If you manage VMware Horizon instant-clone pools or RDS farms, you’ve probably been in this situation: you need to move a pool to a different portgroup — maybe a VLAN change, a migration to a new segment, or just fixing a misconfiguration. The options are not great. You can either dig through Horizon Console’s pool edit wizard and hope you find the right field, or go via vCenter and touch the golden image directly. Neither is fast, neither is scriptable, and neither gives you a clear view of what all your pools are currently assigned to.
I built Horizon Network Editor to solve exactly that.
What it does
The tool gives you a single window showing every instant-clone desktop pool and RDS farm in your environment, with their current portgroup assignments visible at a glance. Click a row, pick new portgroup(s) from a dropdown, and apply. That’s it.
Key things it handles that the Console doesn’t make easy:
Multi-portgroup per NIC — Horizon supports assigning multiple portgroups to a single NIC for load-balancing. The tool exposes this properly.
“From Golden Image” — you can revert a NIC to inheriting its network from the base VM rather than having an explicit assignment.
Force redeploy — optionally delete all machines/servers immediately after the change so they come back on the new portgroup, rather than waiting for the next lifecycle event.
Stale snapshot handling — if the golden image snapshot has been deleted from vCenter, the tool falls back to the v2 NIC API which only needs the base VM, so you’re not blocked.
Under the hood
The tool is built in Python 3.11 with PySide6 and talks directly to the Horizon REST API. Network labels are fetched via GET /rest/external/v1/network-labels scoped to the pool’s host/cluster, NIC definitions via GET /rest/external/v1/network-interface-cards, and changes are applied with PUT /rest/inventory/v8/desktop-pools/{id} (v7 for farms). Credentials are stored in the OS keyring — nothing written to disk in plaintext.
It’s packaged as a self-contained binary via PyInstaller, so there’s no Python installation required on the machine running it.
Getting it
Pre-built binaries for macOS, Windows, and Linux are on the GitHub Releases page. Download, unzip, run.
If you want to build from source yourself:
git clone https://github.com/Magneet/horizon_network_editor.git
cd horizon_network_editor
bash build_mac.sh # or build_win.bat / build_linux.sh
Requires Python 3.11+ and Horizon 2312 or later.
First run
Go to the Configuration tab, enter your connection server, username, and domain, set your password (stored in keyring), and click Test & Save. The tool will discover all pods and connection servers. After that, hit Connect on either the VDI Pools or RDS Farms tab and your environment loads in.
A while back I published the first version of the Horizon Golden Image Deployment Tool (HGIDT), a small desktop app to push golden images to VMware Horizon instant-clone pools without having to click through the Horizon Admin console. Since then the tool has grown quite a bit, so it’s time for a proper write-up of everything that’s changed.
You can grab the latest release as a ready-to-run package from the Releases page on GitHub — no Python installation needed.
What the tool does
HGIDT is a desktop application that talks directly to the Horizon REST API. You point it at a Connection Server, give it credentials, and it lets you:
Push a new base VM and snapshot to instant-clone VDI desktop pools and RDS farms
Enable or disable provisioning per pool or farm
Schedule a push for a specific date and time
Resize the compute profile (CPU, cores per socket, RAM) as part of a push
Manage the secondary image workflow — stage, promote, or cancel All of this from a single window, without touching the Horizon Admin console.
What’s new
new gui
filtering in golden images list
improved performance
improved golden image/snapshot selection from api
added option to not pull golden images/ snapshots all the time
Platform support: Windows, macOS, and Linux
The tool originally only had a Windows build. This release adds native macOS and Linux builds.
macOS ships as a .dmg containing a .app bundle. Because the app isn’t signed with an Apple Developer certificate, macOS Gatekeeper will warn you on first launch — right-click the app, choose Open, and confirm the prompt.
Linux ships as a ZIP with a standalone folder. The only runtime requirement is a display server (X11 or Wayland) and the Qt XCB platform dependencies, which are typically already present on any desktop Linux system. Password saving requires a running keyring daemon (GNOME Keyring or KWallet); without one the app still works, you just re-enter your password each session.
Windows continues to ship as a ZIP with a standalone folder containing the .exe.
All three are available on the Releases page.
