Policy Product Guide. Version 10.1 FR1

Transcription

1 Plicy Prduct Guide Versin 10.1 FR1

2 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cpyright Ntice This dcument cntains the cnfidential infrmatin and/r prprietary prperty f Ivanti, Inc. and its affiliates (referred t cllectively as Ivanti ), and may nt be disclsed r cpied withut prir written cnsent f Ivanti. Ivanti retains the right t make changes t this dcument r related prduct specificatins and descriptins, at any time, withut ntice. Ivanti makes n warranty fr the use f this dcument and assumes n respnsibility fr any errrs that can appear in the dcument nr des it make a cmmitment t update the infrmatin cntained herein. Fr the mst current prduct infrmatin, please visit Cpyright , Ivanti. All rights reserved. Ivanti and its lgs are registered trademarks r trademarks f Ivanti, Inc. and its affiliates in the United States and/r ther cuntries. Other brands and names may be claimed as the prperty f thers. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 2 f 226

3 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Table f Cntents Plicy Prduct Guide 1 Cpyright Ntice 2 Table f Cntents 3 Abut Envirnment Manager 6 What's New in Envirnment Manager? 6 Licensing 8 Architecture 11 Cnsle 13 Envirnment Manager Administrative Tls 20 Service Packs 21 Best Practices fr Cnfiguratin 22 Keybard Shrtcuts 27 Wildcards and Regular Expressins 28 Abut Plicy Cnfiguratin 29 Managing Cnfiguratins 30 Advanced Cnfiguratin Settings 31 Persnalizatin Servers Plicy 40 Auditing 42 Run As User Library 48 Grup Plicy Lcatin 50 Cnfiguratin Change Tracking 50 Default Timeut Settings 58 Cnfiguratin Tasks 59 Library 61 Cnfiguratin Layering 62 Cmpnents 62 Layered Cnfiguratin 63 Nested Layers 64 Excluded frm Layering 64 Trigger Envirnment Actins and Cnditins 65 User Messages, Blcked Text Libraries and Run As Libraries 66 Manage Layered Cnfiguratins 66 Cnfiguratin Dependencies 76 Cnfiguratin Endpint Merging 79 Cmpnents in a Merge 79 ManifestGen Tl 81 BatchCnfig Tl 84 Auditing Events - Cnfiguratin Endpint Merging 85 Merging Cnfiguratins 85 Live Cnfiguratin Rules 88 Triggers 89 Cmputer Triggers 89 User Triggers 90 Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 3 f 226

4 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Prcess Start and Stp Triggers 93 Netwrk Triggers 94 Trigger Envirnment 97 Nde Management 100 Cnfiguring Ndes 100 Nde Descriptins 102 Nde Scheduling 103 Add New Nde t a Cnfiguratin r Prcess Trigger 105 Arrange Ndes 108 Stp Sub Ndes n Fail 109 Nde Grups 109 Clne 111 Reusable Ndes 112 Cnditin Management 117 Create a Cnditin 118 Cnditin Variables 118 Field Validatin 121 Registry Cnditins 124 File and Flder Cnditins 126 Directry Membership Cnditins 128 User Cnditins 129 Cmputer Cnditins 130 Sessin & Client Cnditins 132 Custm Cnditins 136 Reusable Cnditins 139 Envirnment Cnditins 140 Flw Cntrl Cnditins 142 Actin Management 151 Cnfiguring Actins 151 Registry Actins 154 File and Flder Actins 158 Drives and Printers Actins 175 ODBC (Open Database Cnnectivity) Actins 180 Custm and Execute Actins 181 Grup Plicy Actins 183 Envirnment Actins 187 Shrtcut Actins 192 Lgn/Lgff Message 197 Fast Lgff Actin 197 Self Heal Actins 198 DataNw Actin 201 Set Desktp Wallpaper 205 Outlk Actins 206 Tls and Wizards 210 Plicy Templates 210 Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 4 f 226

5 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnfiguratin Prfiler 211 Grup SID Refresh 213 Lckdwn Management 215 App-V 4.x Wizard 226 Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 5 f 226

