Amulet Hotkey DXZC-AM User manual

®
Revision 2.4
June 2016
HB-DXZC-0003
DXZC MANUAL
SECURITY EDITION
DXZC-AM, DXZC-AMC
PCoIP Zero Clients

DXZC-AM and DXZC-AMC Manual
Security Edition
www.amulethotkey.com | 2
©2016 Amulet Hotkey Ltd. All rights reserved.
Information in this document is subject to change. No part of this document may be reproduced through any means including (but not limited to) electronic or
mechanical, without express written permission from Amulet Hotkey Ltd. Amulet Hotkey Ltd may have patents, patent applications, trademarks or copyrights or
other intellectual property rights covering subject matter in this document. PC-over-IP, PCoIP and the PCoIP logo are registered trademarks of Teradici Corp.
Amulet Hotkey and ‘solutions you can bank on’ are registered trademarks of Amulet Hotkey Ltd. Other product names and company names listed within this
document may be trademarks of their respective owners. Amulet Hotkey products are designed and built in the UK.
Warnings
■ To reduce the risk of electric shock, do not remove any
circuit board or power supply covers. There are no user
serviceable parts inside; refer to qualified personnel.
■ To reduce the risk of fire or electric shock, do not
expose this appliance to rain and moisture. The
appliance should not be exposed to dripping or
splashing and no objects filled with liquids should be
placed on or near the appliance.
Safety instructions
1 Clean the product only with a dry cloth.
2 Keep the product away from liquids.
3 Install in accordance with these instructions.
4 Do not install near significant sources of heat.
5 Ensure the product is properly earthed.
6 Only use attachments and accessories approved by
Amulet Hotkey.
7 Refer all servicing to qualified personnel.
Laser Safety Notice
The DXZC-AM and DXZC-AMC zero clients can be fitted with SFP
network modules that contain Class 1 lasers. The SFP module
emits invisible radiation which can cause harm if installed or
serviced incorrectly. Follow the guidelines below:
Warning: Class 1 laser product
Warning: Invisible laser radiation can be emitted from the
aperture of the SFP port when no fiber is connected. To avoid
exposure to laser radiation, do not stare into open apertures.
Warning: Only trained and qualified personnel should be
allowed to install, replace, or service this equipment.
Shipment and Product Inspection
Your zero client and cables were carefully packed prior to
despatch to guarantee safe transit. However, we recommend
that you thoroughly examine all packaging and contents for
signs of physical damage before use.
If any damage has occurred, please notify the shipping company
and your supplier immediately otherwise claims for damage or
replacement may not be granted.
Retain the original packaging for use in the event that the
equipment has to be stored, shipped or returned for service. If
you choose to dispose of the packaging, please do so in an
environmentally friendly fashion.
Thank you
Thank you from everyone at Amulet Hotkey for purchasing this
product. Much time and energy has gone into making this the
best and most reliable solution available.
With over 20 years of experience working around the world in a
variety of installations, we are confident we have provided a
state-of-the-art unit that will provide you with long and reliable
service regardless of the application.
To get the best from this product, please take time to study this
manual carefully even if you are familiar with other Amulet
Hotkey products.
Technical Support
Contact Amulet Hotkey technical support for expert
assistance:
EMEA
[phone]
[email protected]
N America
[phone]
[email protected]
APJ
[phone]
[email protected]
Or, look at the resources page on our website:
https://resources.amulethotkey.com/resources

DXZC-AM and DXZC-AMC Manual
Security Edition
www.amulethotkey.com | 3
Amulet Hotkey Zero Clients are ready for use with VMware® View® version 4 and above.
This device complies with part 15 of the FCC Rules. Operation is subject to the following two conditions: (1) This
device may not cause harmful interference, and (2) this device must accept any interference received, including
interference that may cause undesired operation.
This device has been tested and found to comply with the limits for a Class B digital device, pursuant to part 15 of
the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a
residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed
and used in accordance with the instructions, may cause harmful interference to radio communications. However,
there is no guarantee that interference will not occur in a particular installation. If this device does cause harmful
interference to radio or television reception, which can be determined by turning the device off and on, the user is
encouraged to try to correct the interference by one or more of the following measures:
▪Reorient or relocate the receiving antenna
▪Increase the separation between the equipment and receiver
▪Connect the equipment into an outlet on a circuit different from that to which the receiver is connected
▪Consult the dealer or an experienced radio/TV technician for help
This manual covers the Amulet Hotkey®DXZC-AM and DXZC-AMC zero clients that make use
of the TERA2 range of PCoIP®processors.
It covers the principle features of these zero clients, their specifications, operation and
connection to desktop peripherals. It also explains briefly how to create a PCoIP session
between a zero client and remote PCoIP host.
For a full and detailed understanding of the PCoIP protocol, options for connection, security
and management, please refer to the PCoIP Zero Client and Host Administrator Guide which
can be downloaded from the Teradici website technical support pages.
IMPORTANT

