AppSense Channel on YouTube

A few weeks ago AppSense HQ was the center point for our quarterly Systems Engineering / Pre-Sales Conference..

I thought, while I have 30 or so consultants at my disposal, to take this opportunity to catch them off-guard and have them white-board some of the key AppSense messages and overviews.

Videos / Whiteboard Presentations include (amongst others):

• User Environment Management Overview
• Windows 7 and VDI Overview
• Eliminating the need for Roaming Profiles
• Rolling-back User Personalization Settings
• Automatically Blocking Unauthorized Executables
• Controlling Microsoft Application Per Device Licensing
• Client & Cloud Computing

These videos have now been uploaded to YouTube and are available for viewing here – at the AppSense YouTube Channel

I hope these are of use to people, and where possible, I am keen to read your comments, so please do leave a note of your thoughts on there :)

AppSense on YouTube

CSC Dynamic Desktop – Citrix XenDesktop & AppSense

I have just returned from a successful 2 day IPexpo event in London, and was extremely excited to see the many Google Alerts for ‘XenDesktop’, ‘AppSense’, and ‘User Environment Management’ in my inbox.  Upon clicking on the alert I was taken to Daniel Fellers ‘Ask the Architect’ pages within the Citrix Community site.

In this instance, Daniel (a Lead Architect for the WorldWide Consulting Services at Citrix) interviews Sandy Kingdon (a Dynamic Desktop Architect at CSC) on how CSC has designed and is well into the implementation of Citrix XenDesktop, VMware ESX and AppSense User Environment Management to support a 40,000 user environment.

Sandy explains how CSC were able to overcome some notable challenges, including:

• Supporting multiple users across different sites using different language and MUI packs from just 2 vDisks
• Controlling Application Access
• Persisting User Personalization Settings between sessions
• Current and future plans for supporting User Installed Applications in a non-persistent environment

As AppSense are a core component of CSC’s standard offering for Dynamic Desktop, Sandy covers how by virtualizing the user and controlling Policy and Personalization separate from the underlying OS and App components that CSC were able to overcome the above challenges.

The podcast can be found here

Thanks to both Daniel and Sandy for the great podcast and an insight into a real world large scale XenDesktop deployments.

Sharing Personalization Settings between Operating Systems – Debunking the Myth

I have recently heard, from several different sources, that it is “best practice” not to share user profiles, or personalization settings, between different operating system platforms. On the surface, this seems a sensible limitation since different operating systems have different user profile structures. 

Vista and Windows Server 2008 (WS08) put most profile data somewhere in “\users\%username%\appdata”, whereas XP and Windows Server 2003 (W2K3) may place it in “\documents and settings\%username%\application data” or “\documents and settings\%username%\local settings” or somewhere else entirely.

We can’t predict where the data will go for a given application which doesn’t help us understand the “splatter” that it makes in the file system. This folder lottery is further compounded by the fact that Vista and WS08 implicitly add the “.v2” extension to any profile path you define for a user. What this results in is that with a roaming profile solution, you are forced to have different profiles, and therefore different settings, between XP/W2K3, which implicitly use a “v1” profile, and Vista/WS08 which explicitly use a “v2” profile (even though the path defined for this profile does not actually include the “.v2” extension).

Applications should get the paths to use within the profile folder hierarchy by using operating system API calls that are the same between the different operating systems but will yield the correct folder for the operating system it is being run on. Unfortunately, not all applications are written this way and some will make assumptions about paths and maybe even hard code them which is likely to cause problems even before operating system migration, particularly in Terminal Server/Citrix XenApp environments.

There is also the class of setting that is actually different between the different operating systems. Take for instance the good old desktop wallpaper which most people, if pushed, will confess is the one item that makes their PC experience “personal” (while this is not an essential productivity related personalization setting, it does however provide a good example as to how even the most basic of settings fail to migrate between OS platforms)  Although users don’t know, and indeed do not need to know, they are actually stored in different file formats between XP/W2K3 and Vista/WS08. Therefore if the setting for this, which is stored in the user’s registry hive, was just unintelligently transplanted between the two operating systems then one of the desktops wouldn’t show the correct wallpaper.

Some implementers may say that it is a good idea to start with clean profiles when moving from one operating system to another system since it is a good opportunity, in their view, for a clean start and to leave all the myriad of settings behind that aren’t apparently used for anything and just clutter the profile. However, against this has to be weighed the cost of the user having to re-personalize their applications and desktop. This costs both in terms of time (both users being interrupted during their workflow as they find a toolbar or application setting they need is missing, and then having to remember where and how to re-make the customization, which could be different to how they would have changed the option on their old OS)  and also can cause a certain amount of resistance when these users tell their yet-to-be-upgraded colleagues is that this great new operating system, which has been months in planning, has lost all of their settings and they are struggling to find the new ways to set things the way “they should be”.

