You can configure the Anyware agent, and optimize PCoIP protocol behavior for local network conditions, by adjusting Windows GPO variables.

The variables are in admx template files, which are imported automatically by the agent installer.

Modifying PCoIP GPO Variables

All of the PCoIP settings can be configured using this procedure. The configurable settings are described in the following section.

To modify a PCoIP session variable:

1. Open the Local Group Policy Editor on the agent machine:

   1. Press
      
      + r to open the run dialog
   2. type gpedit.msc and press Enter.

2. In the left pane, navigate to Administrative Templates and then to PCoIP Session Variables.

   The variables you can configure appear in the right pane.

3. Double-click the GPO you want to configure to open the variable's configuration window, then:

   1. Select Enabled to enable the PCoIP setting.

   2. Configure any parameters that are available for the setting.

   3. Click OK to close the GPO's configuration window.

4. Repeat step 3 until all policies have been set.

5. Close the Local Group Policy Editor.

H.264 Hardware Decode Requirements

For H.264 Hardware Decode, the Graphics Agent must have an NVIDIA Graphics Card that supports PCoIP Ultra GPU Offload, and PCoIP Ultra setting is either set to GPU Offload or Auto Offload.

The following NVIDIA graphics cards are supported:

• NVIDIA Quadro P400
• NVIDIA GeForce RTX 3060

Any Nvidia GPU with NVENC support are expected to work, but have not been tested.

Configurable Settings

The following settings can be configured on the Standard Agent for Windows. Refer to Configuring the Anyware agent to understand how to modify these settings.

Authentication broker URL

This setting takes effect when you start the next session. This policy sets the authentication broker URL for federated user authentication. Enter the authentication broker URL in 'https://address:port/auth' format. This setting overwrites the Authentication broker URL from Connection Manager.

Build-to-lossless

This setting takes effect immediately. Specifies whether to turn the build-to-lossless feature of the PCoIP protocol off or on; this feature is turned off by default.

If this setting is Disabled or Not Configured then the build-to-lossless feature is turned off and images and other desktop content may never build to a lossless state. In network environments with constrained bandwidth, turning off the build-to-lossless feature can provide bandwidth savings. If this setting is Enabled then the build-to-lossless feature is turned on; this is recommended for environments that require images and desktop content to be built to a lossless state.

Clipboard redirection

This setting takes effect when you start the next session. Determines the direction in which clipboard redirection is allowed. You can select one of these values:

• Disabled in both directions
• Enabled in both directions (default setting)
• Enabled client to agent only (That is, allow copy and paste only from the client system to the host desktop.)
• Enabled agent to client only (That is, allow copy and paste only from the host desktop to the client system.)

Clipboard redirection is implemented as a virtual channel. If virtual channels are disabled, clipboard redirection does not function.

When this setting is disabled or not configured, the default value is Enabled in both directions.

Collaboration

This setting takes effect when the agent is restarted. This policy enables or disables user collaboration. When not configured, user collaboration is disabled by default.

The default maximum number of collaborators allowed is 5.

The default UDP starting port used for collaborator sessions is 64172. When a different starting port is used, ensure that firewall rules are adjusted so that PCoIP traffic can go through the new port.

If there is more than one collaborator, additional UDP ports will be needed for the collaborator sessions. For example, when the second collaborator connects, the next free UDP port will be opened on the host.

Collaboration input control

This setting takes effect when you start the next PCoIP session. This policy enables or disables input control from the collaborators. When not configured, collaboration input control is disabled by default.

The input control timeout specifies the waiting period before any user with input control permission can acquire the input control of the host. The current input owner is the only one authorized to send mouse, keyboard and touch inputs to the host.

Connection addresses

This setting takes effect when you start the next session. Configuring this allows you to control the IPv4 or IPv6 address used by the agent or client in PCoIP sessions.

'Connection Address' controls the IP address used by the agent for the PCoIP session.

'Client Connection Address' controls the IP address the client is told to use when establishing the PCoIP session.

Please note that neither of these values should need to be set under normal circumstances.

