Ivanti Blog: Posts by

Announcing Ivanti User Workspace Manager 2021.3

Wed, 17 Nov 2021 22:14:48 Z

We’re pleased to announce release 2021.3 of Ivanti User Workspace Manager. The new release includes significant new capabilities for Ivanti Application Control and Ivanti Environment Manager.

Windows 11 and Server 2022 OS Conditions

UWM 2021.3 includes conditional operating system support for both Windows 11 and Server 2022. The following documents, published on the Ivanti User Forum, provide for further information on our Windows version support:

UWM Windows 10 and Server OS Support Statement

UWM Windows 11 Support Statement

Application Control

Integration with Ivanti Neurons for ITSM

Policy change request has been enhanced to include integration with Ivanti Neurons for ITSM. If a user needs to install an application or requires access otherwise normally restricted – rather than having “no” be the end of the story – from within Application Control, they can now request temporary privileges. This launches a request to Ivanti Neurons for ITSM. If the request is approved, the user gets temporary access to the application/privileges they need. No need to sacrifice either productivity or security.

Event Viewer Enhancements

The event viewer tool became a part of Application Control in the 2021.1 release. Already proving to be popular with our customers, the 2021.3 release provides several key enhancements. Users can now track Policy Change request events and can select events for pre-configured views with multiple events. A new Parent Process column in the event summary view provides better context for those events being tracked. Additionally, users can now specify a Deployment Group as part of a query and save the results of a query for working offline.

Microsoft Recommended Block Rules

It has long been possible to copy or share sets of rules between Application Control installations via the use of snippets. There is a library of snippets available on the Ivanti Marketplace. Beginning with this release, a snippet containing the set of rules recommended by Microsoft is now included as part of the Application Control installed application. We recommend all customers review the snippet and consider including it in their policies.

Environment Manager

Endpoint Analysis Tool

Gain environment wide insights into the applied EM Policy Configuration on every device.

The Environment Manager Endpoint Analysis Tool enables analysis of policy configurations on endpoints using endpoint logging data. The tool detects and highlights configuration issues that may exist so that administrators can quickly investigate and diagnose the causes to help make the necessary changes.

In addition to its value in troubleshooting or debugging configuration issues, the tool enables risk assessment of planned upgrade or system changes.

Non-Virtualized Application Group Personalization

The behavior and performance of certain applications can be adversely affected when their user settings reside within a virtual cache. Where critical functions rely upon interaction with third party or OS resources it has been previously necessary to shift management of them from Application Groups to Windows Settings Groups (WSGs).

With the 2021.3 release, Environment Manager offers real flexibility where this scenario occurs. Configured on a per-Application Group basis, the ‘Non-Virtualized’ Application Group (or NVAG) option enables captured settings to remain in the real file and registry locations - as opposed to the default virtual cache.

Synchronization continues to occur at start and end of the application groups processes. The result is optimal performance with no hindrance to users at on Logon or Logoff.

Additional New Features

In addition to the enhancements to Application Control and Environment Manager, UWM 2021.3 includes enhancements to Ivanti File Director and to the UWM Management Center. You can learn more about the 2021.3 release in the Ivanti Community Forum - User Workspace Manager. And check out our new webinar, Amazing Employee Experiences, One Desktop at a Time, now available on-demand.

Ivanti User Workspace Manager Update: 2021.1 Release

Wed, 12 May 2021 20:50:18 Z

Ivanti User Workspace Manager (UWM) 2021.1 is a major release focused on quality, stability and several feature enhancements.

8 feature enhancements.
62 customer bugs resolved.

Event viewer for application control

As of version 2021.1, Application Control offers a native user interface inside the AC console. This interface presents an aggregated view of events captured from all managed endpoints. The events are filtered and categorized on a per-feature basis and can be seamlessly translated into policy actions via drag-and-drop functionality.

See our feature video for more information and a quick demo of how this update smooths your Application Control journey:

VHD(X) cache roaming enhancements

The Environment Manager VHD Cache Roaming solution has been extended to support VHD(X). This disk type offers the following benefits:

Optimal VHD type for modern operating systems.
Larger storage capacity and data corruption protection.

Live resizing and smooth data alignment.

Windows 10 start menu builder update

Create tailored application list with blank tile group layout.

You can now create and deliver a personalized start menu application list without impacting/modifying users’ existing tile groups.

Personalization operations enhancements

Delete full user profile

Now IT/Service Desk has the option to swiftly delete all current settings for the specified user. This replaces complex scripts previously required for this operation.

Allow membership of multiple groups

PersOps now aggregates role memberships to support functions against users, satisfying the criteria of multiple groups.

Upload events on demand from the management console

“Upload events now” action

A new action has been added to the management console: upload events now. This action immediately upload events from deployment group endpoints to the server.

CCA: Command line tool enhancement

Additional CCACMD.EXE Command line functionality

/pollnow

Initiates a poll to the server.

/move

Initiates a request to move the computer to another group.

File Director: SQL dependency removed

Removal of shared external database requirement

The 2021.1 release of File Director removes the requirement for an external SQL database.
This development simplifies infrastructure requirements and File Director configuration.

Potential saving of $$$ in SQL costs on upgrade to 2021.1.

