> ## Documentation Index
> Fetch the complete documentation index at: https://docs.macstadium.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MacStadium VDI customer environment tips

> Best practices for deploying Citrix HDX and HP Anyware PCoIP on MacStadium: MDM enrollment, permissions, networking, and performance tuning.

## Overview

These are recommended best practices for deploying Citrix HDX and HP Anyware PCoIP on MacStadium infrastructure. This document provides guidance on MDM enrollment, permissions, networking, and performance tuning. Sections that differ by protocol use tabs.

***

## Security and encryption

Disable FileVault unless your security policy requires it. If a machine with FileVault enabled powers down, a MacStadium Data Center Technician must intervene locally before it can be accessed remotely. If encryption is required, coordinate with MacStadium to set up secure restart scripts that automate reboots and recovery before enabling it.

Note: If your organization requires the use of FileVault, it is highly recommended that macOS Tahoe is used on your host devices. Apple released a pre-boot SSH capability in Tahoe that allows for remote disk decryption as an alternative to physical DCT intervention. FileVault is not officially supported by MacStadium.

Use an MDM solution (Jamf Pro, Kandji, or Intune) to enforce your security baseline. See [MDM Policies and Permissions](#mdm-policies-and-permissions) for VDI-specific configuration.

***

## MDM enrollment for VMs

Apple Business Manager (ABM) Automated Device Enrollment is not available for virtual machines. Apple identifies VM hardware identifiers as virtual and blocks auto-enrollment. This cannot be worked around.

The standard approach is user-initiated enrollment scripted into your golden image. A LaunchDaemon runs at first boot to install the management framework. A LaunchAgent runs at login to prompt the user to approve the MDM profile. That approval is a macOS requirement on unsupervised devices.

MacStadium's tested and supported enrollment process for VMs at scale uses Jamf Pro. For a full walkthrough, see [Jamf Enrollment for MacStadium VDI Desktops](/remote-desktop-vdi/configuration/mdm-enrollment). The LaunchDaemon/LaunchAgent pattern is the same for Intune and Kandji, but MacStadium is still validating and developing optimized guidance for those platforms.

A few things to get right before sealing the image:

* Set enrollment tokens to expire on a schedule aligned to your image rotation cycle.
* Verify enrollment on a test VM before promoting to production: `profiles status -type enrollment` should return `MDM enrollment: Yes`.
* Do not seal the image with an MDM profile or management framework already present.

For image build and versioning guidance, see [VDI Golden Image Management](/remote-desktop-vdi/configuration/image-management).

***

## MDM policies and permissions

Configure and test these before sealing your golden image. Some permissions cannot be pre-approved via MDM, so they need to be granted manually on a clean VM before the image is sealed.

<Tabs>
  <Tab title="Citrix HDX">
    ### Privacy preferences (PPPC / TCC)

    | Permission       | Required?                  | MDM pre-approvable?                |
    | ---------------- | -------------------------- | ---------------------------------- |
    | Accessibility    | Required                   | Yes                                |
    | Screen Recording | Required                   | No (grant manually before sealing) |
    | Microphone       | Optional (audio redirect)  | No (user-controlled)               |
    | Camera           | Optional (webcam redirect) | No (user-controlled)               |

    **Bundle IDs for PPPC profiles:**

    | Application            | Bundle ID           | Team ID      |
    | ---------------------- | ------------------- | ------------ |
    | Citrix Workspace / VDA | `com.citrix.ctxism` | `S272Y5R93J` |

    ### System extensions

    Citrix VDA installs system extensions for camera and USB redirection. Pre-approve these to prevent user-facing prompts.

    | Extension        | Bundle ID                                | Type             | Team ID      |
    | ---------------- | ---------------------------------------- | ---------------- | ------------ |
    | Camera extension | `com.citrix.mvda.vdacfg.cameraextension` | System extension | `S272Y5R93J` |
    | USB redirection  | `com.citrix.kext.gusb`                   | Kernel extension | `S272Y5R93J` |

    On macOS 15 (Sequoia), admin users can remove system extensions via System Settings. Jamf Pro 11.9.1+ and Kandji 3.x both support marking extensions as non-removable.