DXZC-AM and DXZC-AMC Manual
Security Edition
www.amulethotkey.com | 4
Contents
1. Introduction................................................................5
1.1 Terminology...........................................................5
1.2 What is PCoIP?.......................................................5
1.3 About PCoIP zero clients........................................6
1.4 About PCoIP hosts.................................................7
2. Before you start..........................................................8
2.1 DXZC models: SFP and smart card versions...........8
2.2 Firmware revisions ................................................8
2.3 Change the default password ...............................8
2.4 IP and MAC addresses...........................................9
2.5 Power supply.........................................................9
2.6 Network bandwidth...............................................9
2.7 LED status indicators..............................................9
2.8 Support for connection brokers.............................9
2.9 Zero client management tools.............................10
2.10 Cooling considerations........................................11
3. Deployment security ................................................13
3.1 Physical inspection of the DXZC-AM enclosure...13
3.2 Controlling the use of USB devices......................13
3.3 Event logs ............................................................14
3.4 Secure disposal of DXZC-AM and DXZC-AMC
devices.................................................................14
4. DXZC-AM/DXZC-AMC zero client features.................15
4.1 Front panel ..........................................................15
4.2 Rear panel............................................................16
5. Setting up the DXZC-AM zero client...........................17
5.1 Connect the keyboard, mouse and monitors......17
5.2 Connect to a PCoIP host ......................................17
5.3 Connect the power supply ..................................17
5.4 Establish a new PCoIP session .............................18
6. Connect the DXZC-AM zero client to a host...............19
6.1 Automatic connections to a host PC or virtual
desktop................................................................19
6.2 Connect manually to a host PC or virtual desktop
.............................................................................19
6.3 Disconnect from a host PC or virtual desktop.....19
6.4 Smart card authentication ..................................20
7. Known issue: Monitors continually revert to incorrect
display topology .......................................................21
7.1 Symptom.............................................................21
7.2 Cause...................................................................21
7.3 Solutions..............................................................21
8. Technical Specifications ............................................24

www.amulethotkey.com | 5
transmits the computing experience from a host PC 'pixels only'
across a standard IP network to a remote zero client. Actual
data never leaves the host PC and all pixel transfers are
encrypted with advanced security algorithms.
PCoIP supports high resolution, full frame rate 3D graphics and
HD media, multiple large displays, full USB peripheral
connectivity, and high definition audio, all connected over the
corporate LAN or WAN.
Furthermore, PCoIP technology allows all desktops in your
enterprise to be centrally located and managed in a data centre, in
a geographically remote location if necessary, while providing
remote users with full desktop performance.
There are three essential features of PCoIP:
■Host rendering: PCoIP renders display images on the host PC
(or virtual machine). Host rendering preserves the PC
environment so applications perform as they should. After
an image is rendered on the host, PCoIP broadcasts just the
encrypted pixels (not the data) across the network to the
remote client. This makes it possible to have stateless,
decode-only client devices – called zero clients – with all the
benefits they bring, such as low maintenance, increased
security, and cost savings. See section 1.3 for details.
3
1
4
LAN/WAN
Copper/Fibre
2
1
Example PCoIP system with DXZC-AM zero client
1DXZC-AM zero client (dual video head). 2 Monitors.
3 Remote workstation or blade. 4PCoIP host. The host
can be implemented in hardware (shown here) or in
software (using VMware View).
1
1. Introduction
This manual covers the Amulet Hotkey DXZC-AM and DXZC-
AMC PC-over-IP® (PCoIP®) zero clients. The DXZC-AM is a dual
video head compact zero client with a single network
connection. The DXZC-AMC in addition has an integral smart
card reader. They are both based on the TERA2 chipset from
Teradici and are designed for use with Amulet Hotkey PCoIP
hosts.
The DXZC-AM, and DXZC-AMC have been evaluated by the CESG
Commercial Product Assurance Scheme and approved for use at
foundation grade for Remote Desktop v1.0.
This chapter includes an overview of the PCoIP protocol and the
advantages associated with PCoIP zero clients.
1.1 Terminology
This manual uses ‘DXZC-AM’ as a generic term when referring to
all product models, including the standard DXZC-AM, which
accepts an SFP module; and the DXZC-AMC, which also has an
integral smart card reader.
1.2 What is PCoIP?
The DXZC-AM uses Teradici PCoIP® technology. PCoIP
compresses, encrypts and encodes the entire computing
experience on a host PC. In a PCoIP system, a PCoIP host