Enter AppSense Environment Manager. All of the technical issues outlined above are addressed by Environment Manager making the migration from one operating system to another, and back again if required, a much less painless experience and instead now becomes an automated, seamless process for both the user and administrator alike. The files used by an application within the locally cached profile folders are stored in a relative, rather than absolute, form in the Environment Manager database which then allows them to be subsequently put back in the correct, operating system specific, folder hierarchies. Because Environment Manager functions on a per-application basis, it can much more accurately target which settings need to be brought over onto the new operating system and it also silently transmogrifies items and their settings, such as desktop wallpapers, to help ensure that seamless migration that administrators dream of. All this, of course, is done with next to no configuration by administrators so they do not need to understand the intricacies of any of the applications and subsequent registry settings and profile structures the user uses. This helps make for quick and easy migrations, although I don’t personally like the term “migration” since it implies a one way movement whereas Environment Manager provides bi-directionality with no extra effort.

So in summary…While it is right to say that it is NOT best practice to share ‘roaming profiles’ across OS platforms, AppSense Environment Manager dispels the myth that sharing ‘personalization settings’ between operating systems is not a recommended best practice –in fact AppSense recommend you embrace it…

Citrix & VMware VDI Offerings – Is AppSense User Environment Management ‘Really’ included in their products?

I recently read a great article titled ‘Windows 7 May Spur Virtual Desktops, On and Off the iPhone’ on CIO.com by Kevin Fogarty.

It is a great article and brings attention to the options available to us in how we can deliver desktop (sessions) to our users, even when they are not sat in front of a typical PC or Thin Client device – bring on, the mobile/cell phone device.  However, I have recently received a few emails and mentions on my Twitter Account in relation to the write-up regarding how AppSense is represented in the article.

The article goes on the reference how ”VMware, Citrix and a range of other companies are putting clients on smart phones” and as part of this mobile discussion AppSense User Environment Management is rightly referenced as “The User Environment Manager from AppSense, for example, is designed to make a virtual desktop mimic the real thing by allowing end users to make changes, install software add photos, store cookies and do all the other things they’d do on an actual “personal” computer”.

Unfortunately however there appears to be a slight misrepresentation on the relationship between AppSense and the vendors Citrix& VMware, in that it says AppSense code is part of both the VMware and Citrix VDI offerings, “AppSense, whose code is part of both VMware and Citrix’s VDI offerings, stores all that data and code on the server and reloads it all every time that user logs on, no matter through what device the access comes” .

While AppSense enjoy a very close and strong relationship with both vendors, providing some of the strategic requirements for the VDI offerings in many of the largest enterprise deployments, I must at this point highlight that the AppSense capabilities come from a separate solution outside of VMware View and Citrix XenDesktop- in the form of the AppSense Management Suite.

The AppSense Management Suite is a standalone management framework and solution set which completely separates all elements of the user from the underlying desktop session, operating system and application set.  While this platform agnostic technology integrates seamlessly with the VMware and Citrix offerings, AppSense code is NOT part of any VMware or Citrix offering, and must be implemented in addition to the VDI solution from either vendor.

Hope this clears up any confusion, and please do remember I fully support the article and agree with the other points made.. I just wanted to ensure no one is disappointed when they trial or purchase either VMware View or Citrix XenDesktop and find out there is no AppSense software built in J

Look forward to reading more great articles on the possibilities of desktop deliver.. and of course that AppSense is a key part to this personal computing shift…

(the original article can be read here).

VDI – The Need For User Personalization

Martin Ingram, VP of Strategy at AppSense has been inundated with Press and Analysts wanting to interview him to learn more about the strategic requirement for user personalization within VDI environments. 

Personalization is key to reducing risk and increasing user satisfaction and enabling the adoption of lowest cost, non-persistent VDI environments.

You can read more about this topic along with the views of industry leading Commentators and Analysts at:

IT Business Edge – Putting a Personal Touch on VDI, by Michael Vizard

Virtualization Review – All about the User Personality, by Beth Schultz

These posts come further to Citrix recognizing the need for user environment management solutions in VDI environments, as posted by Sumit Dhawan here

Process “Hibernation” Utility

Guy Leech, a contributor on this AppSense Blog has developed a utility to pause processes, minimize the process/application window, free up the Memory while paused, and provide the option to resume process at later date.

Here is the article intro along with link to the original post (containing the download):

“Ever have the need to pause a process so that you can come back to it later – maybe something that is resource hungry, difficult to get back to the same point in if you quit it or possibly doesn’t work when away from the corporate network? Then this is the utility for you – via a simple user interface it allows you to pause and resume any of your running applications/processes.”

