View vCloudPoint Zero Client Deployment Planning in PDF file. For support on a typical deployment, please contact our support team.

To properly license vCloudPoint zero clients in a Microsoft environment, certain CALs are needed for each vCloudPoint seat, along with certain OSes running on the host computer. Regarding the host machine, you have the option of running supported edition of Server 2008R2, Server 2012, Server 2012R2, Multipoint Server 2011, or MultiPoint Server 2012. Windows 7, 8, 8.1 and 10 will work with the vCloudPoint Sharing Computing solution but at this time cannot be shared under Microsoft compliancy. In order for the vCloudPoint workstations to be fully licensed, they will each need a Remote Desktop Services Client Access License (RDS CAL) along with a Windows Server Client Access License (WS CAL). The total cost of these CALs combined will range anywhere from $10-$120 per seat depending on the type of organization deploying the workstations, and their licensing agreement with Microsoft. But these CALs are perpetual licenses – not annual subscriptions.

The result of the licensing model differences by using the sharing computing , traditional desktop PCs and VDI over three years can be seen in the following example:

Sharing: One server OS license per target server ($883) + For each client device: ( 1 Server device CAL ($30) and 1 RDS device CAL ($102)) x 30 = $132 x 30 = $4,843

Desktop PCs: 30 target desktop OS licenses ($187 each) x 30 = $5,610

VDI: 30 target desktop OS licenses ($187 each) x 30 + For each client device: VDA rights subscription ($100 / device / year) x 30 devices x 3 years = $14,610

* Cost based on 30 thin clients (not eligible for SA) over 3 years, Windows Server 2012 R2 standard, Windows 8.1 Pro, US MOL pricing, corporate customers.

Things to consider:
  • If you are replacing PCs, you may already have the WS CAL for each seat.
  • If you are replacing thin clients, you may already have both the RDS and WS CALs.

While deploying zero clients from vCloudPoint, the required licenses mentioned above must be purchased from Microsoft Windows. It is significant to note that Microsoft’s license policy varies between countries and vCloudPoint users are requested to refer to their local Microsoft’s partners before purchase.

For further details on Microsoft’s multi-user licensing please refer to Microsoft’s website or licensing brief titled: “Licensing Windows Client Operating Systems in Multiuser Scenarios“.

1, Your domain system should include at least one Domain Controller and one sharing host that has joined the domain system.

2, Install the vMatrix Server Manager on the sharing host(s).

3, Create users on the Domain Controller.
(Note: as the users are not created through vMatrix Server Manager, you have to manually add the created non-administrator users to the Remote Desktop Users group.)

4, Log into the host with vCloudPoint zero clients. Hosts will automatically be recognized if they have joined the domain. The picture below shows two login options: the first domain name “CLOUDPOINT” is chosen for domain login; the second one “Local Account” is for local account login. If users choose local account login, they are logging on the host rather than the domain.

5, Select a domain, and then enter your username and password.


1, You cannot log in an domain administrator account from a zero client. This will cause unavailability of the whole vMatrix and zero client system. If you mistakenly do this, remove administrators from vMatirxServerRemoteUsers group on the shared hosts thought Computer Management –> Local users & groups –> groups–> vMatirxServerRemoteUsers group

2, Doman NTLM is not support at the moment


1. By default, only users in the Administrator Group can log into the remote Domain Controller, users in the Remote Desktop User Group cannot.

2. If you are using a vMatrix version of or earlier, you have to install the vMatrix both on the Domain Controller and Hosts. If you do not want to install vMatrix on Domain Controller, please use vMatrix version of or later.

By factory default, vCloudPoint zero clients and vMatrix Server Manager software are configured to be used in an internet connected environment (WAN). If your host is provided with internet, no additional configuration is required to be done. The Operation Mode displayed on the User Management page of any device connecting to the host will automatically change from “Offline” in red to “Online” in black, meaning the device is properly working in an internet provided environment.

However, if the Operation Mode of the devices connecting to the host stays “Offline” in red all the time, you have to re-configure the devices for offline usage, otherwise the devices may be disconnected every few minutes during operation. Use cases where you may encounter this problem and need to apply for “Offline Usage” normally includes the followings:

  • you do not provide internet connection (WAN) to the host or the internet connection is extremely unreliable;
  • you use proxy or VPN or internet control software that the host cannot access our configuration server:

How to re-configure the devices for offline usage:

1) In a non-internet connection environment, vMatrix Server Manager will prompt a message window for offline usage configuration within 5 minutes after host boot.