6 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Abut Envirnment Manager Envirnment Manager prvides n-demand persnalizatin f user desktps n-demand and helps prtect endpints with fine-grained cntextual plicy cntrl. Envirnment Manager Persnalizatin prvides: Fast lgn times A fully persnalized desktp experience, regardless f lcatin r device A secure desktp envirnment that adapts based n user cntext Use Envirnment Manager Plicy t: Enfrce plicy real-time thrughut the user sessin, nt just at lgin Help meet crprate and industry-based cmpliance mandates such as HIPAA, FINRA, and PCI Run multiple plicies in parallel fr the best pssible user experience. What's New in Envirnment Manager? Versin 10.1 FR1 Cnsle Rebrand and Renaming The Envirnment Manager Cnsle has been updated t reflect the new cmpany name f Ivanti - see here fr mre details. Yu may still see the AppSense Envirnment Manager name used in certain areas, such as the registry r services. This is t make the transitin as least disruptive as pssible fr existing. Icn Refresh Having made significant changes t the design f the DesktpNw cnsles in versin 10, we have listened t feedback and added a splash f clr back int the cnsles by refreshing and updating sme f the icns used in the Envirnment Manager cnsle. Scheduling f Plicy Ndes It is nw pssible t cnfigure Envirnment Manager Plicy Ndes t additinally als run at a given schedule. This prvides Administratrs with the flexibility t re-apply r evaluate specific actins r cnditins within their cnfiguratin at a determined interval withut the trigger having t be reexecuted. Fr example, if an Administratr chse t schedule a Nde within the User Pre-Desktp Trigger. It culd run bth during lgn and at the determined schedule irrespective f whether the User had lgged ff and n again. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 6 f 226

7 Envirnment Manager 10.1 FR1 Plicy Prduct Guide By using a similar wrkflw t the Windws Task Scheduler, we have made it simple fr custmers t leverage this new functinality as an alternative t cmplex scripting. This feature is available within bth the User and Cmputer Plicy Triggers. Cnfiguratin Ntes and Cmments Within Envirnment Manager Plicy, Administratrs can nw anntate their Nde Actins and Cnditins. This feature intrduces 3 new ptins: Cmments within the Plicy Nde Actin pane The default Nde descriptin is nw editable A Ntes tab has been added t the Plicy Nde Actin view These are especially useful in envirnments were multiple administratrs will be accessing Plicy cnfiguratins, allwing fr visual tracking f key additinal details and updates within the cnfiguratin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 7 f 226

8 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Licensing DesktpNw Licensing cnsle allws yu t manage DesktpNw prduct licenses. The Licensing cnsle allws yu t: Manage licenses fr single prducts, the DesktpNw Suite and Evaluatin licenses. Exprt license packages t MSI r LIC file frmat fr saving t the Management Center r ther cmputers which can be remtely accessed. Imprt and manage licenses frm LIC file frmat. Fr infrmatin abut license deplyment t endpints, see Management Center Help. Managing Licenses License details are included in the License Agreement which is issued when an rder fr ther sftware has been cmpleted. The License Agreement includes the fllwing infrmatin: Prduct, Feature, and Versin Details Issue Date Expiry Date Custmer Name Serial ID Tgether with the license agreement yu will receive either a TXT file r a LIC file. Use these in the Licensing Cnsle t add r imprt the license. Add a License 1. Open the Licensing cnsle. 2. Click Add. The Add License Key dialg displays. 3. Enter the License Key and click Add. If yu received a TXT file license, pen the file and cpy the license key, paste it in t the Add License Key dialg. If yu received a LIC file license, refer t "Imprt License Files" n page 10. Details f the license are displayed in the cnsle and the license key is added t the fllwing lcatin: %ALLUSERSPROFILE%\AppSense\Licenses Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 8 f 226

9 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Activate a License Once added, sme licenses require activating. 1. Select a license r add ne t the licensing cnsle. 2. Click Activate. 3. Type r cpy and paste the activatin cde. 4. Press Enter t accept the cde. The license cnsle saves the license key t the MS Windws registry n the lcal machine. The License Status field updates t shw the status f the license and the license details display in the lwer part f the cnsle. T check that the license is active n yur endpint, search the registry fr the license cde. If the search finds the cde, then the license is active. Remve a License 1. Highlight the required license and click Remve. A cnfirmatin dialg displays. 2. Click Yes t cnfirm. The selected license is deleted and remved frm the cnsle and the MS Windws registry r %ALLUSERSPROFILE%\AppSense\Licenses lcatin, whichever is applicable t the license type. Exprt License Files Exprt licenses t an MSI r LIC file t create a backup and enable distributin t ther endpints using the Licensing cnsle r the Management Center. 1. Highlight the license yu want t exprt. 2. Click Exprt t display Windws Save As dialg. 3. Brwse t the required lcatin t save the license file. 4. Enter a name fr the file. 5. Select the file type: MSI r LIC. 6. Click Save. A file is created and saved in the selected lcatin. This file can be cpied t any netwrk lcatin and laded via the DesktpNw Suite Licensing cnsle r in the Management Center cnsle. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 9 f 226