Requirements
VMware Horizon 2312 or later
The Horizon REST API must be reachable from the machine running the tool
An account with sufficient Horizon admin privileges to update desktop pools and farms
Running from source
If you prefer to run from source rather than the pre-built binary:
python3 -m venv .venv source .venv/bin/activate # macOS / Linux # .venv\Scripts\activate # Windows
Have you applied or are you thinking about applying for vExpert? Starting June 12th Martin Micheelsen and I will be running the vExpert Candidates Open Office Hours again. This is an online zoom call where we discuss what it takes to become a vExpert but also where we can go over your application together and see what can be improved.
When I became one in 2016 I had no idea what was needed and the vExpert Pro’s where not around yet. Several years ago the vExpert team setup this vExpert Pro program that is aimed at enabling candidates to be able to create the application they need to become a vExpert.
On December 18th 2025, January 8th 2026 and January 22nd 2026 we will be running the vExpert Candidates Open Office Hours calls at 8PM CET via zoom.
If you are interested in joining the vExpert Office Hours drop me an email at vexpertofficehours@gmail.com so I can send you a calendar invitation.
FAQ
How often will you run this?
Three times on the posted dates
How late is this in my time zone?
You can use this link to convert the time to your local time.
Are there any other options to talk to vExpert Pro’s?
YES! We just started a VMware Community DIscord which has a channel for applicants. For more information see the vExpert website https://vexpert.vmware.com/
Some people who read release notes will have noticed that the last few version of Horizon have a api limit these days for the rest api’s. With soap being depracated and the q3 release of this year probably being the last that will have soap api in it these maximums have become very relevant. As I was working on moving The ControlUp for VDI api implementation to rest api I asked Omnissa support for what the actual maximums are.
In the picture below you can find the default maximums per 60 seconds and keep in mind that every page counts as an api call so it’s important to keep page sizes as big as possible.
If you want to change the maximums this is the documentation that I received for it courtesy of the great support from Omnissa
Create an object of type pae-APIThrottlingRules under OU=Properties,OU=APIThrottlingRules with the cn name in the format eg for Inventory/v*/desktop-pools , cn can be InventoryDesktopPoolsList, for inventory/v*/desktop-pools/{id}, cn can be InventoryDesktopPoolsGet
In the object populate the following attributes:
pae-Enabled – by default the rule will be enabled. Set to 0 to disable the rule.
pae-APIEndpoint – endpoint on which API throttling needs to be applied, replace V1,V2 with v* and any path param with {id}. keep everything in lowercase.
Few examples – config/v*/gateways, config/v*/gateways/{id}, federation/v*/pods/{id}/endpoints/{id}
pae-HttpMethod – REST HTTP method for the API denoted by number as follows
0 – GET
1 – DELETE
2 – POST
3 – PUT
pae-ThrottlingRules – no of request allowed in time duration (in seconds).
MaxRequests=,TimePeriodSecs=
Add all the rules under OU=Properties,OU=APIThrottlingRules. Once done, Notify the server to take up the latest rules from LDAP.
Set pae-APIThrottlingRefresh to 1 under OU=Properties,OU=Global,CN=Common
Server will set pae-APIThrottlingRefresh to 0 once rules are updated in the server.
Have you ever dreamt about becoming a vExpert? When I became one in 2016 I had no idea what was needed and the vExpert Pro’s where not around yet. Several years ago the vExpert team setup this vExpert Pro program that is aimed at enabling hopefulls to be able to create the application they need to become a vExpert. You can find more information on the vExpert site here: https://vexpert.vmware.com/
Starting next week June 27th I will be running a weekly vExpert office hour zoom call where people can come with questions or if they want to discuss their application we can also review it. Even if you’re not there yet content wise we can also give you directions on what you could do for the next round of applications. These sessions will be held between 20.00h and 21.00h ECT +1 on Thursday evenings and I will try to get multiple vExpert Pro’s in there to help you out as much as possible.
If you are interested in joining the vExpert Office Hours drop me an email at vexpertofficehours@gmail.com so I can send you a calendar invitation.
or join us on the days via zoom using these details:
You can use this link to convert the time to your local time.
Are there any other options to talk to vExpert Pro’s?
YES! We just started a VMware Community DIscord which has a channel for applicants. For more information see the vExpert website https://vexpert.vmware.com/
Today at VMware Explore I have launched a new version of the Horizon Golden Image Deployment Tool aka hgidt. This new version is a complete rewrite of the old one as I moved the code base to Python. As base I used a converted framework of the old tool (using ChatGpt :D) in Tkinter and my existing python module for Horizon.
