device can be configured to listen for such registration requests, and in response to receiving a registration request, can automatically register with the management server using information contained in the registration request. In this way, the management server can manually discover devices.

Abstract: A method for managing a session between a local computing device and a remote computing device, in which a session is established between a local computing device and a remote computing device, a lock session signal is transmitted from the remote computing device to the local computing device, a lock session signal is received at the local computing device, and the session is locked, at the local computing device. Furthermore, the user is prompted for identification information at the remote computing device, and the identification information is transmitted from the remote computing device to the local computing device. Moreover, the identification information is received at the local computing device, the identification information is authenticated at the local computing device, and the session is unlocked, at the local computing device.

Abstract: A Native Client-based remote display client can efficiently perform multimedia redirection by routing un-rendered multimedia content to browser code executing outside the sandbox in which the remote display client is executed. In this way, a remote display client implemented as a Native Client module will not be limited to using the APIs available within the sandbox to render the multimedia content. The Native Client module can communicate with the browser code to provide parameters necessary for the browser code to submit a web-based request to the Native Client module via localhost to thereby obtain the multimedia content via one or more web-based communications.

Abstract: The subject disclosure relates to a method for initiating an accelerated desktop session between a client device and a remote server. In some aspects, the method includes steps for receiving, via a network gateway, a remote desktop connection request, initiating a first connection with a client device via the network gateway using a first communication protocol and sending a token to the client device via the network gateway. In certain aspects, the method further comprises initiating a second connection with the client device, via a proxy, wherein the second connection is established using a second communication protocol. A client device and computer-readable medium are also provided.

Abstract: The processing of a first data stream to generate a second stream conforming to a remote desktop protocol (RDP) is described. Operations may include facilitating storage of first data from the first stream at a first index indicated is the first stream, facilitating retrieval of second data from a second index included in the first stream, and facilitating generation of the second stream conforming to the RDP and including the first and second data. Additionally, the processing of a third data stream conforming to the RDP to stream a fourth stream is described. Operations include facilitating processing of the third stream to identify a package data unit (PDU), facilitating storing of a hash value corresponding to the PDU, and facilitating generating an altered PDU for inclusion in the fourth stream and including an index identifying a location in memory storing the hash value.

Abstract: A remoting client can be configured to offload various graphics-based remoting protocol processes to the GPU to thereby free up the CPU for performing other remoting tasks. In this way, a remoting client can be executed on a client terminal that has a less powerful CPU even when a graphics-rich desktop is virtualized on the client terminal. When the remoting client receives remoting communications containing graphics display data, the remoting client can write the graphics display data to a location in memory that is accessible to the GPU and can then pass the graphics display data to the GPU for further processing. The CPU is therefore freed from having to fully process the graphics display data including from having to copy the graphics display data to a display buffer.