Deskside mode

This setting takes effect when you start the next session. Deskside mode is only supported on Graphics Agent for Windows. When this setting is disabled or not configured Deskside mode will not be used. It should only be configured for Workstation PCoIP Graphics agents that have displays and input devices physically connected.

Enabling Deskside mode allows the following additional features to be configured:

• Screen blanking When enabled, where possible, any displays plugged into the agent machine will be blanked during the session, and unblanked at the end of session.

• Input blocking When enabled mouse and keyboard access from devices physically connected to the agent machine will be blocked. Input from physically connected devices will be restored at end of session. Note that input blocking may interfere with Wacom tablet functionality, disabling it is recommended when using a Wacom tablet.

• Local display restoration at end of session When enabled displays will be restored to their pre-session state when the session ends. Local display restoration is only supported on Graphics Agent for Windows with an NVIDIA GPU.

Enable Disclaimer Authentication

This setting takes effect when you start the next session. When this setting is enabled, users connecting via direct connect will be presented a disclaimer prior to user authentication. If the disclaimer is rejected, the user will not be able to connect.

Disclaimer files must be placed in %PROGRAMDATA%\Teradici\PCoIPAgent\disclaimers. Files must be named according to the locale, e.g. en_US.txt for en_US, ko_KR.txt for ko_KR, etc. If a file matching the negotiated locale is not present, en_US will be used as a fallback. If disclaimer text cannot be found, an blank disclaimer will be presented.

Enable the PCoIP control panel

This setting takes effect when the agent is restarted. This policy enables or disables the PCoIP control panel. When enabled, the PCoIP control panel will be running, and when disabled the control panel will not be running. When not configured, will run by default.

Enable/disable USB in the PCoIP session

This setting takes effect when you start the next session. Determines whether USB support is enabled in PCoIP sessions. When this setting is not configured, USB is enabled by default. By default all devices are supported unless restrictions are configured through the USB device rules setting.

Enable/disable audio in the PCoIP session

This setting takes effect when you start the next session. Determines whether audio is enabled in PCoIP sessions. Both endpoints must have audio enabled. When this setting is enabled, PCoIP audio is allowed. When it is disabled, PCoIP audio is disabled. When this setting is not configured, audio is enabled by default.

Enable/disable relative mouse support

This setting takes effect when you start the next session. It determines whether relative mouse co-ordinates may be used, when appropriate, during the PCoIP session. By default, this setting is enabled.

Enable/disable trusted domain checks

This setting takes effect when you start the next session. Its purpose is to allow additional security checking of the domain provided during user authentication. By default, this setting is disabled, meaning provided domains are not verified to be trusted. When enabled, the domain used during user authentication is verified to be trusted.

Hide local cursor

This setting takes effect immediately. When this setting is enabled the local cursor on the client will be hidden. This may resolve duplicate cursor issues if there is a host rendered cursor within the host environment but may also result in no visible cursor. With this setting enabled there may be delays in mouse movements due to network latency and video processing times. By default, this setting is disabled, meaning that local cursors will be used, providing the most responsive user experience.

License server URL

This setting takes effect when you start the next session. This policy sets the license server path. Enter the license server path in 'https://address:port/request' or 'http://address:port/request' format.

Maximum PCoIP session bandwidth

This setting takes effect when you start the next session. Specifies the maximum bandwidth, in kilobits per second, in a PCoIP session. The bandwidth includes all imaging, audio, virtual channel, USB, and control PCoIP traffic.

Set this value based on the overall capacity of the link to which your endpoint is connected, taking into consideration the number of expected concurrent PCoIP sessions. For example, with a single user VDI configuration (e.g. a single PCoIP session) that connects through a 4Mbit/s Internet connection, set this value to 4Mbit (or 10% less than this value to leave some allowance for other network traffic).

Setting this value prevents the agent from attempting to transmit at a higher rate than the link capacity, which would cause excessive packet loss and a poorer user experience. This value is symmetric. It forces the client and agent to use the lower of the two values that are set on the client and agent side. For example, setting a 4Mbit/s maximum bandwidth forces the agent to transmit at a lower rate, even though the setting is configured on the client.