Why the rewrite?
I decided for a rewrite as I wante dto be able to publish the tool as an app and most anti malware tools will flag an exeutable that turns out to be a powershell script as malicious. Besides that I thought it would be easier to make the tool more flexible and more important faster. I also wanted to be able to use it from a mac. While the tool itself works flawless when started as a script I did run into issues compiling it into a Mac App so for now I don’t have that yet.
Changes
Switch from Powershell 7 to Python
replaced the selector for machines to deploy a secondary image to to a dropdown and number for amount or percentage of machines
published as an executable
Credentials storing made optional
Moved storing of credentials to the local credentials store
Connect button connects and gets info for both VDI & RDS
Where can I get it?
For now a zip file with the executable (and a ton of other files, it was either that or a slower starting app.) can be found on my Github which also has my (messy) source code.
Did anything change in how I use it?
Only some tiny bits like the option that I added to store the password or not and some slight changes on the VDI/RDS but I think these will be self explanatory.
Pics or it didn’t happen
The executable among the 1000’s of other files needed for Python
The configuration page, note the checkbox to store the password.With the popup to ask for the passwordAfter testing the credentials
The VDI & RDS Tabs after connecting. Take note of the already selected resizing options. These will be read from the current config so you get the same size when redeploying.
After selecting a new snapshot and enabling the secondary image to be pushed to selected machinesDeploy button was hitAnd after a refresh
Todo list & bugs
FIx the percentage of machines that sometimes fails
add more logging
find a method to package into an app for macos
Used Python Modules
These are the modules I am using in this application
In a previous post I described on how to configure the Horizon Event database using the REST API’s. In this post I will describe on how you can retreive those events using a script that I have created. To get the first few events is easy, just use the /external/v1/audit-events api cmdlet and you get the first batch of events in an unsorted fashion. The script that I have created will get the events since a certain date and if you want only gets the types with a certain severity.
The script is created for Powershell 7 and has been tested with 7.3.4
Parameters
I have written 4 parameters into this script, 2 are mandatory and 2 are optional
Credential
This optional parameter needs to be a credential object from get-credential. If this is not supplied you will be asked to provide credentials in domain\username and password.
ConnectionServerFQDN
This mandatory parameter needs to be a string object with the fqdn of the connection server to connetc to i.e. server.domain.dom
SinceDate
This mandatory parameter needs to be a datetime object for the earliest date to get events for. for example use (get-date).adddays(-100) to get events up to 100 days old.
AuditSeverityTypes
This optional parameter needs to be an array with SeverityTypes to get events for. Allowed types are : INFO,WARNING,ERROR,AUDIT_SUCCESS,AUDIT_FAIL,UNKNOWN.
Usage
First I get my credentials using get-credential, you cna also import them from an xml using import-clixml creds.xml for example
For a long time I have been wanting to have some kind of portable lab but I had a few requirements that where limiting me:
has kvm (for troubleshooting as things always break for me)
low power consumption
Does’t require a dedicated suitcase for transportation
Not so long ago I got a newer laptop from ControlUp to replace my (not that old) annoying heat and noise generating Dell Lattitude 5401. I never could get this thing even a bit quiet without hurting performance. While I found it annoying to work daily on I thought it might be a good match to turn this laptop in a portable lab.
The Host
One of the advantages was that the laptop did have an intel nic built in so I decided to see if I could get ESXi installed on it. After some tinkering I found out that the only thing required for this was to change the disk mode in the bios from raid to ahci. (Why dell? why? the thing has only one nvme…) and after that change ESXi installed without issues.
Now with the 16GB that my machine had I could run ESXi but it was far from enough for what I was going to need and neither was the storage at 512GB. I did have an intel nvme 1TB 660P nvme in one of my servers that I honestly wasn’t even using so that was swapped in quickly. I also had a Gigabite Brix box with 64GB that I had planned to run 24/7 but with the rising energy costs I never did that and it was mostly gathering dust as my regular homelab has more than enough cpu/memory. These where 2 Lexar Modules and after another quick swap you might have seen this picture on twitter.