File Director: administrative enhancements

The following improvements have been introduced in the 2021.1 release of File Director:

Snapshots optimized to be configuration only.
Updated admin UI diagnostic capabilities.
Ability to change appliance password from web admin console.
Kerberos authentication testing/troubleshooting inside Admin UI.
VMXNET3 (10GB) support.
Improved client logging.
Environment variable support in path-based expressions.
User data and performance dashboard updates.

Ivanti User Workspace Manager Update: 2020.2 Release

Thu, 17 Sep 2020 20:55:58 Z

Today (September 17th, 2020) heralds the release of Ivanti User Workspace Manager (UWM) 2020.2 – a significant release for our UWM customers.

16 Feature Enhancements
47 Customer Bugs Resolved

IT organizations have faced a year like no other in 2020. The pandemic triggered a 180°degree shift in working habits and patterns for many, in some cases overnight. Thankfully Ivanti UWM 2020.2 is here and brings with it a set of tools and remediations tailored to conquer the challenges of delivering an ambient user experience on the modern, 2020 workspace….

Ambient Windows 10 and Edge Chromium Experience, Regardless of Location

Windows 10 Start Menu Builder

This release introduces the Environment Manager Windows 10 Start Menu Builder - a great new feature that provides a matchless solution to deployed Start menu customization. This solution enables the delivery of a customized, productive Start Menu across both single user (Windows 10) and multi-user operating systems.

Edge Chromium Personalization Template

This Marketplace template enables the capture and persistence of user preferences inside of the most rapidly adopted browser in 2020.

File Type Exclusions for Windows Settings Groups

Custom Windows settings enable you to personalize registry keys, folders, and files by specifying which of these are to be included (or excluded) from the personalization database. Environment Manager 2020.2 provides a greater depth of Administrative granularity, introducing the ability to exclude specific file types without having to specify their folder path.

Sync of Windows Settings over VPN

At logon, a sync of the user’s Personalized Windows Settings preferences is attempted. The result of this sync is dependent upon a stable connection having already been established with the Personalization Server.

As of Environment Manager 2020.2 an Engineering Key is available which - when configured and enabled - ensures the timings of the sync and the VPN connection are in harmony. The result… a consistent delivery of a familiar, personalized user desktop regardless of location.

Privilege Management – Secure session with zero disruption

UAC Replacement

A complement to the existing Self-Elevation functionality, UAC Replacement enables the configurable bypass of the prompt and request for credentials where elevation is required. Where configured, the benefits include a reduction in the distribution of Admin credentials and a lighter weight administrative effort in discovering and remediating requests for on-demand elevation.

URL Redirection – Edge Chromium Support

A secure and seamless browser experience. The autonomous redirection of URLs as configured by the Administrator is now supported in conjunction with the Edge Chromium browser:

On-Demand Elevation of the ‘Add/Remove’ Windows 10 Settings Application Component

As of 2020.2, there is no longer a requirement to elevate the user token for the duration of the sessions to meet a user requirement for uninstalling and modifying programs. You can now empower standard users to uninstall and modify programs on Windows 10 via the Windows 10 Settings application (via Application Control component elevation functionality).

Global Style Update

The 2020.2 release introduces a design update for default global styles. The new style uses a larger message box format to accommodate more detailed information; and the default messages no longer use a logo, instead they feature a color-coded banner.

The update is backwards-compatible, enabling you to continue using the previous classic styling, or to apply the style update to your existing configurations as required.

Extended Auditing Events

Two additional event IDs have been added: 9060 and 9061. By default, both events are disabled. If required, they can enable organizations to differentiate execution requests blocked by Trusted Ownership from those blocked explicitly by a Rule Policy.

User Data Management – Cloud storage enablement

OneDrive Storage – OneDrive Delta API

As of 2020.2 File Director utilizes the Microsoft OneDrive Delta API to ensure the most efficient, response sync experience for the end user. Benefits include a lighter touch logon and autonomous detection and application of out-of-band changes between devices and platforms.

Web Proxy Support

File Director can now be configured to use a web proxy for external services connections such as OneDrive, Google Drive and Box for example:

OneDrive Storage – Additional Character Support

Paths containing the characters # and % will successfully sync with OneDrive storage as of the 2020.2 release.

Cluster Wide Maintenance Mode Activation

A cluster of File Director Appliances can now be disabled simultaneously with a single click, reducing the time and effort previously demanded when performing environment wide maintenance or troubleshooting.

Also included….

A huge focus on performance and experience in this release of Management Centre. 16 customer bugs addressed including several targeting the responsiveness of the Console when navigating between deployment groups.

Explore User Workspace Management Here

Learn more about the 2020.2 release in the Ivanti Community Forum - User Workspace Manager.

File Director: Delivering OneDrive Storage On-Demand to Your Citrix Servers (Including Server 2016)

Thu, 08 Aug 2019 21:59:22 Z

Mandated with moving all personal user data from on-premises to OneDrive storage (free 1TB per licensed Office 365 user) but worried about disk space rapidly filling on your Citrix servers? File Director is your key to a smooth and seamless migration with on-demand sync and local cache cleanup capabilities across Server 2012, 2016 and 2019 operating systems.