2) Open vMatrix Server Manager, go to Offline Usage page (this page only appears when the host is not provided with internet connection on system boot).

3) Export the configuration profile. Before exporting, please connect all client devices for offline usage to the host, so that the serial numbers (SNs) will be collected in the file. Alternatively, you can write down the SNs if you cannot connect all the client devices (especially in large deployments). The host profile contains hardware information of the host. Therefore, make sure the host hardware, e.g., CPU, memory, drives and network card, are exactly the same as your real offline usage condition, otherwise, if there is any change to the host hardware, the final generated offline configuration will be invalid to the host.

4) The dealer will return you with a configuration file based on your last exported profile. Import the returned file to complete.

5) If your configuration for offline usage is successfully accomplished, the Operation Mode changes from “Offline” in red to “Offline” in black.

Note: Offline usage configuration on vMatrix    Server Manager was introduced in the release of vMatirx Server Manager 2.0.2 version, if you are planning to use the vCloudPoint zero clients in a non-internent or unstable internet environment, please use 2.0.2 or a later version of vMatrix Server Manager, and contact the dealer for generating an offline configuration file.

1) The vMatrix Server Manager software is not installed on the host or not working properly.

Resolution: Install or re-install vMatrix Server Manager.

2) The host or the zero clients are not connected to the LAN.

Resolution: Connect both the host and the zero clients to the LAN, and make sure the network is fine.

3) The zero client is with a new firmware version while the vMatrix Server Manager version on the host is out of date.
Resolution: Upgrade the vMatrix Server Manager.

4)  IP Addresses in the DHCP pool have been used up so that new connected zero clients cannot find hosts in the LAN while the old connected zero clients do not have the problem.

Resolution: Go to the DHCP setting page and enable more IP addresses or shorten the time of IP address tenancy.

Please resolve the issue according to the prompt if there is, if there is not, refer to the followings.

1) A pop-up window says that the device serial number is invalid.

Resolution: Contact our technical support team with series numbers.

2) Unstable Local Area Network (LAN).

Resolution: Examine cable and switch and make sure the zero clients are connected to the host in the same LAN.

3) IP address pool is full that new devices cannot login.

Resolution: Lease more IP addresses, and recommend shorten IP address tenancy time in case there is a plenty of mobile devices connecting to the same network.

4) IP address conflict that the sign-in of one user may log the other out.

Resolution: Make sure all devices use different (IP address) from the others in the same (LAN). Recommend using default DHCP instead static (IP addresses).

(Last update: 11-Mar-2016)

In Windows 10, 8.1,  8, & 7  Operating Systems, all drivers and programs must be digitally signed (verified) in order to be installed. If you do not have internet connection for your first time of vMatrix Server software installation, you have to disable Windows Driver Signature Enforcement. Otherwise the USB and audio drivers cannot be executed for failure of getting signature verification.

Please follow these steps to disable Driver Signature Enforcement in Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2008 R2 once.

(Tip from

Step 1. Enter in Advanced Options menu.

To enter in Advanced Options menu in Windows 8 & 8.1 OS:

1. Press “Windows + “R” keys to load the Run dialog box.

2. Type “shutdown /r /o” and press Enter.


3. Windows informs you that you are about to be signed off. Press “Close”.


4. When Windows restarts, press Troubleshoot” .


5. In the “Troubleshoot options” screen, choose “Advanced options”.


6. In the “Advanced Options” window, choose “Startup Settings”.


7. In “Startup Settings” screen, click “Restart”.


8. After restart in “Startup Settings” windows, press the “F7” (or the “7”) key on your keyboard to “Disable driver signature enforcement”.


Your computer will restart again.

9. After the restart, proceed to install your unsigned driver. During the installation procedure, Windows will inform you that can’t verify the publisher of this driver software. At this point, ignore the warning message and choose “Install this driver software anyway” to complete the installation.


Why all USB devices, user audio cannot work or videos cannot be played smoothly?

