Filter policy settings that you configure for View Agent and View Client establish which USB devices can be redirected from a client computer to a desktop.

You can configure USB device filter policy settings in the policy settings for View Agent and View Client. When you connect to a desktop, View Client downloads the View Agent USB policy settings and uses them in conjunction with the View Client USB policy settings to decide which USB devices it will allow you to redirect from the client computer.

View applies any device splitting policy settings before it applies the filter policy settings. If you have split a composite USB device, View examines each of the device's interfaces to decide which should be excluded or included according to the filter policy settings. If you have not split a composite USB device, View applies the filter policy settings to the entire device.

Filter Modifiers for Agent-Enforceable Settings shows the modifiers that specify how View Client handles a View Agent filter policy setting for an agent-enforceable setting if an equivalent filter policy setting exists for View Client.

Filter Modifiers for Agent-Enforceable Settings

Modifier

Description

m (merge)

View Client applies the View Agent filter policy setting in addition to the View Client filter policy setting.

o (override)

View Client uses the View Agent filter policy setting instead of the View Client filter policy setting.

Examples of Applying Filter Modifiers to Agent-Enforceable Settings shows examples of how View Client processes the settings for Exclude Vid/Pid Device when you specify different filter modifiers.

Examples of Applying Filter Modifiers to Agent-Enforceable Settings

Exclude Vid/Pid Device Setting on View Agent

Exclude Vid/Pid Device Setting on View Client

Effective Exclude Vid/Pid Device Policy Setting Used by View Client

o:vid-0a34_pid-****

vid-0122_pid-5cce

vid-0a34_pid-****

m:vid-0a34_pid-****

vid-0122_pid-5cce

vid-0a34_pid-****;vid-0122_pid-5cce

Filter Modifiers for Client-Interpreted Settings shows the modifiers that specify how View Client handles a View Agent filter policy setting for a client-interpreted setting.

Filter Modifiers for Client-Interpreted Settings

Modifier

Description

Default (d in the registry setting)

If a View Client filter policy setting does not exist, View Client uses the View Agent filter policy setting.

If a View Client filter policy setting exists, View Client applies that policy setting and ignores the View Agent filter policy setting.

Override (o in the registry setting)

View Client uses the View Agent filter policy setting instead of any equivalent View Client filter policy setting.

View Agent does not apply the filter policy settings for client-interpreted settings on its side of the connection.

Examples of Applying Filter Modifiers to Client-Interpreted Settings shows examples of how View Client processes the settings for Allow Smart Cards when you specify different filter modifiers.

Examples of Applying Filter Modifiers to Client-Interpreted Settings

Allow Smart Cards Setting on View Agent

Allow Smart Cards Setting on View Client

Effective Allow Smart Cards Policy Setting Used by View Client

Disable - Default Client Setting (d:false in the registry setting)

true (Allow)

true (Allow)

Disable - Override Client Setting (o:false in the registry setting)

true (Allow)

false (Disable)

If you set the Disable Remote Configuration Download policy to true, View Client ignores any filter policy settings that it receives from View Agent.

View Agent always applies the filter policy settings in agent-enforceable settings on its side of the connection even if you configure View Client to use a different filter policy setting or disable View Client from downloading filter policy settings from View Agent. View Client does not report that View Agent is blocking a device from being forwarded.

If you set the Exclude All Devices policy to true, View Client prevents all USB devices from being redirected. You can use other policy settings to allow specific devices or families of devices to be redirected. If you set the policy to false, View Client allows all USB devices to be redirected except those that are blocked by other policy settings. You can set the policy on both View Agent and View Client. Effect of Combining Exclude All Devices Policies shows how the Exclude All Devices policy that you can set for View Agent and View Client combine to produce an effective policy for the client computer. By default, all USB devices are allowed to be redirected unless otherwise blocked.

