1. Create a new group of managed devices. All created device objects for Virtual Desktops will move to it.
2. Exclude the administration group from all inherited tasks: Find Vulnerabilities and Window Updates task and Fix Vulnerabilities and required Updates task.

Network Agent Policy

1. Create a Network Agent policy.
2. Go to the Repositories tab. Clear all selected options and lock them:
   • Details of Windows Update updates
   • Details of software vulnerabilities and corresponding updates
   • Hardware registry details
   • Details of installed applications

3. Go to Software updates and vulnerabilities.
4. Select Disabled for the Windows Update search mode setting and lock it.
5. Clear the Scan executable files for vulnerabilities when running them check box and lock the setting.

Secure Virtual Machine Policy

1. Create a Secure Virtual Machine policy in the group of managed computers where SVMs are located.
2. Open Update settings and clear the Update Application Modules check box. Close the lock.

3. Go to Settings for connecting SVMs to the Integration Server and specify the IP address (or FQND) of the machine with the Integration Server (the IP address of the Administration Server). Close the lock.

4. Verify that the policy is applied on the Secure Virtual Machines.

Windows Light Agent Policy

1. Create the policy for the Light Agent for Windows.
2. Open the policy properties and go to Anti-Virus protection → General Protection Settings.
3. In the Exclusions and trusted applications section, click Settings.
4. If the VDI infrastructure is used in a Citrix environment, enable exclusions and trusted applications for Citrix Virtual Apps and Desktops (Citrix XenApp and XenDesktop), Citrix Provisioning (Citrix Provisioning Services), Citrix Profile Manager.
   
   If they're not in the list, create a new policy and add them at the Exclusions step.
5. If the VDI infrastructure is used in a VMware environment, enable exclusions and trusted applications for VMware Tools and VMware Horizon View. If they're not in the list, create a new policy and add them at the Exclusions step.
6. If roaming user profiles are used, specify the path of the network folder where the profiles are located to avoid scanning on both a network and local level.
7. Go to the SVM discovery settings section. Make sure that Use Integration Server is selected and that the lock is closed.

8. Go to Integration Server connection settings.
9. Specify the IP address (or FQDN) of the machine where Integration Server is installed (the IP address of the Administration Server). Close the lock.

1. Launch local installation of Kaspersky Network Agent on the golden image.
2. At the Advanced settings step, clear the Automatically install applicable updates and patches for components that have the Undefined status check box.
3. Select the Enable dynamic mode for VDI. and Optimize the Kaspersky Security Center Network Agent settings for the virtual infrastructure check boxes.

4. Wait until the installation of the Network Agent finishes. Open the Services snap-in (services.msc) and launch the Network Agent service manually.
5. Launch the local installation of Kaspersky Security for Virtualization Light Agent on the golden image:
   • If you are using Citrix XenDesktop, select the Ensure compatibility with Citrix Provisioning (Citrix Provisioning Services) and Installation on the template for temporary VDI pools check boxes.
   • If you are using VMware Horizon View, select the checkbox Installation on the template for temporary VDI pools.

If the Installation on the template for temporary VDI pools check box is selected, updates that require a protected virtual machine to restart will not be installed on the virtual machines deployed using this template. At the same time, Kaspersky Security Center will send messages that database and application modules updates are required on the template.

What to do after the installation

1. Verify that the Windows Light Agent policy has been applied.
   
   If the policy does not apply to a gold image device, check the location of the device in the administration groups and configure to automatically move devices to managed groups.
2. Open the Support window locally in the interface of the Light Agent for Windows. Verify that the Light Agent is connected to the SVM.
3. Restart the golden image device.
4. Sign in to the system once it has restarted.
5. Shut down the golden Image.

You can now deploy VDI machines from this golden image.