When this setting is disabled or not configured on an endpoint, the endpoint imposes no bandwidth constraints. When this setting is configured, the setting is used as the endpoint's maximum bandwidth constraint in kilobits per second.

The default value when this setting is not configured is 900000 kilobits per second.

This setting applies to the agent and client. If the two endpoints have different settings, the lower value is used.

PCoIP Security Certificate Settings

This setting takes effect when you start the next session. This policy dictates the handling of certificates.

A certificate is used to secure PCoIP related communications. The way PCoIP components choose a certificate is based on the certificate type, the name of the Certificate Store (referred to as "certificate storage") and the key length. Without a certificate being generated or selected, a PCoIP Session cannot be established.

Depending on the value chosen for the option, 'How the PCoIP agent chooses the certificate...' and the availability of appropriate certificates, PCoIP components may acquire a CA signed certificate from the Windows Certificate Store or generate an in-memory self-signed certificate.

Name the Windows Certificate Store where the CA signed certificate is stored. The default is the "MY" store (shown as "Personal" in Management Console). Set the friendly name of the CA signed certificate to be PCoIP, in the Windows Certificate Store.

CA certificate(s) must be stored in the "Trusted Root Certification Authorities" store (sometimes referred to as "ROOT").

Select a minimum key length (in bits) for choosing a CA signed certificate from the Windows Certificate Store. Longer length certificates will require more computing resources and may reduce performance, but will increase security. Shorter length certificates will provide better performance at the cost of lower security.

Note: Please refer to Teradici documentation for instructions on creating and deploying certificates.

PCoIP Security Settings

This setting controls the cryptographic cipher suites used by PCoIP endpoints. Changes will take effect when the agent is restarted. When this setting is disabled or not configured, all supported cipher suites may be used for connections. The endpoints negotiate the actual cryptographic cipher suites based on the settings configured here. Newer versions of TLS and stronger cipher suites will be preferred during negotiation between endpoints. Supported cipher suites:

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_AES_256_GCM_SHA384

Blacklisted Cipher Suites Provides the ability to block specific cipher suites from being offered during negotiation. Must be entered as a semi-colon separated list of cipher suites.

PCoIP USB allowed and unallowed device rules

This setting specifies the USB devices that are authorized and unauthorized for use in a PCoIP session. Any changes to this setting only takes effect after you start the next session.

If this setting is left Not Configured or set to Disabled, then the default behavior is all devices are allowed.

When this setting is enabled, only devices listed in the USB authorization table are permitted in PCoIP sessions, provided they are not subsequently excluded by an entry in the USB unauthorization table.

If this setting is enabled with an empty USB authorization string, this means that no USB devices are allowed. An empty USB unauthorization string means that only USB devices in the authorization list are allowed.

You can define a maximum of 50 USB authorization rules and a maximum of 50 USB unauthorization rules. Separate multiple rules with the vertical bar (|) character. Please note the final number of authorization/unauthorization rules in a PCoIP session are negotiated by PCoIP client and agent. Some clients have a limit of 10 USB rules. Please refer to the PCoIP agent admin guide for details.

Each rule can be a combination of a Vendor ID (VID) and a Product ID (PID), or a rule can describe a class of USB devices. A class rule can allow or disallow an entire device class, a single subclass or a protocol within a subclass.

The format of a combination VID/PID rule is 1xxxxyyyy, where xxxx is the VID in hexadecimal format and yyyy is the PID in hexadecimal format. For example, the rule to allow or block a device with VID=0x1a2b and PID=0x3c4d is 11a2b3c4d.

For class rules, use one of the following formats:

Allow All USB Format: 23XXXXXX Allow All Devices Example: 23XXXXXX

Allow USB Format: 22classXXXX Class Example: 22aaXXXX

Allow a Specific Format: 21class-subclassXX Subclass Example: 21aabbXX

Allow a Specific Format: 20class-subclass-protocol Protocol Example: 20aabbcc

For example, the USB authorization string to allow USB HID (mouse and keyboard) devices (class ID 0x03) and mass storage devices (class ID 0x08) is 2203XXXX|2208XXXX. The USB unauthorization string to disallow USB Mass Storage devices (class ID 0x08) is 2208XXXX.