The Ivanti® File Director OneDrive Connector solution allows IT to capture, control, and audit Office 365 users’ 1TB of OneDrive storage and Google Drive storage. The Connector uses File Director’s granular sync engine and In-Location Sync capabilities to migrate user files smoothly to OneDrive cloud storage. However, as with on-premises storage, users’ everyday Windows experience when accessing files and folders is unaffected.

With File Director acting as an on-premises broker to OneDrive, IT has complete audit and visibility of how OneDrive storage is being used, while delivering a familiar user experience that feels just like using any other file server. No special folders, no clunky redirection, no endpoint device limitations.

File Director’s capabilities don’t end with the cloud Connectors. Acting as a broker between the user workspace and cloud or on-premises storage, File Director makes data migration fast, secure, and invisible to the user. For Windows 10 migration projects, File Director ensures that users’ files and folders from their old Windows workspace are available immediately in their new Windows 10 workspace by syncing data either in real time, in the background, or on-demand, so users gain a new Windows 10 workspace that looks familiar, instantly.

Primary File Director Use Cases

Let’s dive into some key capabilities of File Director that stand it above competitors when it comes to cloud migration support… especially where local disk space is at a premium.

Sync On-Demand for both cloud and on-prem storage on RDSH (Including Server 2016) and VDI

Local user cache management of OneDrive and on-premises storage both in session and at user Logoff

Granular data sync controls. Sync only what is required based upon global and local user policies

Learn more about how Ivanti File Director can help your business unlock the 1TB of OneDrive cloud storage.

FDmon – Endpoint Analysis Tool for File Director

Tue, 23 Apr 2019 21:39:40 Z

The File Director agent for Windows is a powerful sync engine for files stored locally on the desktop. It enables the administrator to configure granular file synchronization to a mix of datacenter and cloud (OneDrive or Google Drive) storage, with the backing of enterprise-grade auditing and reporting.

Ensuring you have the tools to manage, monitor and configure the product in order to deliver the best user experience is a priority at Ivanti, so we are adding an exciting new utility to the product toolkit, announcing...

FDmon

FDmon provides detailed, graphical analysis of File Director Windows client activity for troubleshooting and improved configuration. If you feed FDmon client log files it will present you with a set of dashboards and reports that give both an overview of File Director activity and performance but can also be used for deep drive troubleshooting.

Here are just a few examples of how FDmon can assist you.

Endpoint Reports

User Configuration and Sync activity coupled with Client performance all in one handy view:

Endpoint Details: Client performance including CPU spec and system uptime
Engineering Keys: A resultant set of File Director policies on the client
Queues: Monitor the status of all sync jobs captured within the log
User Settings: User configuration information

Log Search

In the scenario of a reported sync failure this could prove very useful:

Search for specific files/paths to troubleshoot failure reports
Sort by time stamp to search by timeframe
Easily identify and follow a Thread ID to track an activity of interest from start to finish
Edit your filters and build your queries with a multitude of conditions:

Advanced Reports

For those administrators that are more experienced with File Director, there are a few more advanced reports that could be of great use to you. Some examples:

Noisiest Trace Lines

Longest Calls

Frequent Driver Calls

As you can see, FDmon is an amazing addition to the File Director product set and will simplify troubleshooting of a range of client problems. Please visit the Ivanti Marketplace to download the FDmon Tool.

DataNow to File Director: The Evolution

Wed, 27 Mar 2019 21:03:41 Z

Should you consider any item on the list below a current or future challenge, then this blog is for you. Ivanti File Director delivers upon each of these use cases and much much more. Read on to discover how the product has evolved to get to the enterprise scale data management solution it is today:

Managing the local desktop file data of your users throughout and beyond Windows 10 migration.
Reduce laptop/desktop break-fix cost and effort
Replace Microsoft Offline Files
Unlock the 1TB of free OneDrive storage that every Office 365 user gets
Files on demand for OneDrive on Windows Server
Centrally manage and deliver both cloud and on-premises file data on-demand to physical and virtual devices, including Windows, Mac, iPad, iPhone and even Android
Secure auditing of sync activity on both a global and per-user / per-machine level.

AppSense DataNow – A Brief History

Rewind seven years and AppSense is the market leader in user profile management with Environment Manager’s groundbreaking Personalization capabilities taking the market by storm (still is and still are). Accompany this with a rich, granular policy engine and administrators could control and personalize the user’s desktop and their settings from one centralized platform.

A personalized, responsive desktop is a great profile management story but only one chapter in the book of a productive end user. Applications and profiles are nothing without data and access to that data needs to be instant and readily available using a simple method familiar to the user. In order to complete the user settings + data management story AppSense introduced DataNow to its portfolio.

DataNow was released with a ‘DropBox for the Enterprise’ label. A method to securely share documents, across multiple platforms, was in demand following some very public failings of DropBox to securely store sensitive user information. Unlike the more consumer-centric services, DataNow offered organizations the ability to store the data in a private cloud within the enterprise's own IT environment using a virtual appliance created to enable the flow of data.