DXZC-AM and DXZC-AMC Manual
Security Edition
www.amulethotkey.com | 6
To ensure desktop responsiveness, the process of image
compression-encryption-transmission by the PCoIP host
and then decryption-decompression by the zero client
happens very quickly, typically in just one frame (or less than 15
msecs).
Because zero clients just decode pixels to display images, they
can be far simpler and more secure than a traditional desktop
PC and other thin client solutions:
■Increased security: Because PCoIP zero clients have a
stateless architecture and no local data storage, they are the
most secure endpoint available.
Pixel transfers to the zero client are encrypted with
advanced security algorithms. Zero clients are also immune
to viruses and never need anti-virus updates. Finally, zero
clients comply with the most stringent government and
security mandates. In particular, they support robust USB
hardware security authorization, including user
authentication and single sign-on (SSO) based on smart
cards, proximity cards and other SSO devices.
■Low maintenance: Zero clients are extremely easy to
manage and do not require regular updates or patches.
They have no application operating system, no general
purpose CPU or RAM, no graphics processor. And they have
no fan or hard disk to fail.
Because they perform only pure image decompression, they
are future proof. A zero client never needs a new operating
system or updates for drivers, media codecs, or anti-virus
signatures. Also, a zero client does not need to know about
the applications being used (it just has to decode the pixels
to display the image), so there are no version dependencies
between the zero client and the host PC. There is no risk
that future versions of an application will render the zero
client obsolete.
■Cost savings: Zero clients have significantly lower costs than
traditional PCs and thin clients. They use less power,
generate less heat, and often have a smaller footprint
(Amulet Hotkey zero clients are the size of a small book).
Also, because they are simple devices, zero clients require
minimal administration and have very low management
costs. And because they are future proof, their extended life
span is assured and they rarely need replacing.
For more general information about PCoIP zero clients, visit
www.teradici.com.
Note: Other remote computing protocols use client
rendering. To render an image on the client, each
command from the host, and each response from the
client, must travel across the network. This degrades an
application’s performance while it waits for image
rendering to complete.
■Multi-codec display processing: A PC display includes
different types of image elements (text, graphics, icons,
video). Using the same codec to encode all these elements
would use excessive network bandwidth. Instead, PCoIP
continuously analyses and decomposes image elements,
using the right codec for each pixel.
PCoIP’s intelligent image decomposition and encoding
results in efficient transmission and decoding. This saves
bandwidth while delivering the best user experience. In
addition, PCoIP builds every pixel to a lossless state when
they stop changing, ensuring a pixel-perfect image on the
zero client regardless of network limitations.
■Dynamically adapts to network conditions: The PCoIP
protocol lets you easily set image quality settings to manage
bandwidth use and ensure the best possible performance is
delivered for the prevailing network conditions.
On congested networks , PCoIP adaptive encoders
automatically adjust image quality within the limits you set.
When the network is no longer congested, they
automatically resume maximum image quality.
1.3 About PCoIP zero clients
PCoIP zero clients are secure, hardware-based endpoints that
allow users to connect to a remote host PC or virtual desktop
over a local or wide area IP network. They support multiple
wide-screen formats, HD audio, and local USB peripherals,
providing a rich multimedia experience for users.
Zero clients can take many form factors, such as PCoIP
integrated displays and touch-screen monitors. The Amulet
Hotkey zero clients are small stand-alone devices.
Users can interact with their desktops from any type of zero
client and can even continue the same session if they move
between zero client devices.
PCoIP zero clients use a highly integrated TERA-series processor
to perform image decompression and decoding. At the desktop,
they decrypt, decompress and distribute video, audio and USB
data to the standard desktop peripherals such as monitors,
keyboard, mouse, and speakers or headset. A zero client also
passes user-generated USB and audio data back to a remote
PCoIP host (see section 1.4).

DXZC-AM and DXZC-AMC Manual
Security Edition
www.amulethotkey.com | 7
1.4 About PCoIP hosts
A PCoIP host is a card that converts a remote PC (or blade) into
a pixel broadcast centre. The host's TERA-series processor
performs advanced display compression algorithms to encode a
user's full desktop environment, allowing the host to deliver
high-end images to a zero client in any location.
In a PCoIP system, the PCoIP host is installed inside or near to
the remote PC. The host takes digital video, audio and USB data
generated by the PC and compresses and encrypts this data. It
then transmits this data in real time over an IP network to the
user’s PCoIP zero client.
Amulet Hotkey PCoIP hosts are available in various form factors.
Some install inside a PC while others are located near to a PC
and connect to video, USB and audio ports using standard
cables.
Amulet Hotkey also supply a range of PCoIP blade workstations
based on the class leading Tier 1 devices from Dell. These
workstations include Amulet Hotkey BIOS and PCIe mezzanine
cards to provide hardware GPU and PCoIP acceleration.
For further details about Amulet Hotkey PCoIP hosts, visit
www.amulethotkey.com.

www.amulethotkey.com | 8
2. Before you start
emails will sent be to nominated client representatives and
include a link to download a file containing the firmware
update.
We recommend that you apply new firmware releases at the
earliest opportunity to ensure that the latest improvements and
patches are active in any deployment. The latest firmware
release and instructions on how to update the DXZC-AM are
available on the Support > Downloads page of the Amulet
Hotkey website.
Note: You must register on the Amulet Hotkey website to
access the download area.
2.2.2 Security for downloaded firmware files
Before downloading a firmware update from the Amulet Hotkey
website, confirm that the SSL certificate for the Resources page
is valid and issued to the resources.amulethotkey.com domain
(click the padlock icon in the address bar of your browser).
After downloading the file, we recommend that you confirm it
has not been modified by comparing its SHA-256 hash with the
SHA-256 hash value listed next to the download link on the
Amulet Hotkey website. Use the hash calculator of your choice
to independently calculate the SHA-256 hash for the
downloaded file.
2.3 Change the default password
You must enter a password before changing the configuration
of the DXZC-AM zero client. The factory pre-set password for all
Amulet Hotkey zero clients is ahkdante.
At first login, the DXZC-AM prompts for a new password. We
strongly recommend that you set a new, more secure password
before allowing end-users to use the DXZC-AM.
Important! Although the DXZC-AM does not enforce a
password policy for administrator logins, we strongly
recommend that you implement a robust and secure
password policy. Where possible, use a machine-generated
password of eight or more characters. We also
recommend that you provide your DXZC-AM users with
guidance about the secure handling of pass phrases.
2
Before you connect a zero client to a PCoIP system, be aware of
the following information.
2.1 DXZC models: SFP and smart card versions
The DXZC-AMC is available in two models:
■DXZC-AM: This model has a network port that accepts a fiber
or copper SFP module (see item 1 in section 4.2).
■DXZC-AMC This model accepts a fiber or copper SFP module
and has a built-in smart card reader (see item 8 in section
4.1).
Note also that the smart card model, DXZC-AMC is around 5 cm
wider than the DXZC-AM.
2.1.1 SFP modules
Amulet Hotkey can provide a range of suitable SFP modules,
including 1Gbps and 100Mbps fiber SFP modules for multi-mode
fiber and copper SFP modules with RJ45 connectors. See the
Amulet Hotkey SFP Modules Datasheet for details of currently
available modules.
Be aware that SFP modules have differing specifications, and the
distances over which they can drive a signal vary. This especially
applies to fiber SFP modules.
Important! The DXZC-AMC and DXZC-AM only support
certain models of SFP module. If in doubt, contact Amulet
Hotkey for advice.
2.2 Firmware revisions
PCoIP devices operate on embedded code known as firmware.
The firmware is constantly being improved and periodically
updated. To check the current version of firmware on any PCoIP
device, use the On Screen Display or Administrative Web
Interface management tools built into PCoIP hosts and zero
clients. See section 2.9 for details.
2.2.1 Firmware updates
Amulet Hotkey periodically release new firmware to support
continuous improvement of its products. Update notification

