This chapter describes features that are specific to Parallels Desktop for Mac Enterprise Edition.

Beginning with Parallels Desktop 16 for Mac Business Edition, IT administrators have an option to provision a corporate Parallels Desktop virtual machine image from a link that they specify in Parallels My Account.

Here's a quick overview of how this functionality works:

1. An administrator first creates a Parallels virtual machine image with the operating system installed. The virtual machine will serve as a corporate VM image to be deployed on users' computers to run Windows applications used in the organization.

2. The virtual machine is then saved as an archive (ZIP or PVMP, we'll talk about archive formats later) and is placed on a server from which Parallels Desktop users can download it to their computers via HTTP or HTTPS.

3. The administrator creates a configuration profile in Parallels My Account and specifies the download URL of the virtual machine image (together with other required parameters).

4. When a Parallels Desktop user initiates the process of creating a new virtual machine, Parallels Desktop checks if a configuration profile with the VM image link exists and is applicable to the Parallels Desktop license key used by this Mac computer. If the profile exists, a dialog is shown to the user, inviting them to download and install the corporate virtual machine image. If the user accepts, the virtual machine is downloaded to the user's computer and is registered in Parallels Desktop.

The subsequent sections describe how to perform the steps above.

The corporate VM image policy is checked every time a new VM creation process is started by the user in Parallels Desktop on a Mac computer. If the corporate VM image policy is set (a configuration profile with the VM for Intel Mac or VM for M-series Mac payload exists and has been applied to the license key used by this Parallels Desktop installation), the Parallels Desktop Control Center displays a message inviting the user to download the corporate VM image. If the user accepts the invitation, the VM image download begins and the progress indicator is displayed (note that because of the large size of a VM, the download may take some time). If the user declines, he/she is taken to the Installation Assistant where they can create a virtual machine from scratch.

After the VM image download completes, the image is unpacked, and the virtual machine is registered in Parallels Desktop.

In Parallels Desktop for Mac Business and Enterprise Editions, configuration profiles are sets of parameters that can be applied remotely to a Parallels Desktop installation. Configuration profiles can be used to enable and configure the following functionality in Parallels Desktop for Mac Business Edition:

• Provisioning a corporate virtual machine image

• Enabling major version upgrades

Configuration profiles are created in an organization's Parallels business account. You must be the administrator of the account to create and manage configuration profiles. License administrators (admins who are allowed to manage specific licenses) cannot manage configuration profiles.

Configuration Profile Payloads

Payloads in a configuration profile contain settings specific to a particular functionality. For example, the VM for Apple Silicon Mac and the VM for Intel Mac payloads allow you to configure virtual machine image provisioning, while the Product Updates payload allows you to manage Parallels Desktop updates. The configuration profile itself is created and configured the same way, regardless of which of its payloads are configured and enabled.

A configuration profile can have one or more payloads configured and enabled. For example, you can configure and enable a particular payload in one profile and a different payload in another profile. This allows you to enable one functionality for one group of users and another functionality for a different group (see below how configuration profiles are applied to Mac computers). You can create as many profiles as necessary.

Applying Configuration Profiles to Mac Computers

Configuration profiles are applied to registered Mac computers based on a license or sublicense key that computers are using to run Parallels Desktop. After you create a configuration profile, you need to apply it to one or more license or sublicense keys in your subscription. By doing so, you are essentially applying the profile to Mac computers on which Parallels Desktop was activated using that license key.

The rest of this part of the guide describes how to:

• Create a configuration profile

• Apply the configuration profile to a license or sublicense key

• Configure individual payloads

Prior to Parallels Desktop 16, users were not automatically upgraded to the next major Parallels Desktop version. Starting with version 16, this option became available.

In the past, to upgrade Parallels Desktop for Mac Business Edition to a newer version, an IT administrator would need to set up a local update server or use a remote management tool or install the new version manually on a Mac computer. With this new option, administrators have the ability to automate major version upgrades if the organization policy allows it.