DataNow as an EFSS Solution:

DataNow adoption as an Enterprise File Synchronization and Share (EFSS) solution was slow and steady. There were questions over client stability and scalability, and it is fair to say the product had its fair share of challenges in its early days. Over time these challenges were understood and owned by our product teams, working closely with our vast array of enterprise customers to help satisfy the demands of an enterprise data management solution and meet the key use cases the market demands of us.

Ivanti File Director and the Roaming User

Fast forward to 2019 and the product to deliver upon these local file management use cases is now known as Ivanti File Director. No longer just a file sharing solution, File Director tackles all the data challenges facing a roaming user in a modern world.

Here is how File Director can help you roam users’ data seamlessly across devices and platforms. Ranging from Win 7 to Win 10 migrations over to RDSH and VDI session-hopping, File Director is your solution of choice:

File Director vs SMB File Shares

A native, non-disruptive data capture and restore user experience.

The ‘In-Location-Sync’ feature ensures user files are synced to on-premises or cloud storage from within their current folders and locations. Files within a user’s existing profile are synced automatically from their current location, for example, from the Desktop, Documents, or Downloads without User Shell set redirection or file copies. The feature also ensures that applications work as before as the files are managed from within the locations they are hard-coded to read from.

At first logon to a new OS or refreshed device the files are restored exactly where they left them on the previous client. There is no digging around for files within secondary locations accessible via the system tray as is the case with other solutions.

We Truly Sync ‘Files on Demand’ on any platform including RDSH on Windows Server 2016 and 2019, and Windows 7.

File Director has been delivering files manually, on-demand for years and we can support you on any modern OS be it single or multi-user, when employing this capability. With a manual Map Point configured, the end user will see file listings instantly appear at logon for all captured server data giving them the impression every file is available locally.

The files will then be synced on-demand as and when the user requires them. The user can manually override the sync options of any folder and can initiate the download and local caching for the duration of the session, if desired.

Control which files sync based upon a granular sync policy exclusion engine.

Manage Sync activity on a per user or device basis. Exclusion criteria such as file type, size, age, path etc. are available. Administrators can also apply bandwidth control to sync activity ensuring logon storms and migrations are handled smoothly and not at the detriment of the wider network.

You can finally replace Offline Files with a solution that works.

Not many will shed a tear at the prospect of moving away from Microsoft Offline files. Various design flaws around support for encrypted files, its ability to detect offline state and minimum permission set requirements mean it can not be relied upon to deliver and maintain offline access for remote workers. It also requires a VPN connection back to the file servers, and cannot work over a pure HTTPS web connection.

File Director integrates with existing file shares and environments transparently, utilizing current NTFS permissions, ensuring zero impact on data storage, redundancy and business continuity plans. File Director also provides industry standard encryption of data – both in-transit and at rest on mobile devices – for improved governance and compliance when storing files offline.

Low disk space? No problem, we clean up after ourselves.

File Director Cache Management can be configured to clean up the local copy of any file after it has been closed by the user. This can result in a truly on-demand experience and zero touch approach to local disk space. This feature can be hugely beneficial on low disk VDI and shared terminals where large numbers of sessions are caching data locally.

Central management of cloud and on-premises storage

Unlike other cloud-only solutions, File Director can be configured to manage access to cloud storage via one map point and on-premises storage to another, both within the same session. We also provide tools to help you seamlessly migrate user home drives from on-premises to cloud storage.

Secure environment auditing and health monitoring

File Director outputs a constant stream of syslog data from the server containing sync activity on a per user + device basis. This data can be analyzed and reported upon using 3^rd party tools such as Splunk. Client data is also outputted to the local event log and can be centrally reported on from the Ivanti Management Center.

Choose File Director to unlock 1TB of free OneDrive storage

Challenges with Office365’s OneDrive cloud storage

Because OneDrive storage is provided to users – not IT – administrators lack the controls needed to view and manage its content. Accessing and using OneDrive typically requires changes to user working behavior. This typically requires user training and increases in helpdesk calls. Additionally, users employing multiple devices to do their work may find that they can’t access OneDrive from some of them.

Ivanti OneDrive Connector – Capture, control, and audit OneDrive

File Director’s OneDrive Connector solution allows IT to capture, control, and audit Office 365 users’ 1TB of OneDrive storage. The connector uses File Director’s granular sync engine and In-Location Sync capabilities to migrate user files smoothly to OneDrive cloud storage. However, as with on-premises storage, users’ everyday Windows experience when accessing files and folders is unaffected.

With File Director acting as an on-premises broker to OneDrive, IT has complete audit and visibility of how OneDrive storage is being used, while delivering a familiar user experience that feels just like using any other file server. No special folders, no clunky redirection, no endpoint device limitations.

File Director’s capabilities don’t end with the OneDrive Connector. Acting as a broker between the user workspace and cloud or on-premises storage, File Director makes data migration fast, secure, and invisible to the user.

The following table summarizes many of the capabilities described above. If you’d like to learn more you can read about File Director or speak with your partner or Ivanti account rep.