DXZC-AM and DXZC-AMC Manual
Security Edition
www.amulethotkey.com | 9
2.4 IP and MAC addresses
Before you set up a zero client, make a note of these details:
■MAC and IP address of the remote PCoIP host
■MAC and IP address of the zero client
Find this information on the base of the zero client and on
the configuration record/serial number label of the remote
host. You can also use the Administrative Web Interface (section
2.9.2) to find the MAC addresses.
If your network uses DHCP, the host and zero client obtain their
IP addresses from the DHCP server. If no DHCP server is
available, the host and zero client time out after approximately
two minutes and adopt the following default IP addresses:
Zero client: 192.168.1.50
Host card: 192.168.1.100
2.5 Power supply
Amulet Hotkey DXZC-AM zero clients are supplied with a mains
to DC power supply that self-senses the incoming voltage
(110-240VAC). This power supply has a locking DC connector for
use with the zero client. To release the connector, pull the
locking sleeve away from the rear of the zero client.
Important! Use only this power supply with the product.
The Amulet Hotkey part number is CA-XX01-0011.
2.6 Network bandwidth
PCoIP uses the Internet Protocol (IP) to transmit data
between the host and client. The data can be routed over any
IP-compatible infrastructure between offices or across
continents. In every case, performance depends on the available
bandwidth and signal latency.
How much bandwidth is required? This depends on several
factors, including the number of pixels changing from frame to
frame, the number and resolution of screens to be encoded, and
settings made by the user. Different displays and usage will
generate different bandwidth requirements.
For example, a dual video head system running a word
processor, spreadsheets, and 2D illustrations/designs will
typically use between 1 and 10 Mbit/s.
Because the exact bandwidth requirements for PCoIP are
difficult to predict, use the following values as a guide only:
■With no USB or audio data, PCoIP uses approximately
32Kbit/s per pair of monitors.
■General office use (that is, writing documents) consumes
between 300-500Kbit/s.
■PCoIP only sends display changes, so an idle display
generates very little traffic.
■A significant display change (such as minimising or restoring
a window) can cause a brief peak of around 4-5Mbit/s.
■USB transfers generate up to 6Mbit/s of traffic in the
direction of the transfer.
■Audio requires around 2Mbit/s.
■Playing full-screen video can use up to 70Mbit/s.
In all cases, PCoIP builds to a lossless image. If the required
bandwidth is not available, PCoIP dynamically adjusts the quality
to match. You can also use the zero client management tools
(see section 2.9) to optimise performance for most conditions.
If bandwidth usage is a concern, we recommend testing and
monitoring on your network. For assistance, please contact
Amulet Hotkey.
2.7 LED status indicators
The DXZC-AM and DXZC-AMC have status LEDs on the front and
rear panels:
■Front panel LEDs show the status of the PCoIP connection
and the power status. See item 5 and item 6 in section 4.1
■Rear panel LEDs associated with the RJ45 or SFP network
connection indicate current network activity. See item 2 in
section 4.2.
2.8 Support for connection brokers
All Amulet Hotkey zero clients can be configured to use a third
party connection broker (also known as a connection
management server). The following connection broker products
include PCoIP support:
■VMware View Connection Server
■Leostream Connection Broker
Connection brokers simplify the administration effort for
managing large complex PCoIP systems. A connection broker
interacts with systems such as Active Directory to dynamically
assign PCoIP hosts to zero clients based on the identity of the
user establishing a connection from the zero client. Connection
brokers are also used to allocate a pool of hosts to a group of
zero clients.
You can use any of the available management tools (see
section 2.9) to specify the connection broker. You must
provide the IP address or DNS name of the connection broker.
You must also specify the ‘Connection Management Interface’
connection type for the PCoIP session.