PCoIP Ultra

This setting takes effect when you start the next session. When this setting is disabled, PCoIP Ultra will not be used.

• PCoIP Ultra CPU Offload - these optimizations require CPU support for the AVX2 instruction set on both the remote host and client and are not compatible with the PCoIP Zero client. CPU Offload is recommended for 4K UHD resolutions with video playback requirements of 30 fps (or more) and highest image quality / color accuracy.

• PCoIP Ultra GPU Offload - these optimizations require an NVIDIA graphics card on the remote host capable of NVENC. GPU Offload is recommended when minimal CPU impact of pixel encoding is desired.

• PCoIP Ultra Auto Offload - enabling this setting allows PCoIP to automatically switch between CPU and GPU Offload modes; CPU Offload is used by default to provide the best image fidelity, GPU Offload is used during periods of high display activity to provide improved frame rates and bandwidth optimization. This setting is only effective if the remote host and client endpoints are capable of both CPU and GPU Offload.

The PCoIP Ultra Offload MPPS sets the Megapixels Per Second (MPPS) transition rate between PCoIP Ultra CPU Offload and PCoIP Ultra GPU Offload. Under Auto-Offload, PCoIP Ultra uses CPU Offload at lower pixel rates and switches to GPU Offload at the Offload MPPS. Increasing this value results in PCoIP Ultra transitioning to GPU Offload at a higher pixel rate and decreasing this value results in the transition at a lower pixel rate. The default PCoIP Ultra Offload MPPS is set to 10.

PCoIP event log verbosity

This setting takes effect immediately. This policy enables the configuration of the PCoIP event log verbosity ranging from 0 (least verbose) to 3 (most verbose).

When this policy is Disabled or Not Configured, the default event log verbosity setting is 2. When this policy is Configured, the setting controls the verbosity level as described above.

PCoIP image quality levels

This setting takes effect immediately. Controls how PCoIP renders images during periods of network congestion. The Minimum Image Quality, Maximum Initial Image Quality, and Maximum Frame Rate values interoperate to provide fine control in network-bandwidth constrained environments.

Use the Minimum Image Quality value to balance image quality and frame rate for limited-bandwidth scenarios. You can specify a value between 30 and 100. The default value is 40. A lower value allows higher frame-rates, but with a potentially lower quality display. A higher value provides higher image quality, but with potentially lower frame rates when network bandwidth is constrained. When network bandwidth is not constrained, PCoIP maintains maximum quality regardless of this value.

Use the Maximum Initial Image Quality value to reduce the network bandwidth peaks required by PCoIP by limiting the initial quality of the changed regions of the display image. You can specify a value between 30 and 100. The default value is 80. A lower value reduces the image quality of content changes and decreases peak bandwidth requirements. A higher value increases the image quality of content changes and increases peak bandwidth requirements. Unchanged regions of the image progressively build to a lossless (perfect) quality regardless of this value. A value of 80 or lower best utilizes the available bandwidth.

The Minimum Image Quality value cannot exceed the Maximum Initial Image Quality value.

Use the Frame Rate vs Image Quality value to favor image sharpness over smooth motion during a PCoIP session when network bandwidth is limited. Lower values favor smoothness, higher values favor sharpness of image.

Use the Maximum Frame Rate value to manage the average bandwidth consumed per user by limiting the number of screen updates per second. You can specify a value between 1 and 60 frames per second. A higher value can use more bandwidth but provides less jitter, which allows smoother transitions in changing images such as video. A lower value uses less bandwidth but results in more jitter.

YUV chroma subsampling is set to 4:2:0 by default. It enables chroma subsampling to further compress the imaging to reduce bandwidth usage at the cost of reduced color accuracy. 4:2:0 subsampling is only supported in combination with PCoIP Ultra GPU optimization. Please note: 4:4:4 subsampling with PCoIP Ultra GPU optimization is GPU dependent and is not supported by all GPUs, in this case, PCoIP will fall back to 4:2:0 subsampling. Please see our support site for further details.