Key Capabilities	File Director	OneDrive For Business
Flexible sync options on Server OS include background sync, real-time or ‘Files on Demand’ to cater for limited local disk resource or slow networks	✔	✖
Local Cache Management – the ability to reduce the size of local endpoint file caches based on the last access time of files	✔	✖
Secure Auditing for physical and virtual endpoints enables IT to quickly identify potential network or storage requirement issues	✔	✖
Native User Profile ‘In-Location-Sync’ allow users to save files anywhere and have them synced centrally to eliminate data sprawl	✔	✖
Hybrid SMB + Cloud Storage accessibility caters for organizations making a staggered or full move to the cloud	✔	✖
OS Migration Tools & Dashboards for simplified administration and visibility of storage requirements	✔	✖
Granular Bandwidth Control over pipe usage % and Kb/s caters for remote users with low bandwidth links	✔	✖
Secure NTLM + Kerberos SSO support simplifies the end user experience whilst ensuring security	✔	✖
Natively and globally map a drive to cloud, or local, storage enabling offline access to files for a mobile workforce.	✔	✖
Ghost and placeholder files provide a searchable view of files, without having to first download files locally from cloud storage	✔	✖
Exclude files from sync based upon file extension to reduce cloud or on-premises storage requirements	✔	✔
Exclude files from Sync based upon size, age, type or path to provide targeted management of user data	✔	✖
Exclusion override capabilities on a Per User > Per File Type or Path basis to cater tailored user environments	✔	✖
Global sync status control (Admin pause) can be applied to assist with troubleshooting unexpected sync issues	✔	✖
Special sync handling of PST files (SMB) utilizes delta sync and Integrity block checking methods to reduce network consumption	✔	✖

Ivanti Cache Roaming For Virtual Sessions – 2018.3 Service Pack 1 Update

Fri, 18 Jan 2019 18:57:55 Z

The Ivanti VHD Cache Roaming Story …

With the February 2018 release of 10.1 FR4 release of Ivanti Environment Manager (covered here) came the first in-product Cache Roaming capabilities, providing customers with the ability to roam pre-defined and custom user application caches between sessions in Non-Persistent environments.

Embedding this feature within our industry-leading policy engine provides Administrators with the power to deploy and manage the user’s application caches based upon a granular set of User and Computer conditional parameters. This provides Environment Manager with a competitive edge over alternative solutions that are limited to a narrow set of deployment rules and targeting options all configured via Registry edits.

How does this all work and will it do so in my Environment?

Cache Roaming uses a VHD (virtual hard disk file) container, attached to the user's virtual desktop or session, and the necessary folders from the user profiles are redirected into it. This feature is suitable for VDI infrastructures, such as Citrix XenDesktop and VMware Horizon, and Remote Desktop Session Host (RDSH) scenarios such as XenApp. Applications do not require any reconfiguration and no changes are made to user profiles.

So, What’s New?

As the year has progressed the Cache Roaming feature has continued to evolve with some major headline features being introduced in the Ivanti Environment Manager 2018.3 release:

ONEDRIVE FOR BUSINESS CACHE & CREDENTIAL ROAMING
SUPPORT FOR CONCURRENT USER SESSIONS

* Further information on both enhancements can be found within the Environment Manager 2018.3 Release Notes and also covered in a blog post here

Ivanti Environment Manager 2018.3 SP1 (Available January 23^rd, 2019) builds upon this with two major additions to the Cache Roaming feature:

OUTLOOK SEARCH ROAMING

Per-User profile Outlook Search index roamed between sessions in both VDI (full virtual desktops) and RDSH (virtual sessions on Windows Server). The Search cache can be roamed collectively with the OST file to deliver the complete Outlook 365 experience in a Non-Persistent environment, removing the lengthy and often expensive task of downloading the Profile and Search index at every logon.

WINDOWS & OUTLOOK SEARCH ROAMING (Single User Workstations only)

The system-wide Windows Search database can also be roamed between sessions on single-user desktops (VDI, and maybe kiosk/hotdesk PCs). In Non-Persistent environments where users frequently roam between devices it is common practice to disable Windows Search to avoid the resource overhead of a search re-index at every logon.

This feature solves that problem by roaming the index within the user’s VHD, attaching to the desktop and delivering the search index from a locally stored directory.

* Please note with the combined “Windows & Outlook Search” Cache Roaming template, the system-wide search index is roamed capturing both Windows and Outlook search cache. This is ONLY supported on single user desktops with no support for concurrent sessions on Windows Server.

Simplified Configuration

Configuring the VHD and Cache Roaming selections is now even easier thanks to these great improvements in Ivanti Environment manager 2018.3 SP1:

Automatic creation of the parent folder hosting the .VHD file if it does not already exist:

The ability to Delete the ‘Original Location’ of which the cache resides if it already exists:

Configure > Deploy > Roam in less than 5 minutes

Here is a quick demo showing you just how easy it is to get up and running with these updates:

The Complete Office 365 Solution …

With the 2018.3 SP1 enhancements we now believe we have the most complete Office 365 VHD Cache Roaming solution. This tables shows our feature coverage, which can be extended with Custom templates:

Why the Ivanti Approach?

We have worked hard to make our Cache Roaming an enterprise-scale solution with the flexibility and granular control our customers have come to expect from Ivanti Environment Manager over the years. These are some of the key differentiators that our customers have highlighted to us in early testing:

Integration with Office 365 Profile Management

Other solutions can also roam the Outlook.OST data file in a per-user VHD. Where Ivanti stands alone is the capability to natively couple the roaming of the cached Outlook data file with the Personalization of the user’s default Outlook Profile.

