Welcome to my Omnissa Horizon series. With the Connection Servers and the Enrollment Server on 2609, it is time for the agents in the golden images. Instead of patching each golden image by hand, I rebuild the templates from scratch with my maintenance platform (Packer and Ansible). I update the build configuration with the new agent versions from the installer share and start the build. When the build succeeds, the platform publishes the new snapshot to the RDS farm or desktop pool in Horizon by itself.
The process is the same for every template, so this post walks through one of them, my Windows Server 2025 RDSH farm, and lists the differences for Windows 11 and Linux under Per template.
AI-assisted development
This upgrade automation was developed with assistance from Claude by Anthropic, particularly for some of the Ansible- and PowerShell-related tasks. While I am not above using AI to reduce the amount of manual work involved, every part of the solution has been implemented, tested, and proven to work in my lab environment before being included in this write-up.
Release notes
Horizon 8 2609 was released on October 22nd 2026. The release notes list the Windows Agent build as 8.20.0-39012823408, while the agent installer I use from the share is 8.20.0-39774714737, so don’t be surprised if the numbers differ. The full list of new features, resolved issues and known issues is in the Omnissa Horizon 8 2609 Release Notes. These are the new features most relevant for the golden images:
What’s New
- Horizon Agent for Windows
- Smart card SSO with ECDSA certificates. The agent now uses the Windows CNG Key Storage Provider (KSP) by default for both RSA and ECDSA certificates. Minidrivers that only support the legacy CryptoAPI provider can still use it with UseCryptoAPI, but ECDSA requires KSP.
- Remote desktop features
- Blast Extreme auto-discovers the largest UDP packet size the network supports (up to 1500 bytes), which reduces disconnects on networks with a lower MTU. It is on by default.
- The Blast networking components support ECDSA certificates, and intercepted applications can use Windows Hello for Business certificates.
- Client-side clipboard controls (off by default), and a separate port for session recording playback.
- Horizon Agent for Linux
- Wayland with GNOME on RHEL 10.2 and Ubuntu 26.04 is GA, with limited feature availability.
- Caching of directory listings for client drive redirection, DKMS integration for the USB (VHCI) driver, clipboard images, and keypad/scroll/caps lock synchronization.
- Windows OS Optimization Tool
- New optimizations for Windows 11 23H2 and later, including an Autologger category that disables ETW autologgers that run continuously.
Before you upgrade
Checklist & known issues
- Create a DHCP reservation and a DNS host record for the build VM before you start the build. The pre-check at the start of the build checks DNS for the build VM’s name.
- The 2609 Agent is supported with both the 2603 ESB and the 2609 Connection Servers. Upgrade the servers first and the agents afterwards.
- If you install VMware Tools from the downloads page instead of using the version that comes with vSphere, check that the version is supported in the Product Interoperability Matrix (see KB 78434).
- Known issue HZN-11737: creating a sysprep farm from a Windows Server 2025 golden image fails with “Timed out while waiting for VM to shut down” if the RDSH master isn’t joined to the domain. Join it to the domain before you create the farm.
- Known issue in OSOT: an analysis report exported to the user folders on the same VM is deleted when Generalize runs Sysprep. Export it to a network location instead.
- Known issue: when a QoS policy is configured on the Horizon Agent, the Bypass Blast Service TCP proxy feature is disabled.
- Most Linux agent known issues in 2609 concern Wayland desktops on RHEL 10.2 and Ubuntu 26.04 (cursor, mouse wheel, display and a kernel hard lockup in Wayland mode). Read them before you move users to Wayland.
- Resolved in 2609: HZN-11416 (the golden image list for a new instant-clone farm was empty unless you selected Show all golden images), HZN-10746 (instant-clone pool creation failed when Cores per Socket was empty) and VCART-15265 (intermittent black screens on connect, especially with NVIDIA GPUs).