Here's a quick overview of how this feature works:

1. You create a configuration profile in Parallels My Account and configure the Product Updates payload where you enable or disable the "Allow upgrade..." option.

2. You then apply the configuration profile to a license or sublicense key.

3. Parallels Desktop periodically checks if a new major version is available. If it is, depending on how updates are configured in Parallels Desktop, the user will see a notification (with an option to upgrade or postpone), or the upgrade will be performed silently. When the upgrade is initiated, the new major version of Parallels Desktop is downloaded to the Mac computer and installed on it. After that, Parallels Desktop restarts, completing the upgrade.

The subsequent topics describe in detail how to configure and use the major version upgrade functionality.

Asset tags help identify, control, and track computer assets in an organization. Parallels Desktop for Mac Business Edition provides the ability to set an asset tag in the virtual machine BIOS, which can then be read using the standard tools of the guest operating system. You can set an asset tag using the Parallels Desktop graphical user interface or the prlctl command line utility that comes with Parallels Desktop.

To set an asset tag using the Parallels Desktop GUI:

1. On the Parallels Desktop menu bar, select Actions > Configure to open the virtual machine configuration dialog.

2. Select Business.

3. Use the Asset tag field to specify the desired tag.

To set an asset tag using the prlctl command line utility, use the following syntax:

prlctl set ID|name --asset-id tag

where ID|name is the virtual machine ID or name, and tag is the asset tag to set.

To obtain the asset tag in Windows, use the WMIC.exe command:

WMIC SystemEnclosure get SMBIOSAssetTag

For the complete syntax of the WMIC utility please see the Microsoft documentation.

Once set, the asset tag never changes. Even if you perform such virtual machine operations as cloning, template manipulation, registering, or any other, the asset tag always stays the same. If you do want to change an existing asset tag for any reason, you can do it manually using of the methods described above.

To create a configuration profile for VM image provisioning:

1. Begin creating a new configuration profile as described in the Creating a Configuration Profile section.

2. When you have the new configuration profile dialog open, select VM for Intel Mac or VM for M-series Mac payload, depending on the image type that you want to provision.
3. In the right pane, select the Enable VM image provisioning option and specify the following properties:

   • Name: Type a name for the VM image as you want it to be named in this profile. This is the name your users will see in Parallels Desktop when they receive an invitation to download it. This field is mandatory.

   • Description: An optional description. The end user will see this description in Parallels Desktop. For example, if a VPN connection is required to download the image, you may include this information here.

   • Download URL: The VM Image download URL. Mac users must be able to download the image via HTTP or HTTPS using this URL. This field is mandatory. For additional info, please see Creating and Uploading Virtual Machine Images.

   • Checksum (SHA-256): The VM image checksum. This field is mandatory. If you used the PVMP format to archive the virtual machine, the checksum was calculated automatically and saved as a VmName.sha256.txt file. If you archived the virtual machine using the ZIP or other supported format, you'll need to calculate the checksum. For the info about the PVMP format and how to calculate the checksum, please see Creating and Uploading Virtual Machine Images.

4. Click Save to save the configuration profile.

The configuration profile now needs to be applied to a license or sublicense key. If you haven't done so already, use the instructions in the Applying a configuration profile to a license key section and apply the profile.

To create a configuration profile:

1. Log in to your Parallels business account.

2. In the Parallels Desktop for Mac Enterprise Edition product card, click Registered Computers.

3. Click the More item in the main menu (top right) and choose Configuration Profiles, as shown in the screenshot below.
4. The page listing configuration profiles opens. If you haven't created any profiles yet, the list will be empty.

5. Click the Create Profile button. A dialog opens where you can configure the profile.
6. To replace the default profile name (top left), simply erase the default name (New Configuration Profile) and type a new one.

7. The payloads are listed in the left pane. To configure a payload, select it and then specify the necessary settings in the right pane. Each payload has the "Enable..." option at the top of the right pane. This option enables or disables a payload but doesn't change or discard the payload settings. When a payload is enabled, it is included in the configuration profile when the profile is applied to Mac computers. When a payload is disabled, it is not included, so Mac computers don't receive it. For creating the payload (i.e, a virtual machine image), refer to this page of the guide.