A user can browse between Non-Persistent devices and at first launch of Outlook will see their profile configured and data file mapped locally and read in at block level from the VHD.

Granular Targeting

The Ivanti VHD Cache Roaming solution is configured from within the Environment Manager Policy console. Natively these policy actions can be configured within the parameters of a granular User and Device condition set. This provides the Administrator with the capability to target pools of users, devices or network ranges when deploying the VHD action.

For example, a user logs on to a physical device with a local profile. In this scenario they do not see a VHD mounted, as configured by the Environment Manager Policy conditions. The same user subsequently logs on to a Non-Persistent VDI on the same Network and gets a VHD Mounted and Office 365 cache redirected to it.

Flexible Configuration

VHD Cache Roaming Templates can be deployed in isolation or parallel. Administrators are not confined to the constraints of Office or Profile Containers and have the flexibility to configure cache roaming for each application on a user or device basis.

For example, two departments work in the same office on the same LAN. Dept A utilizes both Outlook and OneDrive, Dept B has Outlook profiles but no OneDrive. In this instance the Administrator can configure the mount of a VHD for all users in Dept A with their Outlook and OneDrive Cache redirected to it. The Administrator can then use a Department OU conditional check to identify members of Department B at logon and subsequently Redirect Outlook cache only to their VHD. This is a simple example, but Environment Manager has an infinitely flexible conditions engine that can customize the configuration VMD mounts and any other desktop configuration item based on any combination of criteria.

We offer MUCH more than just a Cache Roaming solution …

VHD Cache Roaming is a key feature but makes up only a very small portion of the functionality on offer in Environment Manager and the User Workspace Manager product suite. To learn more about how we can help further with your Office 365 challenges, meet your Windows 10 migration requirements and Unify your IT strategy please visit some of the content below:

https://www.ivanti.com/solutions/needs/migrate-my-users-to-win-10

https://www.ivanti.com/products/user-workspace-manager

Ivanti Environment Manager – Office 365 Cache Roaming Concurrency

Fri, 11 Jan 2019 19:31:50 Z

In the Environment Manager 2018.3 release we added support to our Cache Roaming feature for concurrent user connections to Office 365 from multiple sessions or desktops. This article discusses the pros and cons of our model compared to other approaches. The goal is to ensure that when a user has multiple non-persistent desktops or sessions connected to Office 365, Environment Manager can successfully maintain a local cache of data for each Office 365 app without conflict.

Environment Manager Data Sheet

Alternate Approaches

Some vendors chose to use differencing disks by default. With this approach a difference –puh –yas disk is created for every concurrent logon and resides within the same network location as the Parent (Master) VHD file. Every VHD file created will contain a merge of the cache from the parent VHD file which, in theory is great but in practice does not play out well when using Outlook Cached Exchange mode, as the .OST file is hashed and deemed outdated by Outlook when attempting to retrieve the profile cache.

At logoff each client attempts to merge their VHD with the base disk and this merge will only succeed if this is the last VHD(Session) to do so. If other sessions are still active the merge will fail and the disk along with the user’s cache will be deleted.

This gives the effect of 'last write wins' (or more exactly 'last logged out wins') which in theory is practical but in practice does not satisfy key office 365 use cases for Non-Persistent environments such as Cached Exchange mode. This model can result in an unpredictable cache lottery where multiple sessions attempt to write to and merge with the base disk with no way of tracking the result and predicting the cache they will retrieve at next logon.

The Ivanti Solution

With Environment Manager Cache Roaming a VHD is attached to the user’s session at every logon. The VHD is mounted and the cache from the configured Office 365 applications is redirected to it from their native locations within the user profile. The cache is then subsequently read from the VHD at block level ensuring Office 365 has the rapid access required to provide a seamless and native user experience.

When the user logs off, the VHD is detached and the VHD file is unlocked ready for the next session. If a user does not logoff and a second concurrent session is created, they will be presented with a new, blank secondary VHD file. At this point NO merge between the VHD’s will be attempted and the user’s office 365 data will be streamed down and redirected locally to the new VHD.

At Logoff from concurrent sessions, a maximum of 5 VHD files are retained, per user. This ensures the user will have a healthy pool of VHD’s to call upon when multiple sessions are active, with data being retained and promptly restored on demand.

VHD Concurrency in Environment Manager 2018.3 – a working example:

