1. Create a new group of managed computers. All created Virtual Desktops will move into it.
2. Exclude this group from all inherited tasks: Find Vulnerabilities and Window Updates task and Fix Vulnerabilities and required Updates task.

Network Agent Policy

1. Create a Network Agent policy.
2. Go to the Repositories tab. Clear all selected options and lock them.
   • Details of Windows Update updates
   • Details of software vulnerabilities and corresponding updates
   • Hardware registry details
   • Details of installed applications

3. Go to Software updates and vulnerabilities. 
4. Select Disabled for the Windows Update search mode setting and lock it.
5. Clear the Scan executable files for vulnerabilities when running them checkbox and lock the setting.

Secure Virtual Machine Policy

1. Create a Secure Virtual Machine policy in the group of managed computers where SVMs are located. 
2. Open Update settings and clear the Update Application Modules checkbox. Close the lock.

3. Go to Settings for connecting SVMs to the Integration Server and specify the IP address (or FQND) of the machine with the Integration Server (the IP address of the Administration Server). Close the lock.

4. Verify that the policy is applied on the Secure Virtual Machines.

Windows Light Agent Policy

1. Create the policy for the Light Agent for Windows. 
2. Open the policy properties and go to Anti-Virus protection → General Protection Settings.
3. In the Exclusions and trusted applications section, click Settings.
4. If the VDI infrastructure is used in a Citrix environment, enable exclusions and trusted applications for Citrix Virtual Apps and Desktops (Citrix XenApp and XenDesktop), Citrix Provisioning (Citrix Provisioning Services), Citrix Profile Manager. If they're not in the list, create a new policy and add them at the Exclusions step.
5. If the VDI infrastructure is used in a VMware environment, enable exclusions and trusted applications for VMware Tools and VMware Horizon View. If they're not in the list, create a new policy and add them at the Exclusions step.
6. If roaming user profiles are used, specify the path of the network folder where the profiles are located to avoid scanning on both a network and local level.
7. Go to the SVM discovery settings section. Make sure that Use Integration Server is selected and that the lock is closed.

8. Go to Integration Server connection settings.
9. Specify the IP address (or FQDN) of the machine where Integration Server is installed (the IP address of the Administration Server). Close the lock.

1. Launch local installation of Kaspersky Network Agent on the golden image. 
2. At the Advanced settings step, clear the checkbox Automatically install applicable updates and patches for components that have the Undefined status.
3. Select the checkboxes Enable dynamic mode for VDI. and Optimize the Kaspersky Security Center Network Agent settings for the virtual infrastructure. Disable vulnerability scan and inventory of applications and hardware.You can edit the current settings through Network Agent policies.

4. After Network Agent has installed, open services.msc and launch Network Agent manually. 
5. Launch the local installation of Kaspersky Security For Virtualization 5.x Light Agent on the golden image.
   • If you are using Citrix XenDesktop, select the checkboxes Ensure compatibility with Citrix Provisioning (Citrix Provisioning Services) and Installation on the template for temporary VDI pools.
   • If you are using VMware Horizon View, select the checkbox Installation on the template for temporary VDI pools.

If the Installation on the template for temporary VDI pools checkbox is selected, updates that require a protected virtual machine to restart will not be installed on the virtual machines deployed using this template. At the same time, Kaspersky Security Center will send messages that database and application modules updates are required on the template.

We do not recommend selecting the Installation on the template for temporary VDI pools checkbox if the template will be used for creating a VDI infrastructure of one of the following types:

• The static dedicated catalog with local drives in Citrix Virtual Apps and Desktops (Citrix XenApp and XenDesktop)
• VMware Horizon View automated pool of the full clone type

What to do after the installation

1. Verify that the Windows Light Agent policy has been applied. The golden image should have been handled by relocation rule created in Kaspersky Security Center. If the golden image does not meet the conditions of the relocation rule, move it manually into the managed group created for virtual machines. 
2. Verify that the Light Agent is connected to the SVM: open the Support window locally in the interface of the Light Agent for Windows.
3. Restart the golden image.
4. Sign in to the system once it has restarted. 
5. Shut down the golden image.

You can now deploy VDI machines from this golden image.