DXZC-AM and DXZC-AMC Manual
Security Edition
www.amulethotkey.com | 10
Instructions for using a connection broker to connect your zero
clients to hosts are available in the Teradici PCoIP® Zero Client
and Host Administrator Guide (available to download from the
Teradici support site).
Note: For further information about using connection
brokers, contact Amulet Hotkey Technical Support. See
also Knowledge Base article ‘Can I use a connection broker
with PCoIP technology? (15134-24)’ on the Teradici
support site.
2.9 Zero client management tools
You can interact with PCoIP zero clients through various
management tools:
■The PCoIP Management Console allows you to centrally
administer large numbers of PCoIP devices. You can organize
zero clients into groups, define configuration profiles, and
apply configuration profiles to groups.
■The Administrative Web Interface (AWI) is a web application
that you can use to remotely configure individual zero clients
and PCoIP hosts.
■The On Screen Display (OSD) runs directly on the zero client.
It allows you to configure and view information about the
local client.
Note: For full details about these management tools, see
the Teradici PCoIP® Zero Client and Host Administrator
Guide (available to download from the Teradici website).
2.9.1 PCoIP Management Console
The PCoIP Management Console has a web interface that allows
you to manage multiple devices (PCoIP zero clients and hosts)
from a central console.
From the console, you can view the status and connection
information of all PCoIP devices. You can manage devices
individually or by group. For example, you can create device
groups based on location or department.
In particular, you can assign configuration profiles to PCoIP
devices and update device firmware (for the Teradici)
processor). You can also view device log files, reset devices, and
control the power state of devices.
PCoIP Management Console home page
Note: The PCoIP Management Console plus supporting
documentation is available for download. For more
information on the PCoIP Management Console, please
contact Amulet Hotkey Technical Support.
2.9.2 Administrative Web Interface (AWI)
The AWI is an embedded HTTPS web interface for PCoIP devices.
It enables you to remotely configure individual PCoIP hosts and
zero clients using a web browser. For example, you can set
device power settings, connection speeds, and define initial
setup parameters. The AWI also provides tools for updating the
device firmware (for the Teradici processor).
To access the AWI, browse to the IP address of the PCoIP host or
zero client (see section 2.4).
AWI example screen

DXZC-AM and DXZC-AMC Manual
Security Edition
www.amulethotkey.com | 11
2.9.3 On Screen Display (OSD)
The OSD is available when the zero client is powered on and a
PCoIP session is not in progress. Press the multifunction Power
button on the zero client front panel to display the OSD Connect
screen.
From the Connect screen, you can create a new PCoIP session
between the zero client and a remote PCoIP host card or a virtual
desktop. The Options menu in the Connect screen gives access
to various configuration pages (these pages provide a subset of
the functionality provided by the AWI). You must enter a
password to change any zero client settings; see section 2.3.
OSD Connect screen
2.9.4 Restricting access to the management tools
Note: The security measures described below recommend
disabling the Administrative Web Interface (AWI).
However, do not disable the AWI on your DXZC-AMC zero
clients until after you have made the security-based
configuration changes in section 3.
For additional security, we recommend that you disable the
Administrative Web Interface (AWI) and PCoIP Management
Console on your zero clients before you deploy the zero clients
to end-users.
With these interfaces disabled, you can only configure a zero
client through its local On Screen Display (OSD). This security
measure prevents malicious third parties from configuring your
zero clients remotely.
To disable the AWI and Management Console and restrict
configuration changes to the zero client’s OSD:
1 From the OSD Options menu, choose Configuration > Access.
2 Select both of the following check boxes:
●Disable Administrative Web Interface
●Disable Management Console Interface
If you keep the AWI and CMI enabled, so that zero client
administration is not restricted to the local On Screen Display,
you must ensure that any configuration changes are performed
from the trusted network on which the zero client is deployed.
If you are concerned about protecting administrative traffic over
an untrusted network and want to ensure that the connection is
confidential, you must use a Virtual Private Network assured to
the classification of the data being exchanged.
2.10 Cooling considerations
Amulet Hotkey zero clients are designed to operate efficiently,
over a long period in a variety of applications. However, for
reliable operation they must be correctly installed and properly
ventilated. In particular, you must always allow sufficient space
around the zero client enclosure for cool air to enter the device
and for hot air to escape. Do not block the air vents. Do not
install in a fully sealed enclosure.
Note: Amulet Hotkey zero clients are passively cooled. It is
a feature of these products that they run hot. Certain
components inside the zero client use the metal case as a
heat sink, so the unit often feels warm or possibly hot to
the touch. This is normal.
■Recommended enclosure size: To ensure adequate cooling
in dual and quad head video applications, the enclosure
must allow the following minimum gaps around the unit:
X=25mm, Y=25mm, Z=25mm.
Note: These recommendations assume room
temperature is 25°C and the enclosure is fully open
front and back for cable and switch access.
■Use a spacer to stack units: If you need to stack zero clients
on top of each other, we recommend that you separate the
stacked units with spacers where S=25mm.