If you have one or all of the above problems, you may probably see “cpaccel.exe” (Cloudpoint Multimedia Accelerator ) error message from Windows or by running vMatrix Diagnostic Tool. This is due to some file missing of vMatrix Server Manager, mainly caused by mistaken removal or block of fire-wall or anti-virus software.  The best and quickest way to fix this problem is to re-install vMatrix Server Manager (make sure you have disabled security software before installation). If you still have this problem in use, you may have to add vMatrix files or ports to exception list of security software. Also refer to How to Configure Firewall and Antivirus software for vCloudPoint Products on this page.

(Last update: Sep-13-2016)

What software can or cannot be run on vCloudPoint zero clients?

1, Most popular Windows software can be run with vCloudPoint zero clients such as Office Applications, Skype, Outlook, Chrome, Firefox, IE, Edge, Teamviewer, Adobe Photoshop, Adobe Illustrator,  Adobe After Effects, Adobe Indesign, AutoDesk CAD, and Camtasia, etc.

2, 3D games are not supported. 3D design software like 3D Max can be run but rendering takes long time. Other 3D software may not be supported as graphic card is not utilized by the zero clients on processing.  The experience of desktop on the zero client is just like that of the host computer without a discrete graphic card.

3, A few software cannot work in the multi-user environment.
Adobe Premiere and VPN are known to be not supported in the multi-user environment. To know if your desired software can be run in the multi-user environment without zero clients, you can try running the software in remote desktop sessions with PCs (run “mstsc”).  

Trouble-shooting some applications that are supposed to be supported but still cannot be run with vCloudPoint zero clients: 

1, The disk partition where the applications are installed must be set to be visible to terminal users. To configure visible disk partitions, open vMatrix Server Manager, click Configuration, and then Storage Visibility, tick the partition where your applications are installed.

2, Try disabling or enabling Windows UAC. Some software, especially security or administration software, may requires administrator authority when Windows UAC is enabled. Therefore, when a non-administrator launch the software, it prompts the user to continue with administrator authority. In this case, you have to disable UAC for terminal users with ordinary user account level. While some software, especially the business software,  like the famous Chinese software, Foxmail and Fangyou, were designed without considering multi-user environment that all user data are stored in the same folder, which leads to interference among the users. For these software, you need to enable Windows UAC so that data of each users will be redirected to different folders. And you may also have to install the software in the folder of program files or program files (x86) under the system partition (C:\).

3,  Change installation directory to non-user based. Default installation directory of some software like Kingsoft WPS are user based, like “C:\Users\Administrator”. When installing, you must change it to non-user based one, such as “C:\Program files\” otherwise other users are not able to run this software.

It takes about two seconds for the device kernel to be ready to work and the reboot/power-off logic only takes effect after that.

The power system of vCloudPoint zero clients like S100 is controlled by the kernel (the residing software). This allows users to power off the device through software interface (e.g. the login screen) without needing to press the switch button on the device, which is impossible with those hardware switch devices. This brings convenience when the devices are back mounted at the monitors.

Configuring Firewall and Antivirus Software for vCloudPoint Products

Anti-virus, firewall, and other types of security software can sometimes interfere with the initial configuration or continued operation of vCloudPoint’s vMatrix software. This document gives basic information on applications, services, and network communication within vMatrix, which can be used to configure security software and help ensure compatibility and stable, continued operation.

vMatrix Installation

Please make sure to DISABLE any Anti-Virus or Firewall software during the installation of our product. Software of this type has been tested and known to interfere with the installation of our product. After installation has completed, you may re-enable Anti-Virus and Firewall software.

If system instability occurs after installing vMatrix, please try removing vMatrix and any anti virus or security software present, and then re-installing vMatrix. If the system is stable in this configuration, re-install the anti-virus software. In some cases, this change in install order can improve the interaction between vMatrix and anti-virus software. If issues persist, please try configuring your security software to ignore/allow/trust the following ports and executables:


1. Port Exceptions

Remote Desktop Services: TCP 3389
vMatrix Network Services: TCP 13389-13342 plus 3 per user

UDP 13389

These ports are default settings on vMatrix’s installation but can be customized at vMatrix -> Configuration ->IP/TCP ports.