10 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Imprt License Files Imprt a previusly exprted license t an endpint using the Licensing cnsle. 1. Open the Licensing cnsle. 2. Click Imprt t display the Windws Open dialg. 3. Navigate t the required LIC file. 4. Click Open. Details f the license are displayed in the cnsle and the license key is added t the fllwing lcatin: %ALLUSERSPROFILE%\AppSense\Licenses Trubleshting I received a license, what d I d? If yu have received a prduct license yu can lad the license by launching the DesktpNw Suite Licensing Cnsle n yur client cmputer and entering the license cde. I have entered a license, but it says it is nt activated, why? Sme licenses require activatin befre they can be used. Activatin cdes are prvided by Ivanti. Activate a license by entering the License and Activatin cdes int the cnsle. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 10 f 226

11 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Architecture The Envirnment Manager system cnsists f the Envirnment Manager Cnsle, Envirnment Manager Agent, Persnalizatin Server and Database. The cnsle is an administrative tl t create and manage cnfiguratins. The agent resides n the cntrlled cmputers and can receive cnfiguratins frm the Management Center r third party deplyment system t manage the machine and user envirnment. The cnsle als prvides a live cnnectin t the Persnalizatin Database. The Persnalizatin Server runs as a website, using IIS n either Windws Server 2003 r Client machines (Tier 1) cnnect thrugh HTTP(s) handlers, and the Cnsle uses WCF Services. The Persnalizatin Server acts as a brker between the Client and Database, prviding a secure channel t read and write the Persnalizatin data. It is designed t supprt thusands f users simultaneusly and multiple Persnalizatin Servers can be cnfigured in parallel t use a single Database. Envirnment Manager can perate either in Standalne r Enterprise mde. In Standalne mde, the cnsle saves its settings directly t the lcal system. In Enterprise mde, different cnfiguratins can be deplyed t the cntrlled cmputers depending n yur system requirements. This help describes the use f Envirnment Manager in Standalne mde. Fr details n centralized management mde please refer t the Management Center Help system. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 11 f 226

12 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Plicy Cnfiguratin and User Persnalizatin wrk tgether t prvide cmplementary cntrl f the entire user envirnment. Inevitably there are sme areas f verlap. The prfile settings are applied in the fllwing stages: Default Settings - Plicy Cnfiguratin Usually ccur thrugh the use f mandatry prfiles, althugh Plicy Cnfiguratin is free t set anything at this stage. Virtual Settings - User Persnalizatin User specific changes t their wn persnality settings that are being managed by User Persnalizatin. These are applied n tp f the defaults. Enfrced Settings - Plicy Cnfiguratin Any plicies that the administratr wants t set regardless f hw the user has changed their applicatin previusly, s these are applied last. The user may be free t change these whilst the applicatin is running, but they will be reapplied the next time the applicatin runs. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 12 f 226

13 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnsle The Envirnment Manager Cnsle launches frm the start menu: Start > All Prgrams > AppSense > Envirnment Manager > Envirnment Manager Cnsle. When accessed in this way the cnsle pens with an empty and untitled cnfiguratin. The cnsle als starts when a saved cnfiguratin is pened. There are three variants f the Envirnment Manager cnsle: Persnalizatin - Installs nly the persnalizatin element f Envirnment Manager Plicy - Installs nly the plicy element f Envirnment Manager Bth cnsles - Installs the cmbined cnsle; bth persnalizatin and plicy are installed. The chice f which cnsle t install is made during installatin. Elements Reslutin Recmmended screen reslutin fr the cnsle is 1024 x 768 pixels. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 13 f 226

14 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Installing the Cnsles The traditinal Envirnment Manager installatin, using Setup.exe, autmatically installs the cmbined cnsle. Sme administratrs may nt require access t bth. Fr example, they may nly be respnsible fr cnfiguring persnalizatin and have n need fr the plicy side f the cnsle. Installing the Persnalizatin r Plicy cnsles can nly be dne using the EnvirnmentManagerCnsle MSIs. Fr mre infrmatin abut installatin, see the DesktpNw help. Ribbns Ribbns include buttns fr perfrming actins, arranged in grups, accrding t the area f the cnsle t which the actins relate. Fr example, the Edit ribbn page includes all cmmn tasks, such as Cut, Cpy and Paste. Split ribbn buttns cntain multiple ptins and are indicated by an arrw just belw the buttn. Click the arrw t display and select the list f ptins, r simply click the buttn fr the default actin. Help The Help buttn n the Help ribbn launches the Help fr the prduct and displays the tpic relating t the current area f the cnsle in view. A smaller icn fr launching the Help displays at the far right f the cnsle, level with the ribbn page tabs. Navigatin Pane The Navigatinpane cnsists f the navigatin tree and navigatin buttns. The navigatin tree is the area fr managing ndes f the cnfiguratin. The navigatin buttns allw yu t view the different areas f the cnsle, i.e. the Plicy Cnfiguratin and User Persnalizatin. Wrk Area The Wrk Area prvides the main area fr managing the settings f the cnfiguratin and prduct. The cntents f the wrk area vary accrding t the selected ndes in the navigatin tree and the selected navigatin buttns. Smetimes the wrk area is split int tw panes. Fr example, ne pane can prvide a summary f the settings in the ther pane. Additinal Cnsle Features Shrtcut Menu right-click shrtcuts are available in the navigatin tree and sme areas f the cnsle. Drag and Drp this feature is available in sme ndes f the navigatin tree. Cut/Cpy/Paste these actins can be perfrmed using the buttns in the Edit ribbn, shrtcut menu ptins and als using keybard shrtcuts. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 14 f 226

