VDI Challenges: Why On-Premises Virtual Desktops Get Hard to Run

VDI challenges come from the work of running the estate yourself, while the idea of virtual desktops itself holds up. VDI (virtual desktop infrastructure) means company desktops run as virtual machines on central servers and staff open them over the network. Six areas of work grow with it: peak sizing, storage and login storms, image and patch upkeep, hardware refresh, support load, and security and audit duties.

This article lists virtual desktop infrastructure problems that build up in on-premises estates, for an IT head or infrastructure manager in India or the GCC. Use it to place your own estate against the six areas and decide which ones weigh on your team. It is not a troubleshooting guide, it gives no set-up steps, and it quotes no prices. For the build steps, see the order for building desktops that run in the cloud.

VDI Challenges Start With Sizing for the Peak

Capacity for a desktop estate is bought for the busiest window of the day. Everything else in this article sits on top of that first purchase.

Hosts Bought for the Busiest Hour

A host is a physical server that runs many desktops at once. You size the hosts for the moment when the highest number of people are signed in, which for many firms is the start of a shift or a month-end close. A bank branch network, a call center or a finance team each has its own sharp peak.

Under-sizing and over-sizing both cost money. If you buy too little, users meet slow desktops at the busy hour and the trouble shows up months after go-live. If you buy enough for the peak, that capacity sits idle out of hours, and the spend lands at the time of purchase, long before you know the real pattern.

A common approach is to test with real users and plan for peak demand. That is sound, yet a test does not show next year’s headcount or a new application. The sizing question tends to return each time the user count or the application mix changes. This article gives no sizing figures, since they depend on the workload.

Storage and the Login Storm

A login storm is many users signing in within the same short window. Each sign-in loads a profile, applies policies and starts scans, and all of it lands on the same shared storage together.

Boot storms, antivirus scans, updates and backups all add load to shared storage, so a desktop can feel slow even when the host has spare processor and memory. In Signisys’s working view, storage is a place where sizing errors can show up early, because it serves every desktop at once.

These points describe causes, and the fixes belong to a different article. For a decision maker, the busiest hour hits storage and hosts together. Storage that looked adequate on a quiet test day can also be the first thing users complain about.

On-Premises VDI Challenges in Daily Upkeep

The work goes on after go-live. Three kinds of upkeep repeat every month: the desktop image, the hardware and the people who support both.

Image and Patch Upkeep

A golden image is the master desktop copy that new desktops are built from. Each patch means testing it in the image, pushing it out, and keeping a way to roll it back.

That work takes time, and where staff are short, updates can get deferred. A deferred update leaves the estate behind on patches, which is a security gap as well as a support cost.

The upkeep covers every layer. NIST’s guide to security for full virtualization, published in January 2011, asks organizations to secure all elements of a full virtualization solution and maintain their security. It names the layers from the hypervisor and host operating system to guest operating systems, applications and storage. A firm that runs the estate itself owns every one of those layers.

Hardware and Host Refresh

Servers, storage, network gear and client devices each carry their own support date. They rarely run out together, so refresh work comes in several waves instead of one project. The client devices that open the desktops are endpoints in their own right, and fifteen pass or fail checks for company devices test their inventory, patch status and remote wipe.

Fault tolerance adds to the list. Because one failed host can take down many desktops, teams keep spare hardware, and spare hardware is bought and replaced too. Support for older equipment may also cost more, so check the support terms for each item.

Each refresh also reopens the sizing question from the first section. A firm that replaces hosts must again guess the peak, so a hardware quote is a good moment to ask whether the estate still fits the firm. This article gives no refresh cycle length, since it varies with the equipment and the support contract.

The Support Load on a Small Team

A desktop estate has many layers, and each needs its own skills: hosts, storage, network, connection servers and images. A small infrastructure team may have only one or two people who know the whole stack.

The reach of an error adds to the load. One mistake in an image or in storage can affect many desktops at once, so a fault that would be a single ticket on a laptop becomes an incident.

Support evidence is another gap. Where desktops reset to the base image at sign-out, the session that showed the fault may be gone by the time the ticket arrives. The support person then has to reproduce the problem.

The Security and Audit Burden of Running the Estate

Running the estate yourself means you also carry its security and audit work: management access, stored images, and logs that someone must keep and show.

NIST’s guide asks you to restrict and protect administrator access to the virtualization solution. The same guide notes that images and snapshots hold sensitive data and are easier to move than a hard drive. For that reason, a self-run estate needs a rule for who can copy, store and delete images. To test whether those rules hold, see a check by check review of how virtual desktops are locked down.

India’s national response team, CERT-In, set out a log duty in its 28 April 2022 cyber security directions. Covered organizations must switch on logging across their ICT systems and keep the records for a rolling 180 days, stored securely within Indian jurisdiction. The directions also ask that system clocks sync to the time servers of the National Informatics Centre or the National Physical Laboratory, or to servers traceable to them. A set of listed cyber incident types must be reported within 6 hours of noticing them. The directions name service providers, intermediaries, data centers, body corporates and government organizations as covered.

The GCC has its own national rules. Check your country’s regulator, since this article does not cover them. Scoring the platform’s own controls is a separate topic, and it is not part of this article.

VDI Challenges Users Notice First

Users do not report burden areas. Instead, they report symptoms, and the table maps four common ones to the area they point to and the person on your team to ask first.

The first answer is a conversation with the right owner. The same VDI challenges appear in the help desk queue before they appear in a review, so the queue is a good place to look for them.

Remote staff add to the lag point, and the gaps that open when staff sign in from home sit beside the distance problem described here.

None of this is a fix list. Each row only points to where to look first.

Signs the Estate Has Outgrown On-Premises Operation

An estate has outgrown on-premises operation when the work of keeping it running grows faster than the value it gives the firm. Five signs show it:

1. A host or storage refresh quote is due, and the question of buying for the peak again is open.
2. Capacity added for peaks sits idle out of hours.
3. Image and patch updates are being deferred.
4. Tickets escalate to one or two specialists every time.
5. An audit asks for logs or access records that the estate does not keep.

One or two signs can appear in any estate.

Three kinds of next step exist, and this article does not rank them. First, you can keep the estate and invest in it, with a plan for the six areas. Second, you can move to desktops run from a cloud data center, where a provider runs the hosts and storage. Or you can run a mixed estate, with some user groups on each side. The right choice depends on your users, your data rules and your team. For the two models set against each other, see how running desktops yourself and buying them as a service differ.

Disclosure: Signisys sells digital workplace and endpoint management work as well as end-user computing services, so a consultation is not neutral advice. It is a review of your estate’s sizing, storage, image upkeep, refresh dates, support load and log keeping. It promises no result or saving. No charge, with a fixed scope.

VDI Challenges FAQ: Questions From IT Leads