Read more about this cool utility with option to download it here

Microsoft Windows Server 2008 TS/RDS CAL now includes App-V

 As of 1st September 2009, Microsoft is including an App-V (formerly SoftGrid)  licence within the Client Access Licence (CAL) for Windows Server 2008 and 2008 R2, meaning that a separate App-V licence is no longer required and shortly will not even be available.

http://www.microsoft.com/systemcenter/appv/howtobuy/default.mspx

 http://www.microsoft.com/windowsserver2008/en/us/rds-product-licensing.aspx

The media for the client, sequencer and server is available here:

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=0890d6cd-0d3b-4c9d-b208-231c65d3e55a

Live from VMworld – VMware to OEM RTO Virtual Profiles™ into VMware View

Live from VMworld 2009 – A press release shows that VMware are to OEM the RTO Virtual Profiles Product into VMware View.

On the recent announcement at VMworld 2009,  VMware are planning to OEM the RTO Virtual Profiles™ technology into VMware View – this is great news, and yet another proof point of the importance of user personalization in the virtual desktop space.   It looks as though VMware have made a similar move Citrix did some months back when they acquired SepagoPROFILES for inclusion into their Xen line, and it makes total sense.

Let’s take a minute to appreciate the basic premise of how to reduce desktop TCO through virtualization.  The only way to deliver cost-effective virtual desktops is to standardize the corporate image.  However, if you standardize, then you also have to provide personalization capabilities in order to get the user adoption needed to make the transition to virtual desktops a success.  In this respect,  providing some level of personalization baked into platform solutions such as View is necessary.

By adding RTO technology, VMware will leverage the Windows User Roaming Profile -  which has been successfully used in Terminal Services environments for many years.  This will certainly ease some of the pains typically associated with Roaming Profiles, such as profile corruption and slow logon times.  However, in more complex, enterprise environments, something more than profile management is required to provide a local PC equivalent experience from a virtualized, standard corporate desktop (as Sumit Dhawan has explained here).   Personalizing a virtual desktop requires the ability to automatically set-up and configure the desktop based on the user’s role and context (e.g. what printers they can use, what drives they can access, use of peripheral devices), support for the installation and persistence of user-installed applications, as well as the application of all user-customized settings across all applications.  All these in combination are known as the ‘user environment’, and the most important characteristic of the user environment is that it is client OS and delivery mechanism agnostic – effectively providing a ‘follow me’ user personality anywhere, using any delivery method and to any device.  This is simply not possible using profile management alone, and why a User Environment Management Solution is required.

The thing is, most companies don’t have homogeneous desktop estates.  This is true in physical PCs today and will also be the case in their virtualized equivalents.  Companies typically use combinations of delivery technologies, applications (corporate and non-corporate), client OS and devices to deliver an optimum, productive working experience to their employees.  Based on extensive experience with many customers rolling out desktop virtualization projects, we know that successful (i.e. low-cost, high adoption) virtual desktops require the ability to automatically deliver non-persisted, leveraged corporate OS and apps on-demand from a centralized source.  To this fresh, clean desktop session must then be added the independently-managed user environment as described above – note this must be added selectively in response to user actions.  We are well beyond profile management now!

Adding RTO Virtual Profiles into the View offering will certainly enable VMware’s customer base to start to roll-out Windows XP based virtual desktops (Windows Vista & Windows 7 will be supported in future releases)  in a controlled way, while providing some personalization capabilities.  As these implementations start to grow, the need for a more comprehensive treatment of the user environment will become essential.

User personalization is an exciting and rapidly-growing space!  We’re working closely with VMware, Citrix, Microsoft and our joint customers to ensure successful and viable virtual desktop roll-outs …..we look forward to seeing this vital part of the new desktop paradigm grow in importance over the coming months and years!

Pete Rawlinson
VP WW Marketing, AppSense

Live from VMworld 2009 – A press release shows that VMware are to OEM the RTO Virtual Profiles Product into VMware View. Press Release can be found here

NEW FEATURE No. 7 – AppSense Environment Manager 8.0 Service Pack 2 – Trigger Action Time Audit Event

This is the seventh installment in a series of posts about the new features and options in AppSense Version 8 Service Pack 2.  (If you have not yet downloaded this latest release, you can read more info and download it from here )

AppSense Environment Manager Service Pack 2.0 introduces a new auditing event – Trigger Action Time.

A Trigger is the instigator for both conditions and actions to be processed.   For example:

Please see the screenshot below showing that when the ‘JD Edwards’ application is launched, and the user is running the application on a client within a ’set IP address range’, then a specific printer is automatically mapped as the only printer available for the application.

Click to see full size capture

In the above case, the Trigger is the  launching of  ‘an’ application, the condition is meeting both the application being ‘JDEwards.exe’ and the IP address range criteria and the policy action is the mapping of the specific printer.