So I had my host with build-in KVM & UPS, now I also needed connectivity. When using it at home it has it’s own dedicated vlan but on the go I needed some kind of router that can use the same vlan. I did not wat to go for a virtual router as I do not want to potentially connect an ESXi host to a for me unknown network. Again I had a few requirements:
USB powered (Requiring a single socket is already enough)
Small
2 ports (wan and lan side)
gbit
wifi (so my regular laptop can connect)
Bonus : usb tethering for my phone in case all other connection options fail
In the end I decided to order the GL.iNet GL-AR300M16. While there might have been cheaper options there aren’t that many that have multi rj45 ports and also have openwrt as that is a very flexible OS for routers like these. The only thing I have had to change oimn the router was the ip addresses that it uses + I had to disablke dhcp as I wanted the domain controller to do that. It switches very easily between wired and tethering so it’s checkeng all the boxes that I needed.
Storage
Yes I know I said this machine is a mobile lab but I did want to have an option to connect shared storage in case I want to do maintenance etc. I did not want to use the built-in nic for this so I went looking for a usb to rj45 adapter that supports 2,5gbps as I have a Qnap TS-464 with 2,5gbps connectivity. The first step was to check the usb nic fling for what adapters will work. Now this list doesn’t include the speed but a quick look at amazon showed me that the RealTek 8156 will work and the images (not the text!) in this amazon CY USB-C to 2,5GBPS adapter showed that it should work. So another quick amazon order later I was able to prove it worked and I had connectivity to my NAS.
The Setup
The host
On Host level I didn’t need to make too much changes besides network configuration. The only things done so far was to install the USB NIC Fling, configure NTP, add storage and last but not least enable TPS! For a LAB this small any gain in memory availability is essential so TPS is really needed.
vCenter
I went with the smalles vCenter option available and for now it’s running ok with 2cpu’s and 14GB of ram.
The domain
The first VM to be deployed was my domain controller as that’s needed for just about everything I do. I went for a domain called LoaL.lab wich is an abbreviation for Lab On A Laptop. As always I name my vm’s with the environment name in it so the first VM to be deployed was LoaLDC which was quickly transformed into a domain controller, dns and dhcp server.
VM’s
The goal for this portable lab was to have something that can showcase ControlUp Integrated with vSphere, Horizon, App Volumes & DEM so I ended up with these VM’s. As you can see the connection server more or less is the bitch of this setup and has multiple functions:
Name
Function
CPU
Memory
LoaLVC
vCenter (Tiny)
2
14
LoalDC
Domain Controller
2
6
LoaLCS
VMware Horizon Connection Server, SQL Server, File server
2
12
LoaLAPP
App Volumes Server
2
6
LoalCU
ControlUp Monitor
2
6
LoalRec
VMware Horizon Session Recorder (needed for demo)
2
4
LoalW10
Static management VM, also available via Horizon
2
8
Desktop Pools & RDS Farms
So besides the manual desktop pool for the mgmt VM I also have an Instant Clone Pool and and RDS Farm. For both I have an App Volume available with notepad ++ and one of the test users also has a writable volume. All iof this still works while I have made the desktops and rds machines as small as possible: 1 cpu and 1gb of ram! Don’t expect that you are able to do a lot but I can login and start notepad++ and that’s enough here. In the VDI pool there are 2 machines while there is a single RDS host deployed. Both Golden Images where optimized to dead with just about everything selected in the VMware OS Optimization Tool.
So with 64GB of ram this is clearly the bottleneck for this system but how is it looking after it has been running for a few hours? I am receiving a warning about memory consumption but the current usage is 58GB but I don’t see any swapping or ballooning so that’s nice. I also like the Shared Common metric
Power Consumption
While it might be less relevant for a mobile lab I am interested in the power consumption and this is the graph for the current period. This data is coming from a Blitzwolf smart plug connected to my Homey. So the peak at boot time comes close to 80W but seems to stabalize after that.
The ControlUp setup
As a ControlUp employee one of this lab’s usecases was to display what we can do with ControlUp. This is a brand new CU environment that is mainly using Real-Time DX but for fun I have also deployed the Edge DX Agent to a few servers.
Some of you might have seen previews on the socials but for the last few months I have been working hard on a GUI based tool to deploy golden images to VMware Horizon Instant Clone Desktop Pools and RDS Farms. This because who isn’t sick and tired of having to go into each and every Pod admin interface to o a million clicks to deploy a few new golden images?