DXZC-AM and DXZC-AMC Manual
Security Edition
www.amulethotkey.com | 12
Without these spacers, airflow is restricted and can cause
higher than usual temperatures in some units.
Important! Do not stack units without using spacers!

www.amulethotkey.com | 13
3. Deployment security
This section describes how to harden security for your DXZC-AM
zero clients and how to configure event logging. It also covers
secure disposal of DXZC-AM devices.
3.1 Physical inspection of the DXZC-AM enclosure
We recommend that you store and use the zero clients in an
appropriately secure environment to reduce the potential for
the device to be physically compromised.
DXZC-AM and DXZC-AMC zero clients are fitted with anti-tamper
seals on the underside of the enclosure. Inspect these seals
when you receive the zero client and thereafter at regular
intervals after deploying the zero client.
If you find any signs of interference or physical damage, you
must immediately report this to the site security administrator
and stop using the zero client. Quarantine the zero client until
the reason for interference or damage is fully understood and
appropriate precautions have been taken.
3.2 Controlling the use of USB devices
Note: You must make these configuration changes using
the Administrative Web Interface (AWI), which we
recommend that you disable before deploying zero clients
to end-users (see section 2.9.4). Therefore, you must make
the configuration changes described below on each zero
client unit before you deploy it to end-users.
The DXZC-AM zero client supports access control of peripheral
USB and audio devices. We advise that you limit the USB devices
accepted by the zero client to only include those devices that
are critical for zero client usage.
To specify or deny permissions for attached USB devices:
1 Launch the AWI for the zero client that you want to
configure.
2 From the home screen, choose Permissions > USB.
3 Specify lists of authorized and unauthorized USB devices.
You can identify devices by ID (vendor or device) or by class
(for example, ‘Mass Storage’ or ‘Wireless’).
First, add a ‘white list’ of any authorized USB devices. Then
add a ’black list’ of unauthorized USB devices.
In both cases, you can use wildcards (* and ?) to define
general device types that you want to allow or block.
Note: A list of hexadecimal vendor IDs and USB device
IDs is available at:
www.linux-usb.org/usb.ids
We also recommended that you disable the zero client audio
inputs and outputs if they are not critical to the deployment
operation. To disable audio:
1 Launch the AWI for the zero client that you want to
configure.
2 From the home screen, choose Permissions > Audio.
3 Clear the Enable HD Audio check box.
3
Anti-tamper seals on underside of the DXZC-AMC enclosure.

DXZC-AM and DXZC-AMC Manual
Security Edition
www.amulethotkey.com | 14
3.3 Event logs
Note: You must make these logging changes using the
Administrative Web Interface, which we recommend that
you disable before deploying DXZC-AM and DXZC-AMC zero
clients to end-users (see section 2.9.4). Therefore, you must
make the logging changes described below on each zero
client unit before you deploy it to end-users.
The DXZC-AM and DXZC-AMC zero clients maintain a log of
device activity and performance. The zero client supports the
Syslog and NTP protocols to centralize and improve the accuracy
of log data. We recommend that you use both of these features.
You can also specify a higher level of detail (‘enhanced logging’)
in the zero client log for one specific category of log entry. To
enable the Syslog and NTP protocols and set up enhanced
logging:
1 Launch the Administrative Web Interface for the zero client
that you want to configure.
2 From the home screen, Diagnostics > Event log.
Enable and configure Syslog logging on the zero client.
Identify the Syslog server and choose a syslog facility for your
zero clients.
You can also enable enhanced logging for a single category of
log entries, such as USB entries or Smartcard entries.
3 From the home screen, choose Configuration > Time.
Configure the Network Time Protocol (NTP) parameters to
allow zero client log entries to be time-stamped based on
NTP time. In particular, you must specify an NTP server and
the local time zone.
We also recommended that you inspect the log at regular
intervals for unexpected entries or activity. Follow your
organisation’s security procedure if the log includes unexpected
or suspicious entries that indicate possible interference. To
check the log:
■Using the On Screen Display:
a. Launch the On Screen Display
b. From the Connect screen, choose Options > Diagnostics
> Event Log.
■Using the Administrative Web Interface:
a. Launch the Administrative Web Interface for the zero
client that you want to monitor.
b. From the home screen, chose Diagnostics > Event log.
c. Click the View button.
3.4 Secure disposal of DXZC-AM and DXZC-AMC
devices
DXZC-AM and DXZC-AMC zero clients support a factory reset
option. This option resets all configuration and permission
settings stored on the device.
If you intend to dispose of these devices, make sure you apply
the factory reset, and that this reset has been effective, before
discharge.

www.amulethotkey.com | 15
4. DXZC-AM/DXZC-AMC zero client features
Amber flash Unit is starting up
Red flash Internal fault, or unrecognised or faulty
SFP module
Blue flash SFP fiber module; no network connection
Blue SFP fiber module; connected to network
Green flash SFP copper module; no network connection
Green SFP copper module; connected to network
7POWER / MENU switch. Powers the unit on or off and
displays the On Screen Display (OSD) menu.
A short button press turns on the unit. When the unit is on:
●A long button press turns off the unit
●A short button press displays the OSD configuration
menu (see section 2.9.3).
8Smart card reader.On DXZC-AMC only.
The integral smart card reader supports CAC and SIPRNet
tokens, ISO 7816 and EMV 2000 Level 1, and is compatible
with 5V, 3V and 1.8V smart cards.
For an overview of smart card authentication, see section 6.4.
4
DXZC-AM front panel
7
1
2
3
4
5
6
DXZC-AMC front panel
7
1
2
3
4
5
6
8
4.1 Front panel
1Mic socket. Microphone input on 3.5mm jack.
2Headset socket. Stereo headset (combined headphones and
microphone) input/output on 3.5mm jack.
When a microphone is plugged into the Mic socket, the
Headset socket switches to audio output only.
3Keyboard USB port. Connect a keyboard or other USB device.
4Mouse USB port. Connect a mouse or other USB device.
5PCoIP LED. Shows the PCoIP link status. When the LED is:
Off No PCoIP link is established
Green blink PCoIP link is available but not in session
Green PCoIP session is active
6DEVICE LED. Shows the power status of the unit:
Red Unit is in standby; cannot be woken
remotely (Wake-on-LAN not enabled)
Amber Unit is in standby; can be woken remotely
by Wake-on-LAN or USB activity