2. File Access Exceptions

On Firewall:

C:\Program Files\Cloudpoint\vMatrix\CpDaemon.exe
C:\Program Files\Cloudpoint\vMatrix\Driver\CpAccel.exe

On Anti-virus:

— By specific files:

—- For vMatrix functionality
C:\Program Files\Cloudpoint\vMatrix\CpDaemon.exe
C:\Program Files\Cloudpoint\vMatrix\Driver\CpAccel.exe

—- For vMatrix tray icon and User functionality
C:\Program Files\Cloudpoint\vMatrix\CpDeploy.exe

—- For vMatrix Admin manager
C:\Program Files\Cloudpoint\vMatrix\CpManager.exe

—- For vMatrix Diagnostic tools
C:\Program Files\Cloudpoint\vMatrix\DiagnosticTools.exe

—- For vMatrix Install and Update deploy tools
C:\Program Files\Cloudpoint\vMatrix\InstallDeployTools.exe

— By folder:

—- For all vMatrix functionality
C:\Program Files\Cloudpoint\vMatrix

View in PDF file

For remote connection with vCloudPoint zero clients over WAN, setting DMZ host is the easiest way but unsafe, therefore, you can add these ports in your router instead.

The vMatrix Network Service uses both TCP and UDP ports. The broadcast port is fixed using UDP 13389, and the listen port begins with TCP 13389 and extends to at least 3 extra plus 3 for each user. For example, if there are 10 users need to connect remotely, you need to at least add ports of UDP 13389-13389, TCP 13389-13422 (13422 is the minimum and reserve more if possible).

The listen port for Remote Desktop Service itself also should be open. It uses TCP 3389.

These ports are default settings on vMatrix installation but able to be customized at vMatrix -> Configuration ->IP/TCP ports.

It is always recommended to use the latest available version of firmware on your vCloudPoint zero client. Each installation of vMatrix Server Manager includes the latest firmware, so no additional downloads are necessary to complete this process. When powered on, the zero client establishes connection with vMatrix Server Manager and asks for update if there is a new version available for update.

vCloudPoint zero clients like S100 provide two different methods to reset the device configurations:

1. Resetting custom configurations — press F2 on device boot.

This is to wipe out custom configurations such as saved username, password, resolution, background image and network, etc. This is often used for restoring desktop resolution which is out of range of the monitor to 1027×768.

2. Resetting firmware — long press the switch button until you see the resetting window.

This is to reset the device firmware to the factory installed one. All configurations will be recovered to the factory defaults. This is often used when device system turns faulty or is damaged by improper firmware upgrade.

If you purchased a non-WIFI model of vCloudPoint zero clients, but later you want to work in the wireless environment, you can turn the zero client into a WIFi supported one by simply attaching a compatible external USB antenna to the vCloudPoint zero client. There are two ways for you to get the external USB antenna.

1, You can purchase the external USB antenna from your local vCloudPoint dealer.

2, Any antenna that is built with RTL8188EUS chip and connects with USB 2.0 standard is supported by vCloudPoint zero clients.

Given blow is the specification of the external USB antenna

Connection USB2.0
Chip RTL8188EUS
Antenna External 5dBi antenna
Antenna standard IEEE 802.11g
IEEE 802.11b
IEEE 802.11n
Speed 11b:1/2/5.5/11 Mbps
11g:6/9/12/18/24/36/48/54 Mbps
11n: up to 150 Mbps
Distance up to 200 meters indoor
Frequency range 2.4~2.4835GHZ
Working channel 1~14
Security features WPA-PSK/WPA2-PSK
64/128/152bit WEP encryption
Power 2.5W

Steps to configure external WIFI:

1, attach the USB antenna to the zero client;

2, reboot the zero client;

3, go to the “Network” page and you will see the WIFI option coming. See pictures below.

(the WIFI option will automatically display on Network page once the WIFI module is detected on device boot.)

(the first picture shows the “Network” page without WIFI option, and the second one shows that with WIFI option.)

By default, theme and wallpaper customization is disabled for terminal users through remote desktop connections. Administrators can enable this option for terminal users through a few simple steps. But enabling this option will increase large resources consumption on the host.

Here are steps to enable theme and wallpaper customization on Windows:

1) for hosts running Windows Client Systems like XP, 7, 8, 8.1, 10 (Desktop Experience features of client systems are pre-installed on system installation).

Open vMatrix Server Manager, on the initial User Management page, right click on the user module and then select “Property” to enter the user’s personal settings. (If you are configuring for all users at a time, go to “Configurations” -> “Default User Settings”.)