Other Trigger actions include Computer Startup, Computer Shutdown, User Logon, User Logoff, Process Started, Process Stopped, Network Connect, Network Disconnect etc…

On selection, this new event is raised for every used Trigger.  This details the start time, end time and duration for the chosen trigger conditions and actions to complete.

P:S
As this is an ever growing blog topic, the previous posts on the other new features we have detailed can be found below:

NEW FEATURE No. 1 – AppSense Environment Manager 8.0 Service Pack 2 – Run As

NEW FEATURE No. 2 – AppSense Environment Manager 8.0 Service Pack 2 – Connect As

NEW FEATURE No. 3 – AppSense Environment Manager 8.0 Service Pack 2 – Improved compression and data handling protocol

NEW FEATURE No. 4 – AppSense Environment Manager 8.0 Service Pack 2 – Manipulation of files in Personalization Analysis

NEW FEATURE No. 5 – AppSense Environment Manager 8.0 Service Pack 2 – Run Once

NEW FEATURE No. 6 – AppSense Environment Manager 8.0 Service Pack 2 – Group SID Refresh

NEW FEATURE No. 7 – AppSense Environment Manager 8.0 Service Pack 2 – Trigger Action Time Audit Event

NEW FEATURE No. 8 – AppSense Environment Manager 8.0 Service Pack 2 – Stop If Fails

NEW FEATURE No. 9 – AppSense Environment Manager 8.0 Service Pack 2 – New Application Categories in the User Interface

NEW FEATURE No. 10 – AppSense Environment Manager 8.0 Service Pack 2 – Refresh

NEW FEATURE No. 11 – AppSense Environment Manager 8.0 Service Pack 2 – Registry Hive Exclusions

NEW FEATURE No. 1 – AppSense Environment Manager 8.0 Service Pack 2 – Run As

This is the first installment in a series of posts about the new features and options in AppSense Version 8 Service Pack 2.  (If you have not yet downloaded this latest release, you can read more info and download it from here )

AppSense Environment Manager 8.0 Service Pack 2 introduces a new option – Run As.

This emulates the Microsoft Run As command and allows actions to be executed in the context of another, specified user.  For example launching an application in a different user context.

When selecting the Run As tab in an action you are presented with one, two or three options:

Current User: Available on all relevant User actions. This is the default selected method and runs the action in the context of the logged on user.

System: Available on all actions. This is the default method for Computer nodes and runs the action in the context of the System user.

User: Available on all relevant User actions. On selection of this option the administrator is prompted to select a friendly name to run as. If no friendly name exists, the Run As Library can be launched where friendly names, usernames and passwords can be stored for re‐use.

The friendly names are stored in the configuration in a reusable library section. Each friendly name is accompanied by the username and password. The password is encrypted using a one‐way public key. This prevents passwords from being reverse engineered.

During installation of the AppSense Environment Manager Agent, the private key is added to the machines key store. This is a write only store, i.e. it cannot be read.

When an action is run as a specified user the associated username and password are used to impersonate said user. AppSense Environment Manager uses a handle to the private key to decrypt the password at this point.

Note: The Run As specified user only impersonates that user. This means the user’s profile and registry hive are not loaded from the domain due to the associated overhead. This results in the environment variables for the action representing the System user and not the currently logged on user or specified user.

Note: This is both a very powerful and potentially dangerous function. Even though the password is encrypted, the username and password pair can be applied to any action and a malicious user may be able to alter the configuration to possibly bypass security. Therefore, this function must be used with extreme care.

P:S
As this is an ever growing blog topic, more posts on the other new features we have detailed can be found below:

NEW FEATURE No. 1 – AppSense Environment Manager 8.0 Service Pack 2 – Run As

NEW FEATURE No. 2 – AppSense Environment Manager 8.0 Service Pack 2 – Connect As

NEW FEATURE No. 3 – AppSense Environment Manager 8.0 Service Pack 2 – Improved compression and data handling protocol

NEW FEATURE No. 4 – AppSense Environment Manager 8.0 Service Pack 2 – Manipulation of files in Personalization Analysis

NEW FEATURE No. 5 – AppSense Environment Manager 8.0 Service Pack 2 – Run Once

NEW FEATURE No. 6 – AppSense Environment Manager 8.0 Service Pack 2 – Group SID Refresh

NEW FEATURE No. 7 – AppSense Environment Manager 8.0 Service Pack 2 – Trigger Action Time Audit Event

NEW FEATURE No. 8 – AppSense Environment Manager 8.0 Service Pack 2 – Stop If Fails

NEW FEATURE No. 9 – AppSense Environment Manager 8.0 Service Pack 2 – New Application Categories in the User Interface

NEW FEATURE No. 10 – AppSense Environment Manager 8.0 Service Pack 2 – Refresh

NEW FEATURE No. 11 – AppSense Environment Manager 8.0 Service Pack 2 – Registry Hive Exclusions