DXZC-AM and DXZC-AMC Manual
Security Edition
www.amulethotkey.com | 16
4.2 Rear panel
1Network port. The DXZC-AM and DXZC-AMC zero clients
have a socket that accepts an SFP module (not shown). SFP
modules are available separately from Amulet Hotkey; see
section 2.1.1.
2Network LEDs. The network port has an upper and lower
network status LED:
Upper network status LED
Off No network connection
Green Network connection; no traffic
Green flash Network connection; traffic detected
Lower network status LED
Off 10 Mbit/s connection
Yellow 100 Mbit/s connection
Green 1 Gbit/s connection
3Video output 1. DisplayPort connector.
Video output 2. DisplayPort connector.
By default, the On Screen Display (OSD) displays on
the monitor connected to video output 1. Alternatively, you
can specify video output 2 as the OSD default; you make this
configuration change in the OSD itself, in the Display
Topology screen.
4Rear panel USB ports. Use these ports to connect any USB
devices, including keyboard and mouse, if these are more
convenient than the front panel ports.
5Feature connector. Reserved for future use. Do not connect
devices to this socket unless instructed to do so by Amulet
Hotkey technical staff.
6Audio socket. Stereo line out or speaker output on
3.5mm jack.
7Locking DC inlet. You must only use the approved PSU!
See section 2.5.
6
4
5
7
3
2
DXZC-AM rear panel
1
6
4
5
7
1
3
2
DXZC-AMC rear panel

www.amulethotkey.com | 17
5. Setting up the DXZC-AM zero client
5
This section describes how to set up your DXZC-AM zero client.
For port descriptions, see section 4.
Important! Always connect the power supply last, after
connecting the peripherals!
5.1 Connect the keyboard, mouse and monitors
A zero client is always located near to the keyboard, mouse and
monitors.
■Keyboard and mouse: You can use any USB sockets, on the
front or rear panel, for the keyboard and mouse. (Although
the front panel USB sockets are labelled ‘keyboard’ and
‘mouse’, they can accept any USB device.)
■Monitors: You can use any rear panel video ports for the
monitors. The DXZC-AM supports one or two monitors.
■Audio: Use the front panel audio sockets to connect a
headset or headphones and microphone. You can also
connect speakers to the rear panel audio output socket.
Alternatively, you can connect USB audio devices to any
USB socket on the front or rear panel.
5.2 Connect to a PCoIP host
The DXZC-AM connects to a remote PCoIP host via the network
port.
DXZC-AM zero clients support the following types of PCoIP host:
■Compatible TERA2 PCoIP host in hardware.
■Compatible TERA1 PCoIP host in hardware,
■Compatible PCoIP host in software
(VMware® View™ 4 and above)
Note: For details about the available connection methods
between the DXZC-AM and a PCoIP host, see section 5.4.
5.3 Connect the power supply
Always connect the power supply last, after connecting the
peripherals. Likewise, always disconnect the power supply first,
before disconnecting any peripherals.
After powering up the zero client, you are ready to establish a
new PCoIP session. See section 5.4 for details.
DXZC-AM front
1 2
7
43
DXZC-AM rear
5
6
DXZC-AMC connections
1Headset. 2USB keyboard and mouse. 3 Network connection to
remote PCoIP host. 4USB device(s). 5 Speakers. 6 DisplayPort
connections to monitors. 7PSU.
For DXZC-AMC connections, see page 18.

DXZC-AM and DXZC-AMC Manual
Security Edition
www.amulethotkey.com | 18
5.4 Establish a new PCoIP session
After setting up your zero client, you need to establish a PCoIP
session to connect the zero client to a remote PCoIP host (or
virtual desktop). These connection methods are summarized
below. For each method, you can use any of the management
tools to establish the connection.
■Direct connections
To connect a zero client directly to a specific PCoIP host card,
use the Direct to Host session connection type. You need to
provide the IP address (or DNS name) for the PCoIP host. For
this method, you must also configure a Direct from Client
session connection type on the host.
You can also configure the Enable Auto-Reconnect setting to
remember the last connected PCoIP host. This allows the
DXZC-AM to reconnect to the host when you start a new
session.
This connection method is not practical for very large PCoIP
deployments.
■Using SLP Discovery
If your zero clients and PCoIP hosts reside on the same
subnet, you can use the Direct to Host + SLP session
connection type to discover available PCoIP hosts on the
subnet. The zero client On Screen Display lists the first 10
hosts discovered. Users can then choose the one they want
to connect to.
The Discovery connection method also supports the Enable
Auto-Reconnect setting. See the ‘Static connections’
description for details.
You must also configure a Direct from Client session
connection type on the host.
This connection method is mainly used for testing and
evaluation purposes.
Note: See section 5.4 for more information about using
the SLP Discovery connection method.
■Using a connection broker
A third party connection broker is a resource management
application that dynamically assigns zero clients to host PCs
based on the identity of the user establishing a connection
from the zero client. Use the Connection Management
Interface session connection type on both the zero client
and PCoIP host. You need to provide the IP address (or DNS
name) for the third party connection broker.
Note: See section 2.8 for more information about third
party connection brokers.
DXZC-AMC front
1 2
3
DXZC-AMC rear
54 6
87
DXZC-AMC connections: 1 Headset. 2USB keyboard and mouse.
3Smart card reader. Insert smart card with integrated circuit
chip face down and forward-most. 4 Network connection to
remote PCoIP host. 5USB device(s). 6 Speakers. 7 DisplayPort
connections to monitors. 8PSU.
■Connecting zero clients to a virtual desktop
You can configure zero clients to use PCoIP to connect to a
virtual desktop in a VMware View environment.
If you want users to log on manually, use the View
Connection Server session connection type. To set up
automatic logons, use the View Connection Server + Auto-
Logon session connection type. In both cases, provide the IP
address (or DNS name) of the VMware View Connection
Server. For automatic logons, you must also provide the
user’s logon credentials.
For full details about PCoIP connection methods, see ‘Session
Connection Types’ in the Teradici PCoIP® Zero Client and Host
Administrator Guide, available to registered users on the
Teradici Support website.
See card insert instructions below
ûü