Set the 'Use image settings from zero client' when you want to use the 'Minimum Image Quality', 'Maximum Initial Image Quality', 'Maximum Frame Rate', 'Disable Build to Lossless' values from the client instead of the host. Currently, only Zero Client Firmware 3.5 and above support these settings on the client side.

These image quality values apply to the soft host only and have no effect on a soft client.

When this setting is disabled or not configured, the default values are used.

PCoIP log retention

This setting takes effect immediately. This policy sets the retention period (in days) for PCoIP logs that have been archived. PCoIP log files are periodically archived to %PROGRAMDATA%\Teradici\logs\ROTATE. When this policy is Disabled or Not Configured, archived logs that have not been modified in 30 days are removed. When this policy is Configured, the setting controls the retention period as described above.

When configuring a retention period PowerShell 4.0 or newer is required. If an older PowerShell version is installed then the default retention period will be used, regardless of the configured setting.

PCoIP session MTU

This setting takes effect when you start the next session. Specifies the Maximum Transmission Unit (MTU) size for UDP packets for a PCoIP session.

The MTU size includes IP and UDP packet headers. TCP uses the standard MTU discovery mechanism to set MTU and is not affected by this setting. The maximum MTU size is 1500 bytes. The minimum MTU size is 500 bytes. The default value is 1200 bytes.

Typically, you do not have to change the MTU size. Change this value if you have an unusual network setup that causes PCoIP packet fragmentation.

This setting applies to the agent and client. If the two endpoints have different MTU size settings, the lowest size is used.

If this setting is disabled or not configured, the client uses the default value in the negotiation with the agent.

PCoIP session SSO access control

This setting takes effect when you start the next session. Enable/Disable the single sign on access control to a PCoIP session.

When this policy is Not Configured, the single sign on access control is enabled.

PCoIP session audio bandwidth limit

This setting takes effect immediately. Specifies the maximum audio bandwidth that can be used for audio output (sound playback) from the virtual desktop to the client in a PCoIP session. Note that the network transport overhead can add an additional 20-40% bandwidth to this number.

This setting does not apply to audio input (recording) from the client to the virtual desktop. This setting also has no effect on USB audio devices which are connected to the virtual desktop through USB redirection.

Audio processing monitors the bandwidth needed for audio and selects the audio compression algorithm that provides the best quality possible, without exceeding the bandwidth limit:

• 512 kbit/s or higher - 7.1 surround, high-quality, compressed audio

• 384 kbit/s or higher - 5.1 surround, high-quality, compressed audio

• 256 kbit/s or higher - stereo, high-quality, compressed audio

• 48 kbit/s to 255 kbit/s - stereo audio ranging between FM radio quality down to AM radio quality

• 32 kbit/s to 47 kbit/s - monaural AM radio or phone call quality

• Below 32 kbit/s - results in no audio playback

If this setting is disabled or not configured, a default audio bandwidth limit of 512 kbit/s is configured to constrain the audio compression algorithm selected. If the setting is configured, the value is measured in kilobits per second (kbit/s), with a default audio bandwidth limit of 512 kbit/s.

Note that zero clients on older firmware have less efficient audio compression algorithms that may require setting this limit higher to achieve the same audio quality or upgrading the firmware.

PCoIP session bandwidth floor

This setting takes effect immediately. Specifies a lower limit, in kilobits per second, for the bandwidth that is reserved by the PCoIP session.

This setting configures the minimum expected bandwidth transmission rate for the endpoint. When you use this setting to reserve bandwidth for an endpoint, the session does not have to wait for bandwidth to become available, which improves session responsiveness.

Make sure that you do not over-subscribe the total reserved bandwidth for all endpoints. Make sure that the sum of bandwidth floors for all connections in your configuration does not exceed the network capability.

The default value is 0, which means that no minimum bandwidth is reserved. When this setting is disabled or not configured, no minimum bandwidth is reserved.

This setting applies to the agent and client, but the setting only affects the endpoint on which it is configured.