Effect of Combining Exclude All Devices Policies

Exclude All Devices Policy on View Agent

Exclude All Devices Policy on View Client

Combined Effective Exclude All Devices Policy

false or not defined (include all USB devices)

false or not defined (include all USB devices)

Include all USB devices

false (include all USB devices)

true (exclude all USB devices)

Exclude all USB devices

true (exclude all USB devices)

Any or not defined

Exclude all USB devices

If you have set Disable Remote Configuration Download policy to true, the value of Exclude All Devices on View Agent is not passed to View Client, but View Agent and View Client enforce the local value of Exclude All Devices.

View Client evaluates the filter policy settings according to an order of precedence. A filter policy setting that excludes a matching device from being redirected takes precedence over the equivalent filter policy setting that includes the device. If View Client does not encounter a filter policy setting to exclude a device, View Client allows the device to be redirected unless you have set the Exclude All Devices policy to true. However, if you have configured a filter policy setting on View Agent to exclude the device, the desktop blocks any attempt to redirect the device to it.

View Client evaluates the filter policy settings in the following order of precedence taking into account the View Client settings and the View Agent settings together with the modifier values that you apply to the View Agent settings.

Exclude Path

Include Path

Exclude Vid/Pid Device

Include Vid/Pid Device

Exclude Device Family

Include Device Family

Allow Audio Input Devices, Allow Audio Output Devices, Allow HIDBootable, Allow HID (Non Bootable and Not Mouse Keyboard), Allow Keyboard and Mouse Devices, Allow Smart Cards, and Allow Video Devices

Combined effective Exclude All Devices policy evaluated to exclude or include all USB devices

You can set Exclude Path and Include Path filter policy settings only for View Client. The Allow filter policy settings that refer to separate device families have equal precedence.

If you configure a policy setting to exclude devices based on vendor and product ID values, View Client excludes a device whose vendor and product ID values match this policy setting even though you might have configured an Allow policy setting for the family to which the device belongs.

The order of precedence for policy settings resolves conflicts between policy settings. If you configure Allow Smart Cards to allow the redirection of smart cards, any higher precedence exclusion policy setting overrides this policy. For example, you might have configured an Exclude Vid/Pid Device policy setting to exclude smart-card devices with matching path or vendor and product ID values, or you might have configured an Exclude Device Family policy setting that also excludes the smart-card device family entirely.

If you have configured any View Agent filter policy settings, View Agent evaluates and enforces the filter policy settings in the following order of precedence on the desktop.

Exclude Vid/Pid Device

Include Vid/Pid Device

Exclude Device Family

Include Device Family

Agent-enforced Exclude All Devices policy set to exclude or include all USB devices

View Agent enforces this limited set of filter policy settings on its side of the connection.

By defining filter policy settings for View Agent, you can create a filtering policy for non-managed client computers. The feature also allows you to block devices from being forwarded from client computers, even if the filter policy settings for View Client permit the redirection.

For example, if you configure a policy that permits View Client to allow a device to be redirected, View Agent blocks the device if you configure a policy for View Agent to exclude the device.

Restrict desktops so that they allow client computers to forward only storage devices.

Block All USB Devices except Storage Devices

USB Filtering Policies on View Agent

USB Filtering Policies on View Client

Include Device Family set to o:storage.

Exclude All Devices set to true.

Any setting of Include Device Family or Exclude All Devices on View Client is overridden.

Restrict desktops so that they allow client computers to forward only those devices with vendor and product ID values that match a specified pattern.

Block All USB Devices except Devices with Specified Vendor and Product ID Values

USB Filtering Policies on View Agent

USB Filtering Policies on View Client

Include Vid/Pid Device set to o:vid-0561_pid-554c;vid-0781_pid-****.

Exclude All Devices set to true.

Any setting of Include Vid/Pid Device or Exclude All Devices on View Client is overridden.

Allow client computers to redirect any devices except smart cards and HID-bootable devices.

Allow All USB Devices To Be Redirected Except Smart Cards and HID-bootable devices

USB Policies on View Agent

USB Policies on View Client

Exclude All Devices set to false.

Allow Smartcard set to false.

Allow HIDBootable set to false.