8. When done, click Save to save the configuration profile.

At this point we will not configure any of the payloads yet and will go straight to applying the configuration profile to a license or sublicense keys (it is allowed to create a profile with all payloads disabled). Once you learn how to create and apply a configuration profile, we'll talk about how to configure and use each individual payload.

The Parallels Customer Experience Program is a feedback solution that allows Parallels Desktop to automatically collect usage statistics and system information that will help Parallels to improve the product's quality and support for popular configurations.

To create a configuration profile for enabling major version upgrades, do the following:

1. Begin creating a new configuration profile as described in the Creating a configuration profile section.

2. When you have the new configuration profile dialog open, select the Product Updates payload in the left pane.
3. In the right pane, select the Enable managing product updates option. This will enable the payload, so when the configuration profile is sent to Mac computers, they will receive it.

4. To enable major version upgrades, select the Allow upgrade to the major Parallels Desktop version option.

5. Click Save to save the configuration profile.

The configuration profile now needs to be applied to a license or sublicense key. If you haven't done so already, use the instructions in the Applying a configuration profile to a license key section and apply the profile.

Configuration profiles are applied to registered Mac computers based on a license or sublicense key that they are using to run Parallels Desktop. By applying a configuration profile to a license or sublicense key, you are essentially applying it to Mac computers that use (or will use in the future) that key.

To apply a configuration profile to a license or sublicense key:

1. In Parallels My Account, click Dashboard in the top menu and then click Active subscriptions inside the Parallels Desktop for Mac Business Edition product card.

2. Click a subscription to open a page containing the subscription information.

3. In the License Keys list, choose a license or sublicense key and click the "gear" icon at the end of the row. This opens a dialog containing the license key information and settings. In the dialog, select the Configuration Profile tab.
4. Initially, the tab page will say that "Configuration profile is not set" and the drop-down menu next to it will contain the "Default" profile. This is because you haven't applied a custom configuration profile to this license key yet.

5. Expand the drop-down menu and select the configuration profile that you created earlier.

6. Click Save.

Once a configuration profile is applied to a license key, the following will happen on Mac computers that use this key:

• The next time Parallels Desktop communicates with Parallels cloud, it will receive the configuration profile and will save the data that it contains locally.

• When an action is performed (by the user or by a scheduled event) that has to do with one of the configuration profile payloads, the data is read from the local storage and is used accordingly depending on the payload and its settings. This is described in more detail in topics that describe individual payloads.

This concludes the description of how to create a configuration profile and how to apply it to a license or sublicense key. The subsequent sections describe how to configure individual payloads and how to use the corresponding functionality when managing Parallels Desktop installations in your organization.

Parallels Desktop Enterprise, Business, and Pro editions include developer tools which are aimed at software developers using Parallels Desktop as part of their development and testing setup. The tools are accessed by clicking the Develop menu on the virtual machine menu bar and then choosing one of the available options (e.g. Start SSH Session, Start Debugging Session, and others). If users in your organization are not using these tools, you can hide the Develop menu altogether. The reason you would want to do this, some of these features (if used accidentally) may start a debugging session or engage in some other development-specific activities that may temporarily disrupt normal Parallels Desktop operation.

This option is a part of a virtual machine configuration and can be set using the Parallels graphical user interface as follows:

1. Open the virtual machine configuration dialog (click the gear icon or choose Actions > Configure).

2. In the dialog, click Options (at the top) and then click More Options in the left pane.

3. In the right pane, select or clear the Show developer tools option. This will show or hide the Develop menu on the virtual machine menu bar (you don't have to restart a virtual machine if it's running).

To modify this setting from the command line, execute the following command in Terminal:

where ID/Name is the GUID or name of a target virtual machine.

When mass deploying Parallels Desktop on Mac computers in your organization, you can configure the autodeploy package to apply these settings to all included virtual machines automatically. For details, see .