PCoIP statistics interval

This setting takes effect immediately. Configuring this allows you to set an interval in seconds for logging performance statistics to the PCoIP server log. When not configured, logging is disabled by default.

PCoIP transport header

This setting takes effect when you start the next session. Configures the PCoIP transport header.

PCoIP transport header is a 32-bit long header which is added to all PCoIP UDP packets (only if the transport header is enabled/supported by both sides). PCoIP transport header allows network devices to make better prioritization/Qos decisions when dealing with network congestions. The transport header is enabled by default.

The transport session priority determines the PCoIP session priority reported in the PCoIP Transport Header. Network devices make better prioritization/Qos decisions based on the specified transport session priority. The transport session priority value is negotiated by the PCoIP agent and client. If agent has specified a transport session priority value (high, medium, or low), then the session uses the agent specified session priority. If only the client has specified a transport session priority (high, medium, or low), then the session uses the client specified session priority. If neither agent nor client has specified a transport session priority (or specified 'undefined priority'), then the session uses/defaults to the medium session priority.

PCoIP virtual channels

This setting takes effect when you start the next session. Specifies the virtual channels that can or cannot operate over a PCoIP session.

There are two modes of operation:

• Enable all virtual channels except for <list> (default setting)
• Disable all virtual channels except for <list>

When specifying which virtual channels to include or not include in the list, the following rules apply:

• An empty list is allowed
• Multiple virtual channel names in the list must be separated by the vertical bar (|) character. For example: channelA|channelB
• Vertical bar or backslash () characters in virtual channel names must be preceded by a backslash. For example: the channel name "awk|ward\channel" must be specified as "awk|ward\channel" (without the double quotes)
• A maximum of 15 virtual channels are allowed in a single PCoIP session

The virtual channel must be enabled on both agent and client for it to be used.

Primary display resolution

This setting takes effect when you start the next session. Configuring this value will override the display resolution of the primary monitor for connections to the host. The value applies only to the PCoIP Standard Agent for Windows.

Proxy Access to a remote License Server

This setting takes effect when you start the next session. If a proxy is required to access a local License Server or the Cloud License Server, enter those parameters here. These parameters are loaded only during agent startup.

Remote printing

This setting takes effect when you start the next session, and applies on the host only. Basic Remote printing will only offer limited printing but has the advantage of using a generic printer driver on the host side. This ensures compatible printing but does not offer all features of the printer.

Advanced remote printing for Windows clients requires installation of the matching printer driver on the host side of the solution. In some cases the matching printer driver cannot be found for the host OS and/or the printer driver is not compatible with the printer. In those cases changing the printer setting to "Basic" should allow printing to those printers.

Remote printing is implemented as a virtual channel. If virtual channels are disabled, remote printing does not function.

When this setting is disabled or not configured, the default value of Basic remote printing is enabled.

The default value of unchecked for 'Automatically set default printer' will not change the default printer on the host when the client connects; the default printer, if set on the host, will be a host local/network printer. When checked, the default printer on the host will match the client's default printer within a session and will be reset to a host local/network printer upon client disconnection. This can allow for a user experience where printing can naturally occur close to the location of the client computer.

Session Automatic Reconnection Policy

This setting takes effect when you start the next session. This policy configures the automatic reconnection period, that is the amount of time a PCoIP Client and Server will attempt to reconnect an interrupted session without requiring the user to re-enter their logon credentials.

A session may be interrupted through network loss, for instance through pulling a network cable, disabling a network interface or moving away from a WiFi hotspot. In the case of portable computing devices closing a laptop lid or similar actions have the same effect. By default, when network connectivity returns within the specified time period, the session will be restored with no further user action being required.

If this setting is disabled or not configured, the default reconnect period is 20 minutes.

Setting this value to 0 disables the session automatic reconnection feature but allows for session reconnection as a result of intermittent short term network loss (between 30 and 60 seconds).

Timezone redirection

This setting takes effect when you start the next session. Configuring this allows you to enable or disable timezone redirection. When not configured, timezone redirection is enabled by default.