AWS workspaces medium security documentation change
Summary
Added documentation for IPv6 network settings configuration and updated automatic client update procedures
Security assessment
The change adds IPv6 configuration guidance and registry settings, which introduces network security considerations. The automatic update section now explicitly states administrator privileges are required and provides Group Policy deployment instructions for update controls. The release notes mention fixing an automatic update failure scenario (installed in custom folders), which could have prevented security-critical client updates from being applied.
Diff
diff --git a/workspaces/latest/userguide/amazon-workspaces-windows-client.md b/workspaces/latest/userguide/amazon-workspaces-windows-client.md index 116a7fc55..a6ed0ff59 100644 --- a//workspaces/latest/userguide/amazon-workspaces-windows-client.md +++ b//workspaces/latest/userguide/amazon-workspaces-windows-client.md @@ -5 +5 @@ -RequirementsSetup and installationDetermine your client versionClient application updatesConnect to your WorkSpaceManage your login information (3.0+ clients only)Client viewsClient languageDisplay supportProxy serversCommand shortcutsDisconnectClipboard supportManage hardware accelerationDiagnostic log uploadRelease notes +RequirementsSetup and installationDetermine your client versionClient application updatesIPv6 network settingsConnect to your WorkSpaceManage your login information (3.0+ clients only)Client viewsClient languageDisplay supportProxy serversCommand shortcutsDisconnectClipboard supportManage hardware accelerationDiagnostic log uploadRelease notes @@ -20,0 +21,2 @@ The following information will help you get started with the WorkSpaces Windows + * IPv6 network settings + @@ -82 +84 @@ The Amazon WorkSpaces client application on Windows will automatically check for -Client updates will maintain the same installation context as the original installation. This means if the Amazon WorkSpaces client was originally installed for all users on the local machine, future automatic updates will apply to all users. Similarly, if the client was installed for a single user, future updates will only apply to that specific user. Should you need to change this behavior, you can uninstall the client application and reinstall it under your preferred installation context. +Client updates maintain the same installation context as the original installation. This means if the Amazon WorkSpaces client was originally installed for all users on the local machine, future automatic updates will apply to all users. Similarly, if the client was installed for a single user, future updates will only apply to that specific user. Should you need to change this behavior, you can uninstall the client application and reinstall it under your preferred installation context. @@ -86 +88 @@ Client updates will maintain the same installation context as the original insta -Automatic client updates are only applied when your client application is used to connect to WorkSpaces in the below regions. +Automatic client updates are only applied when your client application is used to connect to WorkSpaces in the following regions. @@ -88 +90 @@ Automatic client updates are only applied when your client application is used t -Region | Address +AWS Region | Address @@ -114 +116 @@ We encourage you to take advantage of the new automatic client update feature so -Administrator privileges are required on the local device. +Opting out from automatic updates is supported for the Windows client application only. @@ -116 +118 @@ Administrator privileges are required on the local device. -###### To disable automatic updates: +Administrator privileges are required on the local device. @@ -145,0 +148 @@ Administrator privileges are required on the local device. + 9. For organizations managing multiple Windows devices, this registry setting can be deployed using Group Policy: @@ -146,0 +150,3 @@ Administrator privileges are required on the local device. + HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\Amazon WorkSpaces Client\clientUpgradeDisabled + Type: REG_SZ + Value: 1 @@ -149 +154,0 @@ Administrator privileges are required on the local device. -For organizations managing multiple Windows devices, this registry setting can be deployed using Group Policy: @@ -152,3 +157,3 @@ For organizations managing multiple Windows devices, this registry setting can b - HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\Amazon WorkSpaces Client\clientUpgradeDisabled - Type: REG_SZ - Value: 1 +## IPv6 network settings + +The WorkSpaces Windows client application supports connecting to your WorkSpace using IPv4, IPv6, or dual-stack (both IPv4 and IPv6) addresses. By default, IPv4 connections are used for streaming. IPv6 connections are disabled by default, meaning that your client application will exclusively use an IPv4 network for your connection. If you enable IPv6 connections, your client application will prioritize using an IPv6 network, but will fall back to using an IPv4 network if IPv6 is not available. @@ -158 +163,33 @@ For organizations managing multiple Windows devices, this registry setting can b -Opting out from automatic updates is supported for the Windows client application only. +IPv6 connections are supported on the WorkSpaces client application version 5.30.1 or later. + +You cannot change IPv6 connection settings if you are connected to your WorkSpace. Change the setting before connecting to your WorkSpace. + +Use the following procedure to enable IPv6 connections. + + 1. In the WorkSpaces client application, navigate to **Settings >, Manage Connection Settings**. + + 2. Under **General Connection Settings** , choose **Prefer IPv6-enabled communications**. + + + + +Alternatively, you can also enable IPv6 connections by using the following registry key: + + 1. On the Windows client, enter `registry editor` in the Windows search bar. + + 2. Right-click on **Registry Editor** and select **Run as administrator**. + + 3. If prompted for permission, choose **Yes**. + + 4. In the Registry Editor, navigate to: `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\Amazon WorkSpaces Client\` + + 5. Within this key, create a new DWORD (Double Word) Value named `WSUseDualStackIPv6`. + + 1. Set its value to `1` to enable IPv6 preferred connections. + +Set its value to `0` to disable IPv6 preferred connection, and enable IPv4 connections exclusively. + + 6. Changes you make will take effect the next time you launch the WorkSpaces client application. Users can modify this setting, but it will revert to the default registry key value when the client is relaunched. + + + @@ -537,0 +575,12 @@ Release | Date | Changes +5.30.0 | October 21, 2025 | + + * Improved international keyboard experience with new keyboard layout options (server or client) with DCV-based WorkSpaces. + * Added support for generic USB redirection, enabling local USB devices to work with Windows-based Personal WorkSpaces using the DCV protocol. + * Made an improvement that enables microphone audio streaming only when a remote application is using it, helping to optimize performance. + * Fixed an issue with the automatic update function which was preventing automatic updates if the client is installed in a custom folder. + * Fixed an issue that caused the application to crash under certain conditions when streaming with DCV. + * Updated the DCV SDK. + * Updated the PCoIP SDK. + * Updated the .NET Framework. + +