Click on “Advanced” tag and then select “optimum” to enable all desktop experience options including wallpapers, themes, menu animations, and window content on dragging. To only enable a single desktop experience option like wallpapers or themes, you can click on a “custom” button for further customization.

Scroll down to “Desktop Options”, select the options which you like to enable, and apply.

The change will take effect on the user’s next login.

2) for hosts running Windows Server Systems like Server 2008R2, 2012, 2012R2, 2016 and Multipoint Server 2011, 2012  (Desktop Experience features for server systems are not installed on system installation).

For server systems, you have to install the Desktop Experience features before configuring at vMatrix Server Manager.

Open Windows Server Manager;

Click “Add roles and features”;

Search for Features –> Desktop Experience;

Confirm to install Desktop Experience features;

When completed, restart the system and then open vMatrix Server Manager to enable the Desktop Experience options as the same to configure for Windows Client Systems mentioned above.

Knowledge Base

Most customers mistakenly think that a zero client should be, like thin clients, configured high in its internal hardware such as, CPU, flash, network chipset, to gurantee a high performance.

Unlike thin clients that typically use its own client hardware for processing, zero clients push all the computing power to what is running at the host side. In other words, the residing hardware of a zero client do not act on jobs of processing as in PCs or thin clients, but only to initialize a conversation with the network, begin network protocol processes, and display desktop output. Therefore, the configuration of a zero client itself does not contribute to its performance. Even a zero client with powerful configuration as a Pro PC can’t gurantee good performance.

Then what helps with good performance to a zero client?

There are a few aspects:

  • Well-configured host computer– including sufficient cores and frequency of CPU,  IOPS and stroage of Disks, size and frequency of Memory. (Multi-threading technology of Intel also helps increasing CPU capability and i series with hardware acceleration performs better than Xeon series of the same level. Disks in RAID configuration increases redundancy and performance. Intensive graphics processing requires sufficient frequency of memory. Video card on the host helps in video playback only.)
  • Low latency, high-bandwidth network– recommend local-area network connections provided by standard 100 /1000 Mb/sec networks (i.e. Ethernet) between the host computers and the zero clients.
  • High efficient remote display protocol– offers high-resolution sessions, multimedia stream remoting, dynamic object compression, USB redirection, drive mapping and more.

Of the above 3 aspects, only the display protocol is determined by the zero clients. The display protocol determines two critical measures: experience and resource usage. The sticking point for many organizations will be various levels of multimedia support. Regardless of implementation status, any organization can have issues with multimedia support. This is true not only in large implementations that push bandwidth limits — even smaller installations may consume enough bandwidth to push the limits of the display protocol without a bottleneck on the wire. vCloudPoint zero clients ultilized our innovative DDP (Dynamic Desktop Protocol) for remote desktop display. This protocol is purpose-built for zero clients and is designed to make efficient use of the network bandwidth and host resources, delivering a user experience that is equivalent to or even better than a business PC.

We all know the zero clients are free of CPU, memory, processor and hardware requirements. This means that another strong factor plays a role in transmitting of the information from server to client. That is the network. And in case of zero clients, this network bandwidth should be really wide and sufficient enough for the seamless transfer of information.

Let us start with an example. S100 zero client uses Ethernet as the network connection. The deployment so far has registered recognition about its appreciable performance, which is attained with the category 5 or 6 network cable to connect to the Ethernet network. The next question is:

What is a Category-5 or Category-6 cable??

Usually, the high quality copper wires are used for Cat-5/ 6 cabling. They are twisted into 4 pairs which run along an outer cover. This design of the cable makes it immune to the other signal interferences, which means a better transmission of the data signal over the cable.

Most of the times, the poor cabling is responsible for the faulty network transmission. This very often leads to the unnecessary testing of the other equipments. There are a few very high standards tagged with the category 5 and 6 cabling, which must be followed during installation as well. This guarantees a high performance over the network.

Recommendation With Us:

For multimedia intensive environments, especially those with concurrent multiple video playback, we recommend a standard 100 /1000 Mbps network between the host computer and the zero clients, to guarantee a smooth high-end experience; as shown in the figures: (click to view large pictures)

The videos consume higher bandwidth, for example, when the server side videos are played at vCloudPoint zero clients, each 480p video file consumes up to 13 Mpbs of the network bandwidth, a 720p video can take up to 15 Mpbs of bandwidth and a 1080p video can take up to 17 Mpbs of bandwidth straight away.

