VDI, or Virtual Desktop Infrastructure, refers to an architecture where users’ workstations no longer run on their physical machines, but on centralized servers. Each session is hosted in a dedicated virtual machine, accessible from any terminal. The concept has existed for over a decade, but recent regulatory constraints, notably the NIS2 directive in Europe, are transforming how companies approach these projects.
VDI and the NIS2 Directive: A Regulatory Framework That Changes the Game
The European NIS2 directive, currently being transposed into French law, expands cybersecurity obligations to several thousand companies. Remote access environments, of which VDI is a part, are directly affected.
The requirements focus on session traceability, access logging, and proof of resilience in the event of an incident.
In practical terms, deploying a VDI is no longer just a comfort choice for remote work. It is about integrating this component into a comprehensive risk management approach: network segmentation, systematic multi-factor authentication, continuous monitoring. To understand what VDI means in IT in this new context, one must go beyond the simple technical definition and consider the entire compliance chain.
Companies that had implemented a VDI before these obligations sometimes find themselves needing to redesign their architecture to meet new governance and oversight requirements.
VDI Architecture: Persistent or Non-Persistent Desktop
The choice between a persistent and non-persistent desktop conditions the entire operation of a VDI environment. This is not a mere implementation detail: it is a structuring decision that has consequences for security, costs, and user experience.
Persistent Desktop
Each user has a virtual machine that is permanently assigned to them. They find their files, settings, and applications every time they log in. This model suits profiles that need a personalized environment (developers, graphic designers, analysts).
The downside is significant: each persistent VM continuously consumes storage and memory, even when the user is disconnected. Updates are managed on a per-workstation basis, just like in a traditional physical setup.
Non-Persistent Desktop
The user receives a generic VM for each session, recreated from a reference image (sometimes called a “golden image”). Upon disconnection, the VM is destroyed or reset.
This model significantly reduces the attack surface and simplifies maintenance. However, user customization requires third-party tools to persist profiles and data between sessions. Without these additional layers, the experience can frustrate users who lose their settings with each reconnection.
VDI, RDS, and DaaS: What Really Distinguishes Them
The confusion between VDI, RDS (Remote Desktop Services), and DaaS (Desktop as a Service) persists in many projects. All three allow remote access to a desktop, but their technical functioning and business models diverge.
- VDI assigns a dedicated virtual machine per user, with a complete operating system (usually Windows). Each session is isolated from the others.
- RDS shares a single instance of Windows Server among multiple users. It is less resource-intensive, but isolation between sessions is limited, and some applications do not function properly in a shared environment.
- DaaS outsources the hosting of the virtual desktop to a cloud provider. The company no longer has to manage the server infrastructure but relies on a third party for data availability and compliance.
The choice between these three approaches depends on the required level of isolation, the infrastructure budget, and the IT team’s ability to manage the environment. The threshold at which VDI becomes more cost-effective than RDS varies greatly depending on the number of users and the complexity of business applications.
Concrete Limitations of VDI in Production
Marketing content around VDI highlights security and flexibility. Operational limitations deserve equal attention.
The initial sizing remains the major friction point. Undersizing storage or memory immediately degrades the user experience, with latencies that render the virtual desktop unusable. Peaks in simultaneous connections (Monday mornings, post-incident recovery) require reserve capacity that many projects underestimate.
Network dependency is total. Unlike a physical workstation that operates locally, a VDI without a stable connection is useless. Users on the move or in areas with poor network coverage remain disadvantaged.
The software ecosystem also raises questions. Some business applications, designed to run on a physical workstation with specific peripherals (scanners, specialized printers, USB dongles), require redirection layers that complicate the architecture and multiply points of failure.
Zero Trust and VDI: Towards What Security Architecture
Recent analyses show a convergence between VDI projects and Zero Trust architectures, where no terminal or user is considered trustworthy by default, including VDI workstations within the company’s network.
This approach mandates systematic verification of identity, connection context, and terminal security posture before granting access to the virtual desktop. It is accompanied by increasing automation of incident response: anomaly detection on a VDI session, automatic isolation of the affected VM, notification to the monitoring team.
For companies subject to NIS2, this combination of VDI and Zero Trust directly addresses the requirements for segmentation and rapid incident response. The adoption of this model in French SMEs remains difficult to quantify, but the trend is clear among large accounts and managed service providers.
VDI is no longer just a virtualization tool for workstations. It is an architectural component that engages the security, compliance, and IT governance of an organization. Projects that approach it solely from a technical or budgetary perspective miss the real arbitration, which now plays out in the regulatory field and on the ability to prove mastery of one’s remote access environment.