    Citrix also installs background services under `/Library/LaunchAgents` and `/Library/LaunchDaemons`. On Ventura and later, users see a "Background Items Added" notification on first login. This is expected. Do not suppress or disable these services.
  </Tab>

  <Tab title="HP Anyware PCoIP">
    ### Privacy preferences (PPPC / TCC)

    | Permission       | Required? | MDM pre-approvable?                |
    | ---------------- | --------- | ---------------------------------- |
    | Accessibility    | Required  | Yes                                |
    | Screen Recording | Required  | No (grant manually before sealing) |
    | Microphone       | Optional  | No (user-controlled)               |
    | Camera           | Optional  | No (user-controlled)               |

    **Bundle IDs for PPPC profiles:**

    | Application           | Bundle ID                       | Team ID             |
    | --------------------- | ------------------------------- | ------------------- |
    | HP Anyware Client     | `com.teradici.swiftclient`      | Not published by HP |
    | HP Anyware User Agent | `com.teradici.pcoip-user-agent` | Not published by HP |

    HP does not document Team ID information for HP Anyware. To generate a code requirement string for use in a PPPC payload, run this against the installed host agent:

    ```bash theme={null}
    # Locate the agent
    mdfind "kMDItemCFBundleIdentifier == 'com.teradici.pcoip-user-agent'"

    # Generate the code requirement string
    codesign -dr - /path/to/PCoIPAgent.app
    ```

    Paste the `designated =>` line from the output into the Code Requirement field of your MDM's PPPC payload.

    ### Apple Firewall

    MDM solutions typically enforce the Apple Firewall on a recurring check-in schedule (every 30 minutes with some platforms). Disabling the firewall manually does not hold if your MDM profile re-enables it on check-in.

    Add PCoIP application exceptions instead of disabling the firewall. Application exceptions survive MDM check-ins:

    ```bash theme={null}
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add "/Applications/PCoIP Agent/pcoip-agent"
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp "/Applications/PCoIP Agent/pcoip-agent"
    ```

    To verify the exception is set:

    ```bash theme={null}
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --listapps | grep -i pcoip
    ```

    ### Session management

    Train users to end PCoIP sessions by closing the HP Anyware client window. Using the macOS **Log Out** option from within an active PCoIP session breaks the remote display state and prevents future connections until the host is rebooted. This applies to all macOS versions running the HP Anyware Graphics Agent.

    If a host is in a broken display state due to a macOS logout within a session, a reboot is required to restore access. Reboots can be performed via SSH or Screen Share.
  </Tab>
</Tabs>

### MDM platform notes

| Platform         | PPPC                                       | System Extensions                                     | Notes                                                                                                                                                                                                                                                       |
| ---------------- | ------------------------------------------ | ----------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Jamf Pro         | Privacy Preferences Policy Control payload | System Extensions payload (Team ID `S272Y5R93J`)      | MacStadium's tested and supported platform for VM enrollment at scale. For HP Anyware, generate the code requirement string with `codesign -dr -` and paste it manually. See the [Jamf Enrollment guide](/remote-desktop-vdi/configuration/mdm-enrollment). |
| Microsoft Intune | Custom Configuration Profile (macOS XML)   | Endpoint Security > macOS System Extensions           | Deploy HP Anyware or Citrix Workspace as a macOS DMG app via the Apps blade. Optimized VM enrollment guidance for Intune is in development.                                                                                                                 |
| Kandji           | Privacy Preferences Library Item           | System Extensions Library Item (Team ID `S272Y5R93J`) | 3.x supports non-removable extensions on macOS 15. Optimized VM enrollment guidance for Kandji is in development.                                                                                                                                           |

***

## Networking and connectivity

Disable packet inspection and SSL interception on VDI session traffic. Both HDX and PCoIP are sensitive to latency added by middleboxes. Route sessions as directly as possible and avoid unnecessary proxy hops.

**Required ports:**

<Tabs>
  <Tab title="Citrix HDX">
    | Protocol           | Ports              |
    | ------------------ | ------------------ |
    | Primary session    | TCP/UDP 1494, 2598 |
    | Broker / licensing | TCP 443            |
    | EDT (performance)  | UDP 1494, 2598     |

    Enable EDT (UDP 1494/2598) where possible. It provides noticeably better performance over variable-quality connections compared to TCP-only transport.
  </Tab>

  <Tab title="HP Anyware PCoIP">
    | Protocol           | Ports          |
    | ------------------ | -------------- |
    | Primary session    | UDP 4172       |
    | Session fallback   | TCP 4172       |
    | Broker / licensing | TCP 443, 60443 |
  </Tab>
</Tabs>

**Bandwidth planning per concurrent user:**

| Workload type                    | Recommended |
| -------------------------------- | ----------- |
| General productivity / coding    | 2-3 Mbps    |
| Design / graphics                | 5-10 Mbps   |
| Video editing / high-performance | 15-25 Mbps  |

Maintain a secondary administrative access path (VNC or MacStadium remote console) independent of your VDI session for recovery scenarios.

***

## Performance tuning

### macOS settings (both protocols)

Disable desktop animations and transparency effects before sealing your image: **System Settings > Accessibility > Display > Reduce Motion** and **Reduce Transparency**. Disable screen saver, hot corners, and idle timers:

```bash theme={null}
sudo pmset -a sleep 0 disksleep 0 displaysleep 0
```

MacStadium hosts use wired Ethernet. If any nodes in your cluster are on Wi-Fi, disable Wi-Fi power saving to prevent the NIC from dropping into a low-power state during active sessions.