Upgrade sequence
At what point in an upgrade procedure should the golden images be upgraded? According to Omnissa’s official documentation, the agents are upgraded in the second phase, after the connectivity layer (Connection Servers, Enrollment Servers, UAG) and vSphere. Inside the golden image, VMware Tools comes first, then the Horizon Agent and the other agents, with the App Volumes Agent last.
The procedure
- App Volumes Managers and Connection Servers / Enrollment Server: already on 2609.
- New installers on the share: Horizon Agent and Client, DEM Agent and App Volumes Agent 2609. VMware Tools is updated when there is a new version.
- Update the build configuration of each template with the new versions, and save it under a new name.
- Build. When the build succeeds, the platform publishes the new snapshot to the farm or pool.
- Verify the agent versions in the Horizon Console and do a test login.
Walkthrough – rebuilding the RDSH template with my maintenance platform
My Omnissa Maintenance Platform builds each template with Packer (vsphere-iso) and Ansible. The walkthrough is split into four phases. Click a screenshot to view it full size.
Phase 1 – Prepare
1. Image management – status
The Status tab under Images › Image management compares each template’s last build with the installers on the share. Three of my five templates have Updates available, among them rdsh_2025-farm1-2606, which was last built on 30.10.2026 (run #55) and publishes to the RDS farm RDSHFARM1P1. Each card also shows the base, the next scheduled rebuild and the farm or pool it publishes to.
Phase 2 – Update the build configuration
I open the existing build in the Create New Template wizard. The banner shows that I’m editing rdsh_2025-farm1-2606: Ready to complete saves over it, or I give it a new name to keep both. Only the version fields change. The other settings are kept from the last build.
2. Deployment options
Collect the install logs, delete the template VM after it has been cloned, and run Windows Update during the build, here directly from Microsoft (WSUS is the alternative).
3. vCenter settings
Where Packer creates the build VM: cluster, ESXi host, datastore (with free space), portgroup, VM folder and vGPU profile. The lists are read from vCenter.
4. VMware Tools settings
VMware Tools 12.5.1.24649672, as read from the last build. I pick the features to keep. Drivers and EFI firmware update are always installed, and features I don’t use, such as the Carbon Black Helper and NSX File Introspection, are removed.
5. Horizon Agent settings
This is the main change: Horizon Agent 2609-8.20.0-39774714737 and Horizon Client 2609-8.20.0-39382986705 from the share (Browse… lists what is there). The feature list shows the agent features for this version. Core and the instant-clone agent (NGVC) are required, and I keep Blast UDP and USB redirection.
6. Horizon deployment options
Where the new image is published: the RDSH farm RDSHFARM1P1. For the push I chose Force users to log off, so users are logged off when their host is ready to be updated, after the warning and grace period set in Horizon’s Global Settings. Wait for users to log off updates hosts with sessions only after the users log off. “Stop at first error” is always on.
7. DEM Agent settings
DEM Agent 2609 (10.21.0.2550). FlexEngine is always installed, and I add the Self-Support tool for end users.
8. Application settings
Extra installers from the share, each with its own install arguments. On the RDSH image only the YubiKey Minidriver is installed. The other applications are delivered with App Volumes.
9. Ready to complete
The wizard shows the two files that will be saved: overrides.yml with the placement, Windows Update, VMware Tools features and the installer paths, and control.sh with how the build runs: collect logs, publish to the farm with forced log off, and delete or replace the build VM. These two files are all the build needs, so the same build can be started from the terminal with scripts/build.sh.
I save the configuration under a new name, rdsh_2025-farm1-2609, so the 2606 build is kept as it was. Saving under the old name would replace the build, and its scheduled task would continue with the new settings. With the option ticked, a leftover build VM is deleted automatically on unattended reruns.
10. Saved
The build rdsh_2025-farm1-2609 is saved for the base rdsh_2025, as two files under configs/. I can start it now, schedule it, or create another one.