A Parallels virtual machine can be encrypted from the Parallels Desktop graphical user interface. This is done from the Security tab of the virtual machine configuration dialog.

You can also use the prlctl command line utility (included with Parallels Desktop) to perform a full set of encryption operations on a virtual machine.

The following command line options are available:

• Encrypt a virtual machine

  prlctl encrypt <ID | NAME>

• Decrypt a virtual machine

  prlctl decrypt <ID | NAME>

• Change the encryption password

  prlctl change-passwd <ID | NAME>

The <ID | NAME> parameter can be either the virtual machine ID or the virtual machine name. When encrypting a virtual machine, you'll be asked to enter a password phrase, which will be used to encrypt the machine. When decrypting a virtual machine, you will be asked to enter the current password. When changing the password, you'll be asked to enter the old password and then the new password.

The encryption password will also be required to perform any other command line operation on an encrypted virtual machine, including starting, stopping, restarting, pausing, suspending, cloning, deleting a virtual machine, etc. For example, to start an encrypted virtual machine, you'll use the following command:

$ prlctl start my_virtual_machine

After executing the command above, you'll be asked to enter the password:

Virtual machine "my_virtual_machine" is encrypted - password required to continue operation
Please enter password:

After typing in the correct password, you'll see the following output:

Starting the VM...
The VM has been successfully started.

If you need to execute a command remotely without having to enter the password on every Mac, you can send the password via standard input (stdin) as shown in the following example:

$ echo mypass | prlctl start my_virtual_machine
Virtual machine 'my_virtual_machine' is encrypted - password required to continue operation
Please enter password:
Starting the VM...
The VM has been successfully started.

If you need to provide two passwords (as with the change-passwd command that changes the password), you can save the passwords to a text file and then use the following syntax:

$ cat /tmp/pass | prlctl change-passwd my_virtual_machine
Virtual machine 'my_virtual_machine' is encrypted - password required to continue operation
Please enter password: 
Please enter new password:
The password has been successfully changed.

The /tmp/pass file in the example above should contain the old password on the first line and the new password on the second line:

$ cat /tmp/pass
mypass
newpass

You can set an expiration date for a virtual machine. This can be a useful option if you are preparing a virtual machine for a contractor (or a third party user) and want to make sure that it works only for the duration of the contract.

To set an expiration date for a virtual machine:

1. Open Parallels Desktop and select the desired virtual machine.

2. On the Parallels Desktop menu bar, select Actions > Configure to open the virtual machine configuration dialog.

3. Select the Security tab.

4. An expiration date can only be set on an encrypted virtual machine. If your machine is not yet encrypted, click Encryption: Turn On, specify an encryption password, and click OK. Make sure to record the password or you will not be able to start the virtual machine. Wait until the encryption process finishes.

5. To set an expiration date for the virtual machine, click Expiration Date: Set Date, specify a password and click OK. Make sure to record the password to be able to change the expiration settings later. You should keep this password secret to prevent the prospective user of the virtual machine from changing the expiration date.

6. On the next screen, specify the following options:

   • Do not allow this VM start after: specifies the virtual machine expiration date.

   • Contact info: specifies the system administrator email, phone number, or other contact information. This information will be included in the message that will be displayed to the user when the virtual machine is about to expire. You can include each piece of information on a separate line.

   • Time Server: specifies the time server URL. The virtual machine expiration time will be checked against this server. The default time server is https://parallels.com.

   • Date Check Frequency: specifies how often the date and time should be verified against the time server. You can specify it in minutes, hours, or days.

   • If unable to check date, use VM for: specifies for how long the virtual machine should be kept working if the time server cannot be reached. For the duration of this period, the virtual machine will continue to check the date. If it succeeds before this period is over, the counter is reset, and the virtual machine will continue to work normally.

7. Click OK when done entering the expiration info.

8. To modify the current expiration date or password, click Expiration Date: Change Date or Expiration Date: Change Password and enter the new values.

