Ivanti Blog: Posts by

What’s it like to be a Technical Relationship Manager

Tue, 08 Oct 2019 20:55:20 Z

There’s never a dull day

When I joined the Technical Relationship Management (TRM) team around two years ago, I asked our now tech lead Justin Moses what he enjoys most about the job. His reply: "Helping our customers achieve their objectives and the sense of satisfaction in being part of getting them there."

A TRM is a unique capability and as such requires a unique person in the tech world. On the one hand they are a very capable techie, but on the other they also have business awareness and the ability to communicate at all levels both internally and externally. We work within the interest of our customer accounts and are a trusted advisor.

My first experience as an external working at HPe of a TRM was (a now friend) Darren Chapman aka ‘Chappers’. My attitude at the time was, ‘what can this guy tell me’ and ‘he’s going to waste my time’, etc..- oh, how wrong I was. Darren became a very valuable resource in being an advisor to myself and colleagues. He’d be asking questions and considering things I hadn’t. The end result was a very smooth and confident delivery, he was never a hinderance and recognized I was up against tight timelines and adjusted accordingly. I looked forward to seeing him, catching up and sharing all my latest questions/thoughts. Then came along Peter Jones aka ‘Jonesey’, again he became a friend and an extremely dependable resource. To the point that when I left HPe to join AppSense (now Ivanti) he stepped into my shoes, as the account recognized his skills.

I believe the accounts we have that renew year on year not because it’s a ‘nice to have’ and can be ‘useful sometimes’, but because they see a good return on their investment. Chuck anything at a TRM and you will get a reliably good response. Why? They have seen a lot and know a lot inside and outside of the Ivanti arena. If not, they have many strong resources they can pull on - previous support cases, known issues, reference designs, product management, we will even discuss the issue with a developer. We know individuals personally within each team and can help make sure you get a detailed response, providing you with the best options and advise on the best course forward.

What I like about being a TRM is building a strong relationship to the point where I’m considered part of the team and have been a key part in them meeting their business objectives. Getting invited out on team nights out and business events with the business I am working with, when I walk in and everyone welcomes me as a colleague and asks how my family are etc.. I know I’ve achieved my goal. I genuinely care about the success of my customer accounts and if something is wrong, I will work tirelessly to get them back on track. My colleagues are the same, and we all know about the challenges being faced across the team. Customer accounts and any issues is pretty much the first topic all TRMs talk about when catching up.

What can my day look like- some days I’ll wake up and think I’ve got a fairly quiet day ahead but then a colleague will reach out with an issue and I’ll spend some time assisting them. You learn to switch modes very quickly from doing a review, arranging engagement days, helping with an incident, performing a health check, answering a few queries, working with product management on a new feature…

UWM is such an interesting product suite to work with, it touches so many parts of the organization and interacts with other software, meaning that I’m always learning something. We also see the way that various organisations work, and for this reason the TRMs are some of the smartest guys I work with, they understand not only the product but also have a very broad view of the entire landscape.

Due to the unique position a TRM holds we can achieve things in a shorter space of time and provide reassurance along the way, essentially vendor led consultancy. A TRM will have an in-depth knowledge of a customer’s infrastructure and should an issue occur will have a good head start in getting to the root cause, we’re also likely to have seen it before and even more likely a colleague has seen it. If not, we can pull on many strings and resources to get the issue resolved.

Now before this starts sounding like a job spec or worse a sales pitch this is genuinely how it works, my approach with a new customer account is to understand firstly their infrastructure and then the current UWM setup. I then work with them to understand their long term and short-term objectives. Following this I will then take a detailed look at their current UWM infrastructure aligning it to best practice and business requirements/objectives. I’ll then detail a TRM engagement plan which is regularly reviewed to ensure we are hitting business objectives.

The day I’m writing this I’m sat on the runway at Manchester about to travel to a large bank in the Netherlands. Other days I travel from my home in Lancashire over the Pennines to Yorkshire via the Snake Pass to another large bank, or down to London for the day on the train to an insurance group. It’s fun, never the same, never dull and always interesting.

What I like about the job is meeting people and establishing a good working relationship, a reassurance that if they have a question or an issue, I’m always on hand to help. I enjoy understanding the challenges my customers are facing and helping them get to where they want to be.

What exemplifies the TRM spirit is our closeness as a team despite the fact that we are spread out. We bounce issues off one another daily and work to help one another. If another TRM is having a tough time, others will step in and assist. That’s what I like most about being a TRM – the team I work with.

Profile Containers – A Remedy, Not a Cure

Fri, 10 May 2019 21:19:55 Z

Introduction to User Profiles and Their Problems

First, some profile history and knowledge. To begin, let’s look at and understand the Windows Profile.

The Windows user profile holds user-based application and operating system files and settings. The ntuser.dat file is effectively the user’s registry hive loaded up to HKEY_Users at logon, and is represented in HKEY_Current_User within the user session. These profiles include settings such as your wallpaper preference and Windows Explorer layout. Application files specific to the user are stored in %appdata%, with files that need to roam between PCs under %appdata%\roaming, and data to stay local under %appdata%\local. Many applications cache a *lot* of data to the %appdata%\local folder in order to optimize the user experience—Chrome being a prime example.