Most of the Wide Area Networks (WAN) have excessive latency and lower bandwidth. This compromises with the rich PC-like experience over the network.

The ideal recommendation from vCloudPoint is a low latency higher bandwidth Local Area Network, which is the secret behind the excellent performance of zero client devices.

Based on the award-winning classroom management solution, NetSupport School, NetSupport School CCE (Centralized Computing Edition) is optimised to work within the thin/zero client arena, delivering advanced desktop monitoring combined with a real-time presentation tool at an affordable cost; helping to leverage budget-conscious education opportunities.

NetSupport School CCE enables schools, colleges and training institutions to implement the power of computing in schools more quickly and affordably than ever, and helps maximize the return on their investment by providing teachers with the ability to instruct, monitor and interact with their students either individually, or as an overall class.

Installing NetSupport School CCE for use with vMatrix Server Manager

Planning an Installation
For a Teacher to be able to connect and communicate with each student, the NetSupport School CCE Student component must be installed on the host OS.

Note: The student (client) component of NetSupport School CCE is only supported on terminal servers running Microsoft Server operating systems such as Windows Server 2008R2, 2012R2, Multipoint Server 2012. Windows Client OSs such as Windows 7, 8, 10 are not supposed to be used as the shared host system.

Installing NetSupport School
On each host that is running vMatrix Server Manager run the NetSupport School CCE installation program.
1. On the “Custom Setup” dialog choose the Student option. If you require the NetSupport School CCE Tutor to be installed in the host OS, you should also select the Tutor Console option. Alternatively, install the Tutor Console on the teacher’s computer.

2. On the Room Identification dialog enter the name of the Room that the vCloudPoint zero clients are located in, this information will be used to ensure that the teacher and students are connected to each other using NetSupport School CCE.

Configuring Student Client
From a machine with NetSupport School CCE installed please apply the below setting to the Student Configurator, otherwise only the first logged in user can be found.
1. Start the Student Configurator – Start – Programs – NetSupport School CCE – NetSupport School CCE Student Configurator.
2. Select the Terminal Services tab.
3. In the Student Name field enter %Username%.
4. Click Ok to save the configuration.

Congratulations, you have completed a basic installation of NetSupport School CCE in a vCloudPoint environment.

How to prevent Local Student users from accessing the Tutor Console

When the Students are logging on with local user account then a different method to the above would need to be used, one method for this would be to first centralise the configuration of the NetSupport School CCE Tutor Console configuration on the Server following the steps:
1.Configure NetSupport School CCE to write to the Local Machine rather than to the Current Users profile
In NetSupport School CCE 9.00 and above the location of where the Tutor Configuration is stored in the registry was changed. This change was made for Environments where Users would not have rights to write to the Local Machine, but would have rights to write to their logged on users Profile.

From NetSupport School CCE 9.02.003 and above a registry setting has been added that can be set to revert NetSupport School CCE to write to the HKEY_LOCAL_MACHINE rather than to HKEY_CURRENT_USER.
Reverting the Tutor to write its configuration to the local machine will ensure that the same configuration is then applied to any user that logs onto this machine.
For 32 bit Operating Systems please follow the below Steps:

Delete the following registry setting if present:-

Registry location: HKLM\Software\Productive Computer Insight\PCICTL\
ValueName: NSSregkey
Value: hklm
ValueType: String

Add the following registry setting:-

Registry location: HKLM\Software\Productive Computer Insight\PCICTL\
ValueName: NSSuseHKLM
Value: 1
ValueType: String
For 64 bit Operating Systems please follow the below Steps:

Delete the following registry setting if present:-

Registry location:HKEY_LOCAL_MACHINE\Software\Wow6432Node\Productive Computer Insight\PCICTL\
ValueName: NSSregkey
Value: hklm
ValueType: String

Add the following registry setting:-

Registry location: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Productive Computer Insight\PCICTL\
ValueName: NSSuseHKLM
Value: 1
ValueType: String
2.Apply a password to the Tutor Console
Once the same configuration is applied to all users logging onto the Server you can then apply a password to the Tutor Console following the steps below, this password can then be provided to the Teacher(s) providing them with access to the Tutor Console but the Student will no longer be able to start the Tutor Console as this will prompt them for a password that they will not know.