The work started mid December and as usual the first 75% was done pretty quickly so mid January I had a first working version. While I expected a first version that would only support Desktop Pools to be available mid February (Vmug Virtual EUC day someone?) this build actually already had most of the parts in place to support both Desktop Pools and RDS Farms. After this first build my regular work for ControlUp started picking up again so I had less time to fix the numerous bugs that I encountered. Well bugs? Most where logic errors on my part but most of them have been ironed out by now. All in all the version that you can use today has cost me ~80hrs in building & testing and many many more hours thinking about solutions.
Is the tool perfect? Definitely not but it works and it’s more than what we’ve had before and I will be looking into impriving it even more.
The Tool
I guess you got bored with the talking and would like to see the tool now. The content of thos blog post might get it’s own page later for documentation purposes. The tool itself can be downloaded from this GitHub repository. Make sure to grab both the xaml and ps1 files, put them in a single folder and you should be good. The tool entirely runs on Powershell and is using the WPF Framework for the GUI.
Powershell 7.3 or later (for performance reasons I used some PS 7.3 options so the tool WILL break with an older version.)
Horizon 8 2206 or later (the reason for this is that otherwise the secondary images wouldn’t be available and that’s a feature I wanted in there for sure.)
Deplying a new golden Image
For normal usage you can just start the ps1 file.
This will bring you to this tab, before the first use though you need to go to the configuration page.
Fill in one of your cconnection servers, credentials and hit the test button. If you have a cloud pod setup the other pods will be automatically detected and make sure to check the Ignore Certificate Errors checkbox in case that’s needed!
If the test was successfull you are good to go to either the Desktop Pools or RDS Farms tabs. Both are almost completely the same so I will only show desktop pools
Hit the connect button and all Instant Clone Pools or Farms from all pods will be auto populated in the first pull down menu.
The second pulldown menu allows you to select a new source VM
And the third pull down the snapshot (I guess you guessed that already, I might need to add labels but they are so ugly in WPF)
To the right you have all kinds of options that you should recognize from the regular gui including add vTPM that was added in Horizon 2206. This checkbox isn’t in the RDS Farms as we currently simply don’t have the option to have Horizon add a vTPM there. If the options are valid ( like more cores that cores/socket and if those numbers will work (can’t do 3 cores and 2 cores per socket!) the Deploy Golden Image becomes available. Hit this to start the deployment, you can check the status by hitting the refresh button. (don’t tell anyone but the functions does exactly the same as a connect)
Handling Secondary Images
By default a secondary image will not be pushed to any machines. Just select the Push As Secondary Image checkbox and hit Deploy Golden Image button.
What you can also do is select one or more of the machines and deploy the Golden Images ot those machines
Once a Secondary Image has been deployed the three other buttons come available.
From top to bottom you can either cancel the secondary image completely, apply the golden image to more desktops (selecting ones that already has it won’t break anything and will just deploy it when possible) and promote the Secondary Image to the Primary golden image for the pool. The latter will cause a rebuild of ALL machines including the ones already running on the image. In the future I will also add a button to configure a machine to run the original image.
Settings and logs location
All settings are stored in an xml file in %appdata%\HGIDTool this includes the password configured in the Settings tab as a regular Encrypted PowerShell Credentials object. If you didn’t hit save on the settings tab this will be automatically done when closing the tool.
In case you want to borrow some of my code the log files contain every API call that I do to get date, push an image or handlke secondary images. This is the same output as you’d get when running in -verbose mode so that’s only needed when you’re troubleshooting the tool.
With the recent release of Horizon 8 build 2212 one of the new api calls available was that of getting and configuring the event data base. This time I will not use powershell but do everything from the Swagger page.
First of all I the used url is /config/v1/event-database and to get the current config (default in my case I use the GET:
To configure the event data base we actually need to use PUT and not post as there always is at least some configuration.
This is the model of the json that needs to be provided
As you this also contains a setting for the period that timingprofiler data is saved, this is a setting not available in the GUI!
I am running it using this configuration (no prefix and with many changed details) make sure to check the sql port as that’s incorrect by default, took me a few minutes to find.
the response should be a 204 as that indicates everything went well.
And a new get shows the new configuration
In case you want to clear the configuration there is a POST method against /config/v1/event-database/action/clear
a 204 is again fine and a get shows the empty config