When the expiration date approaches, the virtual machine user will be notified as follows: a message will begin to be displayed seven days before the expiration date. The message will be shown to the user every 24 hours and additionally on every virtual machine startup. Once the date is reached, the virtual machine will be locked, so the user will not be able to start or resume it anymore.

With Parallels Desktop Enterprise Edition, you can set up a local update server on your network from which Mac users can get Parallels Desktop updates. Updates are released periodically to improve the performance and reliability of Parallels Desktop. To reduce Internet traffic when downloading updates, you can set up a local update server, download the available updates to it, and then set up individual Macs on your network to take the updates from it instead of the Internet. Read on to learn about setting a local update server.

As administrator of a large Parallels Desktop for Mac deployment, you may need to restrict your users' ability to perform certain common actions, such as creating a completely new virtual machine that would be outside of your control and not configured to your company's standards, or remove your standard-issue corporate virtual machine.

One of the advantages of Parallels Desktop for Mac Enterprise Edition is the ability to set up, monitor, or change all such policies on all of your organization's workstations in a centralized manner via the Parallels Management Portal. Refer to the section for more information.

Your users won't be able to access the Settings -> Security panel on their managed machines where that panel looks like this:

Single Application Mode is a special Parallels Desktop deployment option that allows you to largely obscure Parallels Desktop and Windows on a Mac, making Windows applications appear native to macOS. This mode is designed for system administrators who want Mac users in their organization to run one or more Windows applications while minimizing their interaction with Windows or Parallels Desktop.

To make Parallels Desktop run in Single Application Mode, you need to deploy it on Mac computers via the autodeploy package. This includes preparing the autodeploy package in a special way and then either deploying it on Mac computers using Mac management tools or running it manually on a Mac.

For more information about how to use the autodeploy package and how to deploy Parallels Desktop in Single Application Mode, please see the following sections of this guide:

When configuring USB device settings for a virtual machine, you can enforce what types of USB devices are allowed to be connected. For example, if storage devices (in general) are not allowed, the Mac user will not be able to connect an external hard disk or thumb drive to the virtual machine. This functionality is available in Parallels Desktop Business edition only and is absent in other editions.

To enforce USB device policies, open the virtual machine configuration window and select Hardware > USB & Bluetooth.

In the Allow external devices list:

• Clear the types of devices that you don't want Mac users to connect to the virtual machine.

• Select the types of devices that should be allowed.

To set up a Parallels Desktop update server, you'll need a local Web server. Install a Web server on a computer connected to your network (or use an existing one).

Starting from Parallels Desktop 18, the Activation using corporate account (sometimes referred as SSO-activation) option became available.

This option works best for Medium and Enterprise size organizations that have an identity provider (e.g., Entra ID) and rely on it to automate applications license management routines. With SCIM integration (optional) licenses from contractors and people who left the company and removed from the identity provider directory will be automatically revoked. There is also an option to automatically revoke licenses from people who are not using the product for a long time.

The license key is also not used in this scenario, so there are less chances for it to be misused.

There are three major steps to enable this option:

1. This option works only if you purchased a special license type. Please check your license certificate for details and contact your sales representative if you have questions. Note that the minimum purchase for this license type is 50 licenses and it is not available as an online purchase from parallels.com.

2. IT team has to setup integration between your identity provider (Entra, Okta, Ping Identity, or others that support SAML 2.0 and SCIM 2.0) and Parallels My Account by using the "Configure SSO-based activation" guide that is available in this KB article. If there is no guide for your identity provider, it is recommended to follow the one for Entra ID.

3. To provide your employees with the best user experience use the deployment capabilities described in this guide or simply share this link with users: https://parallels.com/directdownload/pd?experience=sso.

By default, Parallels Desktop Business and Enterprise Edition downloads updates from a special location on the Parallels website dedicated to hosting Parallels Desktop Business and Enterprise Edition updates. Parallels Desktop Standard and Pro editions download their updates from a different location. As an administrator, you have an option to choose the location from which Parallels Desktop Business or Enterprise Edition downloads updates. The reason why you would want to do this is explained below.