1. Logon to the Server with Admin rights and start the Tutor Console
2. Access the School drop down menu and choose Configuration…
3. Choose the Administration – Security option
4. From here you will find a Password option
5. Click the Set button to apply your required password
6. Click OK to apply the configuration.

How to prevent an AD Groups of Student users from accessing the Tutor Console

If the Student Users are all within the same AD Group then it is possible to create a new Group Policy Object that will apply to just this group and import the NetSupport School CCE Tutor Console ADM or ADMX template to this and then enable the following Policy :

Administrative Templates – NSS Tutor Settings – Security – Options – Disable Access to the Tutor Interface

When the above policy is enabled and applied to a group of users when the Users logon if they attempt to run the Tutor Console it will advise them that they do not have access to this.

In order to access and import the ADM or ADMX templates please see the below links:


View this guide in a PDF file

When a single host computer is shared by multiple users runnng vCloudPoint zero clients, how to make the most use of the host resources and support more users is the administrator’s top concern. Which media player you choose and how you use it for playing local videos has great impact on the CPU consumption of the host. GOM Player, KM Player, Potplayer, SMPlayer and Media Player Classic are some of the popular media players that customers are most likely to use. These media player have the most codecs included for supporting a large number of media formats. However,  as some of these media players do not support hardware acceleration, you may experience heavy CPU consumption when playing local videos with them.


VLC player supporting client-rendering with hardware acceleration
To help customers offload host-side cpu consumption on video playing and support more video users per host especially for cases where simutaneous video play is often required, beginning from vMatrix 2.0 version, we introduced a new feature of client-rendering support. This feature allows local videos played on the zero client with VLC player to be rendered locally by the client processor instead of the host cpu, therefore, host CPU consumption is only taken by the running the VLC player itself to as low as less than 1% of an i7 processor per video.  This feature is supported by VLC player of 2.1.5 or newer versions and works automatically after the installation of vMatrix 2.x. You just make sure you are using the correct versions of vMatrix and VLC player and VLC player is selected to play the video, then you are ready to “save”.

Note: As the media content is not rendered at the host side, there is a drawback of using this feature: media content within the VLC player cannot be viewed by the administrator through monitoring at the host side.


Use K-lite codec pack with Media Player Classic supporting host-rendering with hardware acceleration

When using MPC (media player classic) for playing videos on the zero clients, although the rendering job still is done by the host CPU and the consumption is higher than using VLC player, as MPC supports hardware decoding, the host CPU consumption is greatly reduced, to as low as 1/2 of using other players without hardware acceleration.

Beblow is the download link and configuration steps:

1. download K-lite standard codec pack at The Media Player Classic is bundled.

2. install the K-lite pack on the host. The Media Player Classic is integrated so you don’t have to install it separately.

3. Open “Codec Tweak Tool” at “Start” menu–>”K-Lite Codec Pack” or “Tools” at the installation file.

4. Click on “DirectShow (x86)” if you are Windows system is 32 bits, or “DirectShow (x64) if 64 bits.

5. On the next popup window, select “Video: LAV Video Decoder”, and apply.

After it is applied, “LAV Video Decoder” goes to “DISABLED FILTERS” as below:

6. Open the Media Player Classic, go to “View”-”Options”-”Playback”-”Output”, select the “DirectShow Video” option. And all configuartions complete.

To add users to the Remote Desktop Users group

    • Open Computer Management.
    • In the console tree, click the Local Users and Groups node.
    • In the details pane, double-click the Groups folder.
    • Double-click Remote Desktop Users, and then click Add….
    • On the Select Users dialog box, click Locations… to specify the search location
    • Click Object Types… to specify the types of objects you want to search for.
  • Click Check Names; When the name is located, click OK.

Notes: By default, the Remote Desktop Users group is not populated. You must decide which users and groups should have permission to log on remotely, and then manually add them to the group. (Particularly with vCloudPoint: Users created with vMatrix Server Manager are automatically added to the Remote Desktop users group, but if the users are not created with vMatrix Server Manager, e.g., users created in Windows Control Panel or on domain, and they are non-administrators, then you have to manually added to the Remote Desktop users group. )

To open Computer Management, click Start, click Control Panel, double-click Administrative Tools, and then double-click Computer Management.

Article source:

How to Restrict Users from Running Specific Windows Programs

There are many ways to restrict remote desktop users from running specific windows programs. Using paid third-party software or applications is the simplest way. Administrators can also achieve by using Windows  Group Policy or editing the registry.