www.amulethotkey.com | 19
6. Connect the DXZC-AM zero client to a host
6
2 Power up the zero client by pressing the power switch.
The OSD connect screen activates on the monitor attached
to video output 1.
3 Click the Connect button.
Wait while the zero client discovers and lists the available
PCoIP hosts.
This section briefly describes how to connect a zero client to a
remote PCoIP host (or virtual desktop).
6.1 Automatic connections to a host PC or virtual
desktop
You can set up zero clients to automatically connect to a remote
PCoIP host or virtual desktop when the end-user logs on. With
this setup, there is minimal impact on the end-user.
For example, at the end of the day the user logs out of
Windows, powers off their monitors, and presses the power
switch on the DXZC-AM zero client to put it in standby. In the
morning, the user presses the power switch on the zero client
to bring it out of standby. They then turn on their monitors.
There is a pause while the zero client acquires the host IP
address; the PCoIP On Screen Display (OSD) briefly shows a
connection progress screen (see below) on the monitor
attached to video output 1. After a few seconds, the user is
presented with the customary Windows login screen.
Connections methods for PCoIP sessions are listed in section 5.4.
6.2 Connect manually to a host PC or virtual desktop
This section summarizes the procedure for end-users when
using the SLP Discovery method to connect to specific host PC
(see section 5.4). Follow these steps:
1 Make sure you know the IP address (or MAC address) of the
PCoIP host that you want to connect to.
4 Select the host you want and click OK.
If the zero client successfully connects to the host, the front
panel PCoIP status LED illuminates green to indicate an
active session (see section 4.1).
6.3 Disconnect from a host PC or virtual desktop
Press the front panel Menu button and choose Disconnect from
the OSD Control Panel that appears on screen.
OSD connection progress screen
1
OSD connect screen: 1Connect button.
OSD Control Panel. 1Disconnect option.
1

DXZC-AM and DXZC-AMC Manual
Security Edition
www.amulethotkey.com | 20
6.4 Smart card authentication
Applies to DXZC-AMC only.
The DXZC-AMC features an integral smart card reader that
supports 5V, 3V and 1.8V smart cards, including support
for Common Access Card (CAC) smart cards and SIPRNet
hardware tokens.
Important! Users must always insert smart cards into the
smart card reader with the integrated circuit chip (ICC)
facing down and forward-most. For example, this means
that CAC cards are inserted upside down and with the
chip towards the slot.
Depending on your security requirements, the integral smart
card reader can be configured for pre-session or in-session
authentication:
■Pre-session authentication: The smart card is used to
authenticate the user before a PCoIP session is established.
This allows the user to log on directly to their virtual
desktop. After supplying their smart card PIN, they do not
need to separately connect to their remote PCoIP host or log
into their desktop OS (typically Windows) .
The requirements for pre-session authentication are
summarized in Teradici Knowledge Base article Do PCoIP
zero clients support pre-session smart card authentication?
(15134-299). Teradici Knowledge Base articles are available
to registered users at techsupport.teradici.com.
■In-session authentication: The smart card is used to
authenticate the user after a PCoIP session has been
established. That is, the user first connects to their virtual
desktop or remote workstation in the normal way (see
section 6.1 and section 6.2. The smart card is then used to
log the user into their desktop OS.
For further information about zero client security, see the
Teradici PCoIP Zero Client and Host Admin Guide, particularly
the ‘PCoIP Zero Client Security Overview’ and ‘Security settings
Checklist’ sections. This manual is available on the Doc Center
page of the Teradici Support site at techsupport.teradici.com.
DXZC-AMC front panel: Flip the smart card over and insert with
integrated circuit chip (1)facing down and forward-most.
Typically, DXZC-AMC zero clients require no additional PCoIP
configuration to support smart card user authentication (but
see the note below).
Note: For CAC cards that support both the modern
Personal Identity Verification (PIV) interface and old-style
CAC (GSC-IS) interface, it is possible to configure zero
clients to prefer the GSC-IS interface. For details see the
Teradici PCoIP Zero Client and Host Admin Guide .
ü
û
1 1
Chip on underside of card