When Parallels Desktop updates are released by Parallels, they become immediately available for Parallels Desktop Standard and Pro Editions. Updates for Parallels Desktop Business and Enterprise Edition are released at a slightly later date (from a few days to 1-2 weeks from the initial release). The delay is necessary for additional testing of business features of Parallels Desktop to ensure they meet the highest quality standards. During this period, we even give an updated version of Parallels Desktop to some of our corporate customers,who test and evaluate it in their real-world environments.

We recommend that you use the default configuration and download Parallels Desktop Business/Enterprise Edition updates when they are finalized and available for download. However, if for any reason you don't want to wait, you can configure Parallels Desktop Business or Enterprise Edition to download updates from the Parallels Desktop Pro location. The updates are the same regardless of where you download them from. The only difference is, the updates downloaded from the Parallels Desktop Pro location will have not been fully tested in a business environment.

When you mass-deploy Parallels Desktop, you can set the desired Software Update options in the deployment configuration file. Mass Deployment of Parallels Desktop is described later in this guide. For more information, please read the entire Mass Deployment chapter and specifically the Configuring Deployment Options section. Look for the Software Updates section in the parameter table.

If you need to modify Parallels Desktop software update options on a specific Mac without using the Mass Deployment procedure, you can do this as described below.

To configure Parallels Desktop to download updates from the Parallels Desktop Pro location, execute the following command on a Mac:

defaults write com.parallels.Parallels\ Desktop.plist Application\ preferences.VolumeLicenseUpdatePolicy  https://update.parallels.com/desktop/v20/parallels/parallels_sbscr_updates.xml

The command above writes the specified URL (the parameter in the second part of the command) into the Parallels Desktop plist file. Please note that the "v20" part of the URL indicates the current Parallels Desktop version number. If you are using a later version, substitute this part with the correct number.

To switch back to the default Parallels Desktop Business/Enterprise download location, execute the following command:

defaults write com.parallels.Parallels\ Desktop.plist Application\ preferences.VolumeLicenseUpdatePolicy Parallels

The next step is to configure individual Macs to take their updates from the local update server. This can be done automatically during the mass deployment of Parallels Desktop by modifying the appropriate deployment configuration option. Please see Configuring Deployment Options for the complete info (see the description of the Software Updates section of the configuration file).

If you have an existing Parallels Desktop installation that was not configured for automatic updates during deployment, then read on to learn how to do it manually.

To configure Parallels Desktop automatic updates, you need to modify the Parallels Desktop property list file on a Mac as follows:

1. Find the com.parallels.Parallels Desktop.plist file located in the Library/Preferences subfolder in the user's home folder. This is the Parallels Desktop property list file that contains the user-specific information.

2. Open the file using the Property List Editor application (included with Xcode).

3. Set the update policy by modifying the Application preferences.VolumeLicenseUpdatePolicy property. If the property doesn't exist, add it to the file specifying its data type as String. Set the property value using one of the following options (see also the Notes subsection below):

   • "Parallels" — when this value is set, the updates will be downloaded from the Parallels update server via the Internet. The value is case-sensitive.

   • Complete URL of the parallels_updates.xml file residing on your local update server. For example, "https://10.0.0.1/pdfm/v8/en_us/parallels/parallels_updates.xml". When the URL is specified, the updates will be obtained from the local update server.

   • "None" — automatic updates are disabled. The value is case-sensitive.

4. Specify how often Parallels Desktop should check for updates. This is done by modifying the Application preferences.Check for updates property. If the property doesn't exist, add it to the file specifying its data type as Number. Specify the property value using one of the following options:

   • 0 — Never

   • 1 — Once a day

   • 2 — Once a week

   • 3 — Once a month

5. Set the automatic download option. Find the Application preferences.Download updates automatically property. If it doesn't exist, add it to the file specifying its data type as Boolean. Set the property value using one of the following options:

   • True — Download updates automatically. Specify this value when using a local update server.

   • False — Notify the user about the updates but don't download them automatically. This option is useful only when updates are downloaded from the Parallels update server, and the user has full control over the update functionality.