### Protocol-specific tuning

<Tabs>
  <Tab title="Citrix HDX">
    Configure transport via Citrix Workspace App for Mac settings: EDT, H.264/H.265 codec selection, and audio quality profiles. See the [Citrix Workspace App for Mac docs](https://docs.citrix.com/en-us/citrix-workspace-app-for-mac) for the full tuning reference.
  </Tab>

  <Tab title="HP Anyware PCoIP">
    Configure via `/Library/Preferences/com.teradici.pcoip-agent.plist`. Set before sealing or push via MDM config profile:

    ```bash theme={null}
    # Bandwidth ceiling in kbps (default: 900000, effectively uncapped)
    sudo defaults write /Library/Preferences/com.teradici.pcoip-agent pcoip.max_link_rate -int 25000

    # Image quality floor/ceiling, 0-100 (defaults: 40 / 80)
    sudo defaults write /Library/Preferences/com.teradici.pcoip-agent pcoip.minimum_image_quality -int 40
    sudo defaults write /Library/Preferences/com.teradici.pcoip-agent pcoip.maximum_initial_image_quality -int 80

    # Frame rate ceiling in fps (default: 30)
    sudo defaults write /Library/Preferences/com.teradici.pcoip-agent pcoip.maximum_frame_rate -int 30

    # Audio bandwidth ceiling in kbps (default: 512)
    sudo defaults write /Library/Preferences/com.teradici.pcoip-agent pcoip.audio_bandwidth_limit -int 256

    # MTU size in bytes (default: 1200)
    sudo defaults write /Library/Preferences/com.teradici.pcoip-agent pcoip.mtu_size -int 1200

    # Build-to-lossless: 0 = off (default), 1 = on
    # Sharpens to pixel-perfect during idle; useful for design review, increases bandwidth
    sudo defaults write /Library/Preferences/com.teradici.pcoip-agent pcoip.enable_build_to_lossless -int 0
    ```

    Changes take effect after the PCoIP agent service restarts or the VM reboots.
  </Tab>
</Tabs>

***

## Management and policy

Define MDM policies before sealing your golden image. A baseline for MacStadium VDI:

| Category          | Policies                                                                                                          |
| ----------------- | ----------------------------------------------------------------------------------------------------------------- |
| Must be enabled   | Remote management, System Integrity Protection, disable end-user restart and shutdown                             |
| Should be enabled | Password complexity, software firewall, Gatekeeper, software update enforcement                                   |
| Avoid             | User lockout policies requiring local physical recovery; FileVault without a MacStadium-coordinated recovery plan |

Do not apply aggressive idle timeout or auto-sleep policies that conflict with active session stability. See [VDI Golden Image Management](/remote-desktop-vdi/configuration/image-management) for incorporating MDM configuration into your image build pipeline.

***

## Backup and recovery

Keep machines in an always-on or wake-on-network state. Maintain a secondary administrative connection (VNC or MacStadium secure console) that does not depend on your VDI session. Enable Time Machine or equivalent backup on a schedule that meets your retention requirements. VDI sessions are not a substitute for enterprise backup.

***

## Quick reference

|                        | Citrix HDX                    | HP Anyware PCoIP                                      |
| ---------------------- | ----------------------------- | ----------------------------------------------------- |
| Session ports          | TCP/UDP 1494, 2598; TCP 443   | UDP/TCP 4172; TCP 443, 60443                          |
| Main bundle ID         | `com.citrix.ctxism`           | `com.teradici.swiftclient`                            |
| System extensions      | Camera kext, USB kext         | None                                                  |
| Accessibility (MDM)    | Pre-approvable                | Pre-approvable                                        |
| Screen Recording (MDM) | Grant manually before sealing | Grant manually before sealing                         |
| MDM enrollment         | User-initiated only           | User-initiated only                                   |
| Agent variants         | VDA                           | Graphics Agent, Standard Agent                        |
| Agent config           | Citrix Workspace settings     | `/Library/Preferences/com.teradici.pcoip-agent.plist` |

**Related:**

* [Jamf Enrollment for MacStadium VDI Desktops](/remote-desktop-vdi/configuration/mdm-enrollment)
* [VDI Golden Image Management](/remote-desktop-vdi/configuration/image-management)
* [Citrix Workspace App for Mac](https://docs.citrix.com/en-us/citrix-workspace-app-for-mac)
* [HP Anyware Documentation](https://anyware.hp.com/web-help/pcoip_client/mac/24.03/)
* [Apple Platform Security Guide](https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf)