The preferred method of downloading and installing Parallels Client for Windows is via an invitation email as described in the previous section. If you would like to download and run the installer manually, visit https://www.parallels.com/products/ras/download/client.

To install Parallels Client for Windows:

1. Run the Parallels Client installer that you've downloaded from the Parallels website and follow the onscreen instructions to being the installation.

2. If you don't have administrative permissions on this computer, a dialog will open saying so. The dialog has two buttons: Install Full Client and Install Basic Client. If you know credentials of an administrative account on this computer, click Install Full Client and enter the credentials when asked. The installation will continue using these credentials and the full version of Parallels Client will be installed. If you don't know the credentials, click Install Basic Client. The basic version of Parallels Client will still work but some of the functionality will be missing.

1. On the Shortcuts page, select where you want to create a Parallels Client shortcut. You can select one or more options.

2. The SSO Installation page will be skipped when installing Parallels Client on a Windows Server operating system. On all other supported versions of Windows, it will be shown. Use the page to specify whether you want to install the Single Sign-On component. The component will automatically use your credentials to connect to Parallels RAS. Please note that for the component to work, you will need to reboot your computer (or log off and then log on again) after the installation.

3. Click Next.

4. On the Ready to Install page, click Install.

5. When the installation is complete, click Finish to close the wizard and start Parallels Client for Windows.

After you manually install Parallels Client and run it for the first time, you'll be asked if you would like to configure a new connection. Click Yes. This will open the New connection dialog.

Your system administrator should give you the connection information that must be specified in this dialog. If you received an invitation email from your administrator, you can find this information at the bottom of the message. The information will look similar to the following:

To manually configure the RAS Connection, use the following settings: Server: 192.168.1.10 Port: 443 Connection Mode: Gateway SSL Mode

To connect to Parallels RAS:

1. Enter the Parallels RAS IP address, its hostname (this should be the server where the RAS Secure Gateway resides), or your work email address. You system administrator should tell you what to use.

2. Click Next.

3. In the Connection mode field, select one of the following options (note that you should use the mode that your system administrator has asked you to use):

   • Direct Mode. Parallels Client first connects to the RAS Secure Gateway for the best available terminal server and then connects directly to that server. This is best used when the Parallels Client and the terminal server reside on the same network.

   • Direct SSL Mode. Same as the direct mode above, but uses encryption to secure the data.

   • Gateway Mode. Parallels Client connects to the RAS Secure Gateway and the session connection is tunneled through the first available connection. This mode is ideal for servers that are only reachable via the gateway and do not require a high level of security.

   • Gateway SSL Mode. Same as the gateway mode above, but uses encryption to secure the data.

4. In the Friendly name field, choose and type a friendly name for this connection.

5. If your system administrator instructed you to specify the port number, do the following:

   1. Click the Advanced settings link. The Connection Properties dialog opens (see the screenshot below).

   2. Specify the port number in the Port field.

   3. You can also review and modify other properties if you wish. More on these later in this guide.

   4. The [...] button next to the Primary Connection field allows you to select a Parallels RAS server (this will only work if the Broadcast RAS Secure Gateway Address option has been enabled on the server side).
6. Click OK. The Log in dialog opens.
7. In the Authentication type drop-down list, select the desired method of authentication:

   • Credentials. Select this option and then enter your username and password. You will be authenticated on the remote server using the specified credentials.

   • Web: Select this option to use the SAML SSO authentication.

   • Smart Card. Select this option to authenticate using a smart card. When connecting to the remote server, insert a smart card into the card reader and then enter a PIN when prompted.

   • Single Sign-On. This option will be included in the list only if the Single Sign-On module is installed during Parallels Client installation. Select this option to use local system credentials to connect to the remote server.

   • Web + Credentials. The same as Web, but you will be prompted to enter credentials when you launch a published application.

1. Click Connect.

2. This step may, or may not, appear depending on whether the two-factor authentication using the Google Authenticator app is configured in Parallels RAS by the administrator. If Parallels RAS is configured to use Google Authenticator, you will need to take additional steps. First you need to install the Google Authenticator app on your mobile device. When you click Connect in Parallels Client, you'll see a dialog displaying a barcode (also known as QR code) and a secret key. Scan the code (or enter the secret key) into the Authenticator app. The app will generate a one time password. Click Next in Parallels Client and enter the one time password in the OTP field. Click Connect. On every subsequent logon, you'll only have to enter the OTP. For step-by-step instructions, see the Using Google Authenticator subsection below.

3. If the connection is successful, you'll see the main Parallels Client window where your connection(s) and published resources are displayed.

Using Google Authenticator

Use the following instructions when you see the multi-factor authentication dialog during the login procedure. The dialog is displayed when your IT administrator configures two-factor authentication using the Google Authenticator app.

Important: To use Google Authenticator, the time on your computer must be synchronized with a global NTP time server, such as time.google.com. Otherwise, Google authentication will fail.

To use Google Authenticator, you need to install the Authenticator app on your iOS or Android device. Simply visit Google Play or App Store and install the app. Once the Authenticator app is installed, you are ready to connect to Parallels RAS using two-factor authentication.

To connect to Parallels RAS:

1. Opens Parallels Client and log in using your credentials.

2. The multi-factor authentication dialog opens displaying a barcode (also known as QR code) and a secret key.

3. Open the Google Authenticator app on your mobile device:

   • If this is the first time you use it, tap Begin and then tap Scan a barcode.

   • If you already have another account in Google Authenticator, tap the plus-sign icon and choose Scan a barcode.

4. Go back to your computer and scan the barcode displayed in the Parallels Client login dialog.

   If scanning doesn't work for any reason, go back in the Authenticator app, choose Enter a provided key and then enter the account name and the key displayed in the Parallels Client login dialog.

5. Tap Add account. This will create an account for your RAS connection and display a one time password.

6. Go back to Parallels Client, click Next and enter the one time password in the OTP field.

On every subsequent logon, you only need to type your credentials (or nothing at all if the Save password options was selected) and enter a one time password obtained from the Google Authenticator app (the app will continually generate a new password). Please note that your IT administrator has an ability to reset user accounts in Google Authenticator. If your account is reset, you'll need to repeat the registration procedure described above.

The Parallels Client for Windows installer uses the MSI format. This enables you to deploy it remotely using Group Policies or any other deployment tool that can work with MSI installers.

There are two ways to modify the client installation settings:

• Modify the original file using Orca.exe.

• Run the installer from the command line: msiexec.exe /i RASClient.msi (or RASClient-x64.msi if using a 64-bit version)

Silent Install

To perform a silent install, run the following command:

msiexec.exe /qn /i RASClient.msi

In the command above, specify RASClient-x64.msi if using a 64-bit version of Parallels Client for Windows.

General Settings

When running an installation command specified above, you can pass the following properties to msiexec.exe using the PROPERTY=VALUE notation:

DEFSETTINGS: To use when Parallels Client installer reads 2xsetting.2xc (the file containing all settings to be used by the client) as default settings.

DEFSETTXML: To use when XML settings are entered manually.

OVERRIDEUSERSETTINGS: To override the user settings with client MSI settings.

• 0 – Client settings are not overridden

• 1 – Client settings are overridden with the new settings of the Client MSI setup.

DISABLEOPTIONS: To disable the Options button and hide the options to configure the client settings. This option can be applied to users without administrative rights.

• 0 – Options are enabled

• 1 – Options are disabled

DISABLEOPTIONSADMIN: To disable the Options button and hide the options to configure the client settings. This option can be applied to users with administrative rights.

DISABLESAVEPASSWORDADMIN: To disable the clients from saving the password even if they have administrative rights.

• 0 – Option to save password is enabled

• 1 – Option to save Password is disabled

DISABLESAVEPASSWORD: To disable the clients from saving the password. This option is ignored with users with administrative rights.

• 0 – Option to save password is enabled

• 1 – Option to save Password is disabled

INSTALLSSO: Exclude/Include SSO during silent installation.

• 1 - Install SSO. ADDLOCAL=F_SSO is also required, as in ADDLOCAL=F_SSO INSTALLSSO=1

• 0 - Exclude SSO

IGNORESETTCREDS: Controls the usage of credentials that are available in the .2xc file (available since builds 16.2.4.19490 and 16.5.1).

• 0 - Connections imported from a .2xc file will use the credentials that are stored in the .2xc file (if any).

• 1 - Credentials in the .2xc file are ignored (this is the default).

The IGNORESETTCREDS option above allows you to automatically add preconfigured RAS connection settings when you install Parallels Client. To do so:

1. First install Parallels Client on some computer and configure the desired connection(s). Set a password for the connections and select Save Password.

2. Export the client settings to a file.

3. When performing a clean Parallels Client installation on a user's computer, use the following command line parameters:

   DEFSETTINGS=<2xc file> IGNORESETTCREDS=0

   where <2xc file> is the name of file that you exported in step 2.

4. After the installation, the imported connection settings become available in Parallels Client for all users of a given computer.

SHAREDDEVICE: Creates a shared RAS connection for all users on a device. To use this command, you must have administrative privileges.

The command has the following format:

msiexec.exe /qn /i RASClient.msi SHAREDDEVICE="mode:settingsstring"

In the command above, the mode option can have the following values:

• 0 - Deletes the shared connection. When this value is used, settingsstring must be empty, as in "0:".

• 1 - Creates a shared connection. In this mode, an IT administrator configures the authentication type for the connection, and users authenticate using the selected type.

• 2 - Creates a shared connection with shared credentials. In this mode, an IT administrator configures the credentials for the connection, and users authenticate automatically without providing them.

The settingsstring option can have the following values:

• ui - Brings up the UI to enter the shared connection properties.

• import - Imports shared connection properties from a .xml file created with the "export" command (below). Format: "1:import:c:\my data\my file.xml".

• export - Exports share connection properties so that can be imported on another device with the "import" command (above). Format: "1:export:c:\my data\my file.xml".

Using Active Directory

There are two different ways that you can deploy an application through Active Directory. You can either publish the application or you can assign the application.

You can publish applications to users only, but you can assign applications to either users or computers. The applications are deployed in different ways, depending on which method you decide to use.

Parallels recommends that administrators assign the applications to COMPUTERS. The main reason is that the application is actually installed the next time the computer reboots.

When assigning to users, the application is not installed until the user actually clicks on the icons created for the application.

To assign an application to certain computers, simply do the following in Active Directory:

1. Open the Group Policy Editor.

2. To assign an application to a computer, navigate through the group policy console to Computer Configuration / Software Settings / Software Installation. Right-click the Software Installation container and click New > Package in the context menu. Select the appropriate MSI file and click Open. You are now asked whether you want to publish or assign the application. Select Assign and click OK.

Please note that when doing a silent installation, the MSI can be deployed using the following syntax (for the 64-bit version, use RASClient-x64.msi):

msiexec /qn /i RASClient.msi

Example

The following example installs Parallels Client using the DISABLESAVEPASSWORD=0 option (enable the ability to save the password):

msiexec /qn /i 2XClient.msi DISABLESAVEPASSWORD=0