Belows are two methods quoted from, using Administrative Templates in Group Policy and editing the Registry. Alternatively, you can use Software Restriction Policy or App Locker under Application Control Policy in Group Policy.
Method 1: How to Restrict Users from Running Specific Windows Programs by Using Group Policy

To use Group Policy Object Editor to restrict users from running specific Windows programs, use the procedure that is described in the section that is appropriate to your situation.

Editing the Local Policy

To restrict users from running specific Windows programs on a standalone Windows -based computer:

  • Click Start, and then click Run.
  • In the Open box, type gpedit.msc, and then click OK.
  • Expand User Configuration, expand Administrative Templates, and then expand System.
  • In the right pane, double-click Don’t run specified Windows applications.
  • Click Enabled, and then click Show.
  • Click Add, and then type the executable file name of the program that you want to restrict users from running. For example, type iexplore.exe.
  • Click OK, click OK, and then click OK.NOTE: If domain-level policy settings are defined, they may override this local policy setting.
  • Quit Group Policy Object Editor.
  • Restart the computer.

Editing the Group Policy in a Domain

To edit a domain-wide policy to restrict users from running specific Windows programs:

  • Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  • Right-click your domain, and then click Properties.
  • Click the Group Policy tab.
  • In the Group Policy Object Links box, click the group policy to which you want to apply this setting. For example, click Default Domain Policy.
  • Click Edit.
  • Expand User Configuration, expand Administrative Templates, and then expand System.
  • In the right pane, double-click Don’t run specified Windows applications.
  • Click Enabled, and then click Show.
  • Click Add, and then type the executable file name of the program that you want to restrict users from running. For example, type iexplore.exe.
  • Click OK, click OK, and then click OK.
  • Quit Group Policy Object Editor, and then click OK.NOTE: Group Policy changes are not immediately enforced. For more information, see the Troubleshooting section.

Method2: How to Restrict Users from Running Specific Windows Programs by Editing the Registry
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: 322756 How to back up and restore the registry in Window.

To restrict users from running specific Windows programs by editing the registry, follow these steps:

  • Click Start, and then click Run.
  • In the Open box, type regedit, and then click OK.
  • Create a DWORD value named DisallowRun. To do so:
  • Locate and then click the following registry key:
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion \Policies\Explorer
  • On the Edit menu, point to New, and then click DWORD Value.
  • Type disallowrun, and then press ENTER.
  • Double-click the DisallowRun value that you created in the previous step.
  • Type 1 in the Value data box, and then click OK.
  • Create a new HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion \Policies\Explorer\DisallowRun subkey. To do so:
  • Right-click the following registry key, point to New, and then click Key:
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion \Policies\Explorer
  • Type disallowrun, and then press ENTER.
  • For each program that you want to prevent users from running, create a new string value in the DisallowRun subkey that you created in step 4. Use consecutive numbers to name the string values (starting with 1), and use the executable file name for the program as the data for the string value.For example, if you want to restrict users from running Microsoft Internet Explorer:
  • Right-click the following registry key, point to New, and then click String Value:
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion \Policies\Explorer\DisallowRun
  • Type 1, and then press ENTER.
  • Double-click the 1 value that you created in the previous step.
  • Type iexplore.exe in the Value data box, and then click OK.
  • Quit Registry Editor, and then restart the computer.


Group Policy background processing can take up to 5 minutes to be refreshed on domain controllers and up to 120 minutes to be refreshed on client computers. To force background processing of Group Policy settings, use the Secedit.exe tool:

  • Click Start, and then click Run.
  • In the Open box, type cmd, and then click OK.
  • Type secedit /refreshpolicy user_policy /enforce, and then press ENTER.
  • Type secedit /refreshpolicy machine_policy /enforce, and then press ENTER.
  • Type exit, and then press ENTER to quit the command prompt.

On Windows 8 or later systems, remote desktop users are not able to shutdown the host. But for Windows 7 and realier systems, the shot shutdow option is available to remote desktop users. Below is the guide to preventing zero clients users from shutting down the host.

      1. on the host, open the security setting console through Control Panel — Management Tools — Local Security Settings  — Security Setting —- Local — User’s right assignment — Shutdown Operation system


      1. 1. delete users or groups that are not allow to shutdown host.