User Joe.Bloggs logs on to a Citrix XenApp server. A VHD file is created and attached to his session labelled Joe.Bloggs.VHD.
The user launches and configures Microsoft Outlook and OneDrive. The caches for these applications sync with Office 365 and files are redirected into the VHD. Joe logs off the session and the VHD file is detached and unlocked and stored on the network ready for the next session.
The next day Joe.Bloggs logs on and the Joe.Bloggs.VHD file from yesterday is attached to his session and the cache is ready for the launch of Office 365 applications.
This time instead of logging off, Joe.Bloggs disconnects from the session leaving the VHD attached and the Joe.Bloggs.VHD file on the file share locked.
Later, Joe.Bloggs logs on to a Citrix XenDesktop VDI and so now has two concurrent sessions. In this scenario the original VHD file (Joe.Bloggs.VHD) cannot be attached as it is still locked in the disconnected XenApp session. A new VHD file (Joe.Bloggs1.VHD) is created and attached to the second session.
When Joe.Bloggs opens Outlook and OneDrive in the second session Office 365 will sync the user’s cache from the cloud whilst redirecting it locally into the new Joe.Bloggs1.VHD.
All Office 365 cache generated within this second concurrent session is synced with the user’s Office 365 cloud storage whilst also being redirected to the Joe.Bloggs1.VHD file. When Joe.Bloggs logs off this second session the VHD is detached, but not deleted and is retained on the network.
When Joe.Bloggs logs off the original XenApp session the base disk Joe.Bloggs.VHD is detached, but not deleted, and will be available on the network alongside Joe.Bloggs1.VHD as the primary choice for any new sessions spawned by the user.
At this point Joe.Bloggs has now been logged out of all sessions in all environments. At next logon the original Joe.Bloggs.VHD file is attached if it is unlocked. Should it not be available the next in line is Joe.Bloggs1.VHD and so forth. The maximum number of VHD’s per user is 5 ensuring a significant but manageable number of disks are readily available to attach and restore the Office 365 cache with all changes in sync.

Please refer to our Cache Roaming compatibility matrix below for information on supported concurrency configurations:

* Please note with ‘Windows & Outlook Search’ Cache roaming template the system wide search index is roamed capturing both Windows & Outlook search cache. This is ONLY supported on single user workstations with no support for concurrent sessions.

Managing the Windows 10 User Workspace in Detail

Mon, 19 Nov 2018 22:37:41 Z

"Outlook is missing from my Start Menu."

"All of my pinned items are gone."

"I have just logged on to Windows 10 and everything looks different."

Roaming and persisting the user’s Windows 10 Start Menu and Taskbar is a constant challenge that gains complexity every time Microsoft releases a new Windows 10 update. Users are more mobile than ever, and, in many environments, they hop between physical and virtual workstations and sessions with a variety of Windows desktop and server versions. Providing a consistent look and feel to the user regardless of their platform is key to their productivity and your help desk service levels, and the first place they look for familiar applications and utilities are the Start menu and Taskbar.

The Start Menu in Windows 10 is very different to that in Windows 7. In addition to the changes in the interface, we now must also deal with UWP (Universal Windows Platform) applications, also known as Windows Store apps. This new breed of applications are present in the Start Menu at first logon on any Windows 10 device and items such as Cortana, Store and Edge are often seen as an unwanted distraction and even nuisance.

What Are These UWP Applications and Can They Be Removed?

Classic Win32 applications are installed through an MSI, and typically create a desktop shortcut linked to an executable in C:\Program Files and a registry key in HKLM and possibly HKCU. When a user logs on to this device the application is available to them and any personalization they apply to it will be stored in their user profile.

UWP applications come in two forms that reside in different locations:

System Apps live in C:\Windows\SystemApps. Microsoft Edge is an example and is system-wide. Microsoft makes it very challenging to remove these applications.

Windows Apps live in C:\Program Files\WindowsApps. These applications are provisioned to the user’s session at first logon. Yes, that means this “install” process repeats itself every time on a non-persistent desktop or session. They can be removed or hidden on a per-machine or per-user level. Details on how Ivanti Environment Manager can manage this for you can be found below.

Behind the Scenes of the Windows Start Menu

In any version of Windows 10 prior to 1709, Start Menu tiles were fully or partially stored in a Jet database (%localappdata%\TileDataLayer\Dataebase\vedatamodel.edb). This created a challenge as the database file is locked throughout the user session and only released after the user profile is unloaded. To provide support for roaming the Start Menu on these earlier Windows 10 versions, Ivanti Environment Manager hooks the profile notification module and will only trigger a sync once the profile is unloaded and the tiles are unlocked. Partially in 1703 and exclusively in 1709 the Start Menu handling is now encapsulated within the Cloud Store registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\CloudStore

How Can Ivanti Help?

As the industry leader in user workspace management, Ivanti makes your Windows 10 migration smooth with minimal effort and expertise required. Read on to discover how Ivanti Environment Manager provides consistency in migrating and managing key areas of the Windows 10 profile, specifically the Start Menu, Taskbar, and File Type Associations.

Roaming the Windows 10 Start Menu Using Ivanti Environment Manager Personalization

Out of the box, Environment Manager Personalization Server provides templates that capture the user’s Start Menu and Taskbar across and between all specified Windows 10 (1607, 1703, 1709, 1803) versions plus Windows Server 2016. Beginning with the Start Menu group, when enabled it will roam the following settings:

Start menu panels
Start menu panel resizing preferences
Start menu properties (power settings, privacy & customised settings)

To capture and restore these settings at every logon the group is made up of a series of registry keys and files/folders. These items are synchronised via the Personalization Server (an IIS web service) to and from the Personalization Database (on a SQL Server):

Roaming the Windows 10 Taskbar Using Ivanti Environment Manager Personalization

In Ivanti Environment Manager, the Windows Settings Group configuration for roaming the Taskbar is broken into three areas: Notification Area, Taskbar and Toolbars. Each area hosts its own set of Registry Keys and file/folder items. When the Windows Settings Group is applied, and all three areas enabled, the user will see the following settings roam between sessions:

Taskbar pinned items
Taskbar item position
Taskbar item size
Taskbar appearance (Aero peek, auto hide, group buttons, lock)
Taskbar toolbar options (Address, Links, Desktop)
Notification area (System Tray)

The managed items within each of these is shown below:

Note that this is the current template in the latest version of Ivanti Environment Manager, and we continually update personalization templates based on customer feedback, and in response to changes in Windows 10. We typically publish personalization template updates on the Ivanti Marketplace.