There are several profile types. The main ones are local, roaming, and mandatory. Local profiles are now the most common, with mandatory being very similar to a local profile but typically customized for a better user experience and stored on a central file server. Both mandatory and roaming profiles come with their challenges—the main ones being that roaming profiles are prone to corruption and slow to logon when files are copied from the server. Mandatory profiles also present security risks and challenges around personal certificates, Skype for Business being a well-known offender.

If you want to read more about the history of profiles, please take a look at this popular blog written for Ivanti by James Rankin (Twitter: @james____rankin).

I first became aware of the problems with roaming profiles very early in my career, where 70% of my time on the helpdesk was spent resetting roaming profiles for users who had lost all settings and personalization in their Windows desktop. Normally there was a difficult problem to troubleshoot, or a device had unexpectedly powered off, leaving the profile corrupt. This was a common problem in the industry, and something needed to be done.

Profiles – Virtualized and Optimized by Ivanti

There were numerous attempts to solve this problem, but an early solutions leader was AppSense (now part of Ivanti as the User Workspace Management (UWM) group). The AppSense Environment Manager product not only solved the problem, it also optimized the user’s profile and user experience. And the solution wasn’t just a point product; it allowed easy management of profiles and developed into the gold standard for profile management. Competitors’ approaches stored profiles on file-server SMB shares, which might be acceptable for smaller deployments with 100% of users on virtual desktops and sessions, but these approaches didn’t fare so well for physical desktops, WAN links, and (looking to the future) cloud architectures requiring web services over HTTPS.

To learn more about how UWM is leading the march to the cloud in workspace management and tight integration with Azure, read this blog.

The New Contender: Profile Containers

I first became aware of the idea of profile containers in the very early days of Office 365, as an AppSense engineer at HPe (now DXC). We looked to Environment Manager as a way of retaining the user’s Office 365 Outlook cache so it did not need to be re-cached each time the user logged onto a new non-persistent desktop or session. If the cache is not immediately available, the user’s experience is poor as they wait for the mailbox to be rebuilt and are initially unable to search.

Why not just capture the Outlook cache file through Environment Manager, like any other personalized file? Well, the problem is size—these cache files quickly grow to multiple gigabytes, which isn’t suitable for transfer at app start or even logon. Using VHDs as an alternative approach (managed through Environment Manager) was discussed at the time, but the idea never really took off.

Around the time I joined Ivanti, the VHD idea was gaining popularity across the industry and we developed scripts for Environment Manager that allowed elements of the profile to be roamed in a VHD. These scripts worked nicely and, over time, evolved into the feature known as EM Cache Roaming, initially released in early 2018.

What does this have to do with profile containers? Well, this concept of using a VHD to solve a specific application cache problem can be extended to capture the entire user profile in one large VHD blob. It mounts quickly, ensures fast logons, and, compared to other approaches, doesn’t have the performance impact on the file server, which makes for exciting demos and appears simple. You could almost say that profile containers are Folder Redirection 2.0, or are at least trying to solve the same challenges.

UWM Virtualized Profiles vs Profile Containers

So how do profile containers differ from Ivanti’s profile management? First, the concept of a profile container actually dates back to Windows Server 2012, where it was known as “User Personal Disk” and was primarily used to solve Outlook roaming problems. It was buried deep in the UI and never got much love, leaving the door open for other vendors, including FSLogix, to advance the concept and extend it to capturing the entire user profile as well as other application caches.

So, do we need both approaches? Why does Environment Manager contain a mix of file and registry capture, and the option of VHD Cache Roaming for things like Office 365 caches? The key word is “Management”—if you place the entire profile into one large container then you lose so much of the ability to manage the user experience. Profile containers are a point solution to allow efficient redirection of a profile to a network share, that’s it. Below are some genuine examples of “asks” I’ve had this week that simply are not possible (or at least very difficult) with profile containers:

A large financial organization wants the experience on its Windows 10 virtual desktops to be the same on Windows 10 laptops. This is impossible with profile containers because delivering a huge VHD file over a WAN or VPN won’t work, especially when the laptop user goes offline. In addition, sharing a single profile container across multiple devices can result in lost profile data.
If you have a user roaming geographically to different VDI farms, then a profile container cannot stretch across the world through a WAN link, unless you replicate the entire file system. The GeoSync feature in User Workspace Manager synchronizes data between datacenters.
Here’s another example I heard today: An Office setting is causing problems for 3,000 users and the organization needs to delete it from each user’s profile. With Environment Manager, this is easy to apply in bulk and just relaunch the app. With profile containers, however, it requires each user to log on again so the changes can be applied.
When profile settings cause a problem, either the administrator or the user (if self-service is enabled) can easily roll back to an earlier version either the specific application or operating system setting, rather than blowing away the entire profile.