6. Save the file and close the Property List Editor application.

Notes

On initial Parallels Desktop activation using a Business Edition key, the Parallels Desktop update properties will be absent from the com.parallels.Parallels Desktop.plist file. In such a case, a Mac user will be able to configure Parallels Desktop automatic updates using the Parallels Desktop graphical user interface.

When the update-related properties are added to the com.parallels.Parallels Desktop.plist file, the automatic updates will be performed according to the specified values. In addition, the value of the Application preferences.VolumeLicenseUpdatePolicy property will affect the Parallels Desktop update-related elements in the Parallels Desktop graphical user interface as follows:

• If the property contains a URL of the local update server or "None", the Parallels Desktop update-related controls will be disabled (grayed out) in the Parallels Desktop graphical user interface. The displayed settings will have no effect on how the Parallels Desktop updates are carried out. Therefore, the user will not be able to configure automatic updates or check for updates manually.

• If the property doesn't exist, has no value, or contains "Parallels" as a value, the Parallels Desktop update controls will be enabled in the user interface giving the user the ability to configure automatic updates and check for updates manually.

Create a file named parallels_updates.xml on the Web server where it can be accessed via HTTP. The file is an XML document that should contain specifications for a particular Parallels Desktop update available on your local updated server.

To create your own document, use the following sample XML document and the XML document specification that follows it as a reference.

A Sample parallels_updates.xml File

  
    Parallels Desktop
    1
    
      12
      0
      12494
      262214
      Sumer
      
        0
        Build 13291 is available!
        Update description goes here</UpdateDescription>
        URL to the update file goes here</FilePath>
        219515
        0
        2017-06-17 01:23:00
        0
        en_US
        parallels
        mac
        
          desktop.13.0.12927.482436.en_US.parallels.mac
          desktop.13.0.12473.274921.en_US.parallels.mac
          desktop.13.0.12262.823647.en_US.parallels.mac
        
      
    
  

XML Document Specification

Parallels Desktop for Mac Enterprise Edition allows you to protect the configuration of a virtual machine with a custom password. When a password is set, even a local Mac administrator will be required to enter it in order to modify virtual machine settings.

Setting the Password via GUI

To set a password in the Parallels Desktop graphical user interface:

1. Open Parallels Desktop and select a virtual machine.

2. On the Parallels Desktop menu bar, select Actions > Configure to open the virtual machine configuration dialog.

3. Select Security.

4. Click the Custom password: Turn On... button.

5. Enter a password, then enter it again to verify and click OK.

To change or remove the password:

• To change the password, click the Change Password button and follow the instructions on the screen.

• To remove the password, click Custom password: Turn Off and follow the instructions on the screen.

If the password is set and the user tries to view or modify the virtual machine configuration, they will be required to enter this custom password.

Setting the Password via CLI

In addition to the graphical user interface, you can use the prlctl command-line utility to set a custom password for editing the virtual machine configuration.

To set the password, type the following command in Terminal:

prlctl set "vm_name" --custom-pwd

where vm_name is the virtual machine name in quotes. You'll be asked to enter a password and then confirm it.

To change or remove the password, type the same command as above:

prlctl set "vm_name" --custom-pwd

You'll be asked to enter the current password and then a new password.

To view the current protection status for a virtual machine, type the following command:

prlctl list "vm_name" -i

In the output, search for the Security section and look at the Custom password protection property. It will be either set to "on" or "off".

Setting the Password Using the Mass Deployment Process

If you are mass deploying Parallels Desktop and one or more virtual machines, you can simply set the custom password in the source virtual machine. When a virtual machine is deployed on Mac computers, the password will be retained.

Parallels Desktop Control Center is a part of the Parallels Desktop graphical user interface. It's a window from which a Mac user launches virtual machines. By default, the Control Center displays the list of the available virtual machines, as in the following example:

You can customize the Control Center by specifying a URL to your own HTML document, which will be embedded at the top of the Control Center window. The HTML page can contain text, graphics, and links such as your company logo, custom text, a link to a support page, etc. The HTML document format doesn't have any specific requirements.