Applying the Personalization Configurations to Your End Users

Now we understand the composition of the Windows Settings Groups, the next step is enabling them for your users, so that they can roam between Windows environments safe in the knowledge that their Start menu and Taskbar settings will follow

1. Create a Personalization Group:

A Personalization group is, in effect, a pool of users defined by a set of membership rules. If a user matches the membership rule(s) of a Personalization group, they will have a configuration file (XML) delivered to their client that tells the Environment Manager agent which applications and Windows settings to personalise. In this instance we are going to walk through the process of creating a Personalization Group and importing the Start Menu and Taskbar Windows Settings Groups to it:

2. Defining Membership Rules:

You can define the combination of users and devices where the Personalization Group applies using Membership Rules that look up User & Computer conditions:

3. Apply the Start Menu & Taskbar Windows Settings Groups:

Personalization Server is shipped with numerous templates alongside the Start Menu & Taskbar items referenced in this blog. When building your Personalization Group configuration, you can simply select a number of these from the dialog shown below and they will be applied at next user logon to any user matching the specified membership rules:

4. Select Your Sync Trigger(s) and Enable Offline Mode for Remote Users:

Local Cache: In environments where remote users and unreliable network connections are a factor, Offline Mode ensures the consistent retention and delivery of user settings between sessions. Offline Mode provides an unrivalled level of resiliency by maintaining a local copy of the user’s cache regardless of network status or connection type. As soon as a network connection is established, the EM client will efficiently sync the data with the Personalization Server so the user can roam.
Sync Options: Chose a trigger at which Personalization data is synced with the server providing flexibility in non-persistent environments where users may switch devices without a graceful logoff.

Adding and Removing Win32 Applications From Start Menu and Taskbar Using Environment Manager Policy

Every organization has essential applications: Finance may look straight to the taskbar for Excel whilst the Creative team expect Photoshop in the Start menu. With a simple Environment Manager policy action, you can add and remove applications from the user’s Start menu and Taskbar based on any number of conditions.

In the example below, I have set a policy in two simple steps to pin Internet Explorer to the Start menu and Taskbar of all users in the Helpdesk on Windows 10 machines:

Removing UWP (Windows Store) Applications From the Start Menu Using Environment Manager Policy

As discussed earlier in the blog UWP applications are a different beast when it comes to understanding their mechanics and limiting their disruption to the end user and their session.

Ivanti Environment Manager can help you strip out any of these unwanted Windows Store applications on a per-user basis on any version of Windows 10. In the example below, I have launched the Ivanti UWP Management Utility* and selected 12 items to remove for all Helpdesk staff:

Using Environment Manager I can point a custom Powershell action to the text file executing the clean up on the Desktop Created trigger:

* Note: The above-mentioned FTA roaming configuration is currently going through community testing and will be added to the product as a full feature in a future release. Please see this Community link for more info.

File Type Association Roaming

A common user experience problem with Windows 10 has been that the user sets Adobe Reader as the default program for PDF files, they save their files and logoff for the day. The next day they login, open the PDF file and instead of Adobe's splash screen they get the default program dialog appear and Microsoft pushing them to use Edge instead!

The complexity behind persisting File Type Associations (FTA) on a per-user basis is all too apparent when one begins to explore the different moving parts. There is the OEMDefaultAssociations.xml file and its Alcatraz-like ACL's coupled with the application, device and user specific hash that is created every time you set a default association!

Thankfully Environment Manager can solve the FTA puzzle for you and provide your users with a consistent experience. The configuration can be used to persist the required associations across all versions of Windows 10 and Server 2016.

* Note: This configuration is currently going through community testing before it is added into the product or the Ivanti Marketplace. Please try it and give us your feedback!

Define User File Type Associations for the User

Environment Manager also provides the Administrator with the ability to define File Type Associations for the user. (Note that this is different from the ability to roam the user’s own FTA settings, described above.) Together they complete management FTA on Windows 10 and provide a consistent, managed user workspace.

In the screenshots below, I have extended the earlier example of pinning Internet Explorer to the Start menu and Taskbar for the Helpdesk group, by also setting the FTA to associate all relevant web files with IE:

Summary

This article only touches the surfaces of Ivanti’s capabilities when it comes to management of the Windows 10 user experience and profile. For a detailed overview of our supported Windows 10 platforms and version matrix please see this community item.

Help Us to Write the Next Chapter in Our Windows 10 Story!

We need our community of customers to tell us how we are doing and if we are solving the Windows 10 challenges you face daily. Please use the Ivanti Community to provide your feedback and suggestions directly to the UWM product teams.