The short version is that with Environment Manager, you have granular, centralized control over every aspect of the user profile, combined with the benefits of using VHDs for roaming caches in situations where it makes sense. In other words, the best of both worlds.

Profile Containers and Performance

When IT teams look at deploying profile containers, the most common questions we receive relate to the anticipated IOPS load on the file server that will host the VHDs. This article is a good discussion based on real world experience.

By comparison with Ivanti, personalization only synchronizes data on demand when an application or session starts (although it can be pre-loaded and cached for offline devices). With a little configuration, it is possible to capture a relatively small amount of profile data (typically 15-20 MB per user) and still provide a full roaming experience.

Conclusion

When weighing up how you want to manage your user profiles across the Windows desktop, consider it from an administrative and user-experience perspective. I’ve provided a small snapshot of requirements that would be difficult/impossible to achieve with profile containers. With Environment Manager, you can reap the performance benefits of using VHD to containerize the parts of the profile that make sense without giving up management of the rest.

You can learn more about Environment Manager here.

Ivanti Performance Manager: Release Its Full Potential!

Mon, 02 Jul 2018 16:44:19 Z

Far too often I hear organizations are just using the out-of-the-box configurations supplied with Ivanti Performance Manager (powered by AppSense) for controlling resources in their desktop and server environments. Sure, this brings many benefits, including fast time-to-value and reduced IT admin, but potentially, you may not be exploiting the true power of Performance Manager.

Common resource hungry applications such as Microsoft Office, Internet Explorer, Firefox and Chrome can all be managed more efficiently. This is especially useful in a Terminal Services scenario where controlling resource will allow you to increase the user density on a server.

In the short video below, you will see a simple demonstration of Performance Manager, showing how the unique feature of CPU Thread throttling works, how the base priority is changed, followed by a run through of recommended CPU resource planning.

In a future blog I’ll explain more on how to get the right figures for planning efficient resource levels. For now, rather than just relying on our out-of-box configurations, download an example Performance Manager config to help get you going!

Windows Intune, Autopilot, and Ivanti User Workspace Manager

Tue, 05 Sep 2017 15:55:12 Z

The Cloud is far more than just a datacenter in the sky. Cloud technologies and platforms enable a multitude of new ways to work and, for IT, new ways to deliver IT services to end users. Microsoft’s recent introduction of Windows Autopilot is a new example of how the Microsoft Cloud is evolving to support these new workstyles, and of the changing role of IT in the cloud era.

For many users, the traditional route to work computing is that IT orders computer equipment, configures it and delivers it to them. It’s often a week or more before a new employee has their laptop set up and running in most organizations. And what happens when they need to upgrade or replace that laptop? The employee is back where he started, waiting several days (or more) and possibly visiting IT once or twice while they set up and migrate applications and data to the new laptop.

This is where Windows Autopilot and Intune come in. When IT pre-registers any new Windows 10 device, that device will be automatically enrolled in both of these cloud-based services when first switched on by their new owner and connected to the Internet. Autopilot will present the user with a logon tailored to their organization, and will allow that user to log on using the account pre-assigned to them by IT. Further, if the laptop is pre-built with Windows 10 Professional it will be automatically upgraded and licensed for Enterprise.

After that initial logon, Intune will set basic policy, deliver applications, and give IT a high degree of control over the all-important Office 365 setup and the service branch the device is part of.

So far so good, this all sounds promising—but wait a minute! What does IT lose through this style of management? Well, first, there is an inconvenient feature gap between SCCM and Intune. But the biggest challenge is that with Windows 10 devices using Autopilot and Intune, the user is authenticated with AzureAD, not traditional Active Directory, so Windows 10 devices using Autopilot and Intune are not domain-joined, which knocks out a lot of traditional IT management tools—including Group Policy.

If you want the convenience of Autopilot and InTune plus the ability to apply policy, help is at hand from Ivanti’s User Workspace Management products. In particular, Ivanti Environment Manager can apply Group Policy-like policies to the endpoint, but with a far higher degree of performance, flexibility and granular targeting.

If you’re willing to give up that control to get a low-touch way to configure new laptops, you’re still faced with this question: how do you migrate the user’s persona (settings, local files, shortcuts, printers, credentials, regional settings, favorites, etc.) from their old Windows device to a new one? And how do you ensure that if a user loses or breaks her laptop, you can give her a new one—in minutes—that will look and feel exactly the same as the old one?

That’s something we at Ivanti call Personalization—the roaming of a user’s persona between devices—that is delivered by Environment Manager and Ivanti File Director as part of Ivanti’s User Workspace Management products. And, yes, before you ask, Environment Manager and File Director can be cloud-hosted.

Need to lock down those devices? Unfortunately, Intune policies don’t cover things like app blocking, whitelists and privilege control—but Ivanti Application Control has the answer with capabilities like Trusted Ownership™.

So—how would you put Autopilot, Intune and Ivanti products together to give IT full control of the user experience and workspace, while embracing the new world of Autopilot and Intune? What would the end-to-end workflow look like? Here’s a 3-minute video to show it all working together.