The URL must be specified during the preparation stage of the . Specifically, you need to specify the URL and the HTML page size using the following variables in the mass deployment configuration file (deploy.cfg):

• control_center_banner_url

• control_center_banner_height

• control_center_banner_min_width

The following is an example of Parallels Desktop Control Center displaying a custom banner at the top.

You can download a sample HTML document defining the banner using the following URL:

To avoid possible security and privacy issues, a suspended Windows virtual machine can be completely locked from user interaction and viewing. When this option is enabled and a virtual machine is suspended, the Windows desktop in the virtual machine window (and in the Parallels Desktop Control Center) is replaced with a black background and the Windows session is interrupted. When the virtual machine is resumed, the Windows session is remained locked and the user will have to enter their credentials or authenticate (depending on how Windows is set up) to unlock it and see the Windows desktop.

To enable or disable this option:

1. Open Parallels Desktop and select the desired virtual machine (e.g. the source virtual machine when preparing it for mass deployment).

2. On the Parallels Desktop menu bar, select Actions > Configure to open the virtual machine configuration dialog.

3. Click the Security tab.

4. Depending on your needs select or clear the Always lock Windows on suspend option.

5. Close the dialog.

When users run Parallels Desktop Enterprise Edition, they can get support at any time by clicking the Help > Support Center menu. By default, this will open one of the following:

• If you are a large organization with your own Help Desk, the menu will open a message box saying the user should contact the system administrator for assistance.

• If you are a small organization without a Help Desk or if you are using a trial version of Parallels Desktop, the menu will open the Parallels Desktop support web page.

You can change the default behavior described above and make the Help > Support Center menu open a custom URL, such as your corporate Help Desk page or any other web page you desire.

The customization can be done during mass deployment of Parallels Desktop by modifying the corresponding deployment configuration parameter. Please see Configuring deployment options for the complete info (see the description of the Help and Support section of the configuration file).

You can also make the customization manually on an individual Mac as follows:

1. Log in to the Mac.

2. In the Finder, navigate to the /Users/<User_Name>/Library/Preferences directory and locate the com.parallels.Parallels Desktop.plist file.

3. Open the file using the Property List Editor application, which is included with Xcode.

4. Find the SupportRequestUrl property in the file. If the property doesn't exist, add it to the file specifying its data type as String.

5. To specify the action that should be performed by the Help > Support Center menu, set the value of the SupportRequestUrl property:

   • To display the default text message, clear the property value.

   • To open a URL, specify the full URL of the desired web page or resource.

If a virtual machine user forgets the password of their guest OS account (e.g. a Windows user password), it can be reset outside the virtual machine using the command line interface.

To use this functionality the following conditions must be met:

• Parallels Tools must be installed in the guest OS.

• The virtual machine must be running. If it's stopped, start it and wait until you see the guest OS login prompt.

• Depending on your requirements, the following option can be selected or cleared in the virtual machine configuration dialog: Security > Require Password to: [ ] Change guest OS password via CLI. If this option is selected, you will be asked to provide the macOS administrator password to change the guest OS password from the command line. If the option is cleared, the administrator password will not be required. By default, the option is cleared.

To reset the password, open Terminal and enter the following command:

prlctl set vm_name --userpasswd username:new_password

where:

• vm_name is the virtual machine name. To obtain the list of virtual machines installed on this Mac, type prlctl list.

• username is the guest OS user name.

• new_password is the new password.

Example:

prlctl set My_Win8_VM --userpasswd JohnDoe:A12345

If the Require Password to: Change guest OS password via CLI option is selected in the virtual machine configuration dialog (see above), the command will display the following text and prompt:

Only host administrator can change user password in the guest OS.
Confirm your administrator credentials.
Username:

Enter the name of the macOS user with administrative privileges and press the Enter key. Type the user password and press Enter again.

Once the new password is set, you can use it to log in to the guest OS.