Troubleshooting VMware Horizon USB Redirection Issues Across Different Subnets

Troubleshooting VMware Horizon USB Redirection Issues Across Different Subnets

Troubleshooting VMware Horizon USB Redirection Failure Across Different IP Subnets

Published on | Category: Virtualization & Networking

When connecting to a VMware Horizon Virtual Desktop Infrastructure (VDI) from multiple locations, you might encounter an issue where USB Redirection works seamlessly in Location A but fails completely in Location B. If the primary difference between these locations is the PC's IP address subnet, the issue almost certainly points to blocked network ports, disabled client services, or location-based group policies.

Here is a breakdown of why this happens and a step-by-step guide to resolving the issue.

Common Causes for Location-Based USB Redirection Failures

  • Port 32111 Blocked: TCP/UDP port 32111 is the standard port required for USB redirection between the Horizon Client and the virtual desktop/Connection Server. Local firewalls or network switches on specific subnets often block this port.
  • Disabled Client USB Service: The VMware Horizon Client USB Service on the local machine might be stopped, uninstalled, or blocked by local Endpoint Detection and Response (EDR) software.
  • Horizon Smart Policies / GPO Restrictions: VMware Horizon administrators often configure location-based policies that automatically disable USB access when a user connects from specific IP ranges (e.g., remote or guest subnets).

Step-by-Step Solutions

Fix 1: Verify and Open Port 32111

First, test whether the network port is open from the client PC where USB fails.

  1. Open PowerShell on the client PC.
  2. Run the following command (replace <Server_IP_or_FQDN> with your Horizon Connection Server or Agent IP): 
    Test-NetConnection -ComputerName <Server_IP_or_FQDN> -Port 32111
  3. Check the output for TcpTestSucceeded:
    • True: The port is open. Move to Fix 2.
    • False: The network firewall or ACL on that subnet is blocking port 32111. You must request your network administrator to allow traffic over TCP/UDP 32111 for that IP range.

Fix 2: Check Client-Side VMware USB Service

Ensure the USB component is installed and running on the endpoint machine.

  1. Press Win + R, type services.msc, and press Enter.
  2. Locate VMware Horizon Client USB Service.
  3. Verify that the Status is set to Running and Startup type is set to Automatic.
  4. If the service is missing, rerun the VMware Horizon Client installer, select Modify, and ensure the USB Redirection feature is explicitly checked.

Fix 3: Review Horizon GPO & Smart Policies

If you have administrator access to the VMware Horizon environment:

  1. Open Group Policy Management on your Active Directory Domain Controller.
  2. Check policies assigned under VMware Horizon Agent Configuration > Device Redirection > USB Redirection.
  3. Verify if DEM (Dynamic Environment Manager) or Smart Policies are configured to disable USB redirection based on the client's IP subnet condition. Adjust the policy to permit access for the affected subnet if authorized.

Conclusion

If VMware Horizon USB redirection works in one IP range but fails in another, a firewall blocking TCP/UDP 32111 is the culprit in over 80% of cases. Running a quick PowerShell connection test will save you hours of troubleshooting. If the port is open, verify the local client service and consult your system administrator regarding location-based Horizon policies.

© 2026 Tech Troubleshooting Blog. All rights reserved.

Comments

Post a Comment

Popular posts from this blog

Troubleshooting VMware Horizon Client vdpConnect_Failure Issue

  Introduction VMware Horizon Client is a widely used solution for virtual desktop infrastructure (VDI). However, users may encounter various connection issues, one of which is the vdpConnect_Failure error. This error often results in a black screen followed by a disconnection, preventing users from accessing their virtual desktop. In this article, we will explore the possible causes of this issue and provide step-by-step solutions to resolve it. Common Causes of vdpConnect_Failure 1. RPC Server Unavailable One of the most common reasons for vdpConnect_Failure is the unavailability of the Remote Procedure Call (RPC) server . This can occur due to: The RPC service being stopped or disabled Network issues preventing communication with the server Firewall blocking required ports 2. Display Protocol Issues (Blast/PCoIP/RDP) Horizon Client uses different display protocols such as Blast, PCoIP, or RDP . If there are misconfigurations or compatibility issues with the selected protocol, ...
Read more

VMware / Omnissa Horizon Agent Unreachable – Causes and Fixes (Complete Troubleshooting Guide)

  Keywords: VMware Horizon Agent Unreachable, Omnissa Horizon Agent unreachable, Horizon View troubleshooting, Blast service issue, Horizon Agent not responding, VDI connectivity problem In VMware Horizon (now branded as Omnissa Horizon ), administrators frequently encounter the “Agent Unreachable” state in the Horizon Console. While a simple reboot often resolves the issue, persistent cases indicate deeper infrastructure, service, or network-layer problems. This guide provides a structured root-cause analysis and remediation checklist suitable for production VDI environments. What Does “Agent Unreachable” Mean? When a desktop shows Agent Unreachable , the Horizon Agent inside the VM cannot communicate with the Connection Server . The failure typically occurs in one of these control paths: Horizon Agent → Horizon Connection Server Blast Secure Gateway (BSG) → Agent Windows OS services → Horizon Agent service Firewall or network layer blocking agent heartbeat ...
Read more

VMware Horizon Agent “Protocol Error” — Fixed by Windows Firewall Configuration

  🖥️ VMware Horizon Agent “Protocol Error” — Fixed by Windows Firewall Configuration Overview Recently, I encountered an issue where several Horizon Agent–based virtual desktops in our environment showed the status “Starting other services” or “Protocol Error” in the Horizon Administrator console. Even after reinstalling the Agent (version 2206 ), the problem persisted. Symptoms Horizon Agent status: “Starting other services” → “Protocol error” Horizon main services appeared to be running normally Event Viewer showed Event ID 7000 for services such as: PASVC – failed to start LUFAV – not installed Reinstalling the Agent (even using Repair mode ) did not solve the issue Root Cause After deeper inspection, we discovered that on the affected VMs: Windows Defender Firewall (Domain Profile) → “Block all incoming connections, including those in the list of allowed apps” was checked (enabled). This setting silently blocks all inbound traffic , ev...
Read more