Phase 3 – Build and publish
11. Start the build
Before the build starts, a summary shows what will happen: publish to the farm RDSHFARM1P1, force users to log off when the image is pushed, delete the VM after publishing, and no scheduled task yet. The firewall ports the build needs are checked from the worker right away (7 checks, all open). The platform also confirms there is no leftover build VM in vCenter.
12. The build runs
Run #59 lists every step of the build, with a progress bar and an estimate based on the last run (1h 34m). The first step checks placement, DNS and that all installers are on the share. The live log shows the port checks: the vCenter API, the ESXi host (443 and 902) for Packer, the Horizon REST API for publishing, and DNS for the build VM’s name.
13. Build succeeded and published
After 1h 34m the run succeeded, all 25 steps done. The new image was published as snapshot gi-rdsh2025-20261108-155623 and pushed to the farm RDSHFARM1P1. The step times show where the time goes: Windows Update took 36 minutes, .NET Framework 3.5 8 minutes and the OS install 6 minutes. The log starts with the command the web GUI ran, scripts/build.sh rdsh_2025 –config rdsh_2025-farm1-2609, which is the terminal path to the same build.
Phase 4 – Verify
14. RDS hosts in the Horizon Console
Under the farm’s RDS Hosts in the Horizon Console, the recreated host is available and reports Horizon Agent 8.20.0-39774714737, along with the versions of the Telemetry Agent and the App Volumes Agent. Finally I log in to a published desktop and an application, and check App Volumes attachments, DEM settings and the regional settings inside the session.
Per template
The steps above are the same for every template, only the wizard pages for the OS differ. These are the differences, and the build posts with the details:
- Windows Server 2025 RDSH – publishes to an instant-clone RDS farm (this walkthrough). Don’t reboot an instant-clone RDS host from within Windows: refresh it with a push image instead.
- Windows 11 24H2 – publishes to an instant-clone desktop pool. The same wizard pages, and OSOT runs Optimize and Generalize.
- Ubuntu 24.04 and Rocky Linux 9 – publish to a Linux desktop pool. The Horizon Agent for Linux is installed from the Linux installer on the share. There is no OSOT and no App Volumes Agent.
Troubleshooting & rollback
- A build fails: the platform only publishes when the build succeeds, so the farm or pool keeps running on the previous snapshot. “Stop at first error” is always on. Open the run, read the failing step in the log (Open in a window), fix it and start the build again.
- Leftover build VM: a failed build can leave the build VM in vCenter. The start page tells you if one exists, and unattended reruns delete it automatically when that option is ticked.
- Horizon Agent install fails with 1603: check the agent features against the agent version. An invalid feature name (for example PSG, which is no longer a valid feature) makes the MSI fail. The wizard only lists the features of the selected version, and the MSI log is in the collected build logs.
- Problems after the push: push the previous snapshot again from the Horizon Console. Keep the previous snapshot until the new image has run without errors for a while.
- Sysprep farm on Windows Server 2025 times out (HZN-11737): join the RDSH master to the domain before you create the farm.
Next steps
With the new configurations in place, the scheduled rebuilds keep the images patched every month with the same settings. The remaining steps of the upgrade are the Horizon GPO bundle / ADMX templates and the App Volumes templates.
Documentation & sources
- Horizon 8 2609 Release Notes
- Update sequence for Horizon 7, Horizon 8, and compatible Omnissa products (78445)
- KB 78434 – VMware Tools versions
- Horizon Agent with Windows 10 and 11 (78714)
- Horizon Agent with other guest operating systems (78715)
- Product Interoperability Matrix
- Setting up my Ansible/Packer image-automation platform
Horizon planning, deployment etc.
Disclaimer: Every tips/tricks/posting I have published here, is tried and tested in different it-solutions. It is not guaranteed to work everywhere, but is meant as a tip for other users out there. Remember, Google is your friend and don’t be afraid to steal with pride! Feel free to comment below as needed.