15 Envirnment Manager 10.1 FR1 Plicy Prduct Guide File Menu The File menu prvides ptins fr managing cnfiguratins including create new, pen existing, save, imprt and exprt cnfiguratins and print. Optin New Open Descriptin Creates a new default cnfiguratin which is lcked fr editing. Opens an existing cnfiguratin frm ne f the fllwing lcatins: Live cnfiguratin n this cmputer Cnfiguratin frm the Management Center Cnfiguratin file frm disk: AppSense Envirnment Manager Package Files frmat (AEMP). Cnfiguratin frm System Center Cnfiguratin Manager A live cnfiguratin is lcated n a cmputer which has Envirnment Manager Agent installed and running. Save Updates the current cnfiguratin with any changes made since the last change. Click the arrw by the icn t access the fllwing Management Center Specific ptins: Save and Cntinue Editing - Save the cnfiguratin and keep it lcked and pen fr editing. The cnfiguratin cannt be deplyed whilst lcked. Use t save yur changes whilst cntinuing t update the cnfiguratin. Save and Unlck - Save the cnfiguratin and unlck it ready fr deplyment. Unlck withut saving - Unlck the cnfiguratin withut saving changes. A live cnfiguratin is lcated n a cmputer which has Envirnment Manager Agent installed and running. Save As Saves the cnfiguratin with a new name t ne f the fllwing lcatins: Live cnfiguratin n this cmputer - Save the current cnfiguratin n the current cmputer and apply it as the wrking cnfiguratin. Cnfiguratin in the Management Center - Creates the current cnfiguratin in the package stre n the selected Management Center. Cnfiguratin in System Center Cnfiguratin Manager - Saves yur cnfiguratin t the specified System Center Cnfiguratin Manager server. Cnfiguratin file n disk - Saves the current cnfiguratin as a file n a lcal r netwrk drive in AEMP frmat. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 15 f 226

16 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Optin Imprt & Exprt Descriptin Imprt cnfiguratin frm MSI - Imprts a cnfiguratin frm an existing MSI package, fr example, legacy cnfiguratins which have been exprted and saved frm legacy cnsles. Exprt Cnfiguratin as MSI - Exprts the current cnfiguratin as a MSI package. Exit Clses the cnsle. Yu are prmpted t save any changes yu have made t the current cnfiguratin. Quick Access Tlbar The Quick Accesstlbar prvides quick functinality fr managing the cnfiguratin setup, such as Save, Save and Unlck, Und, Red, and navigatin t previusly and next displayed views. Buttn Descriptin New Opens a new, empty default cnfiguratin which is lcked fr editing. If yu already have a cnfiguratin pen, yu will be prmpted t save it befre yu pen a new ne. Open Cnfiguratin frm the Management Center Opens an existing cnfiguratin frm the Management Center. Save Saves changes t the cnfiguratin. The cnfiguratin will remain lcked if pened frm the Management Center. Save and Unlck Saves the cnfiguratin t the Management Center and unlcks it t allw deplyment. The current cnfiguratin clses and a new default cnfiguratin pens. Save As Saves the cnfiguratin with a new name t ne f the fllwing lcatins: Live cnfiguratin n this cmputer - Save the current cnfiguratin n the current cmputer and apply it as the wrking cnfiguratin. Cnfiguratin in the Management Center - Creates the current cnfiguratin in the package stre n the selected Management Center. Cnfiguratin in System Center Cnfiguratin Manager - Saves yur cnfiguratin t the specified System Center Cnfiguratin Manager server. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 16 f 226

17 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Buttn Descriptin Cnfiguratin file n disk - Saves the current cnfiguratin as a file n a lcal r netwrk drive in AEMP frmat. Back and Frward Cycle thrugh the views yu have visited in a sessin. Fr example, if yu select the Cmputer trigger and then the User trigger, the Back buttn takes yu t the Cmputer trigger and a subsequent click f the frward buttn, takes yu t the User trigger. These are navigatin tls nly and d nt affect the actin yu have perfrmed in the cnsle. Und Clears the actin histry. Up t 20 previus actins are listed. Select the pint at which yu want t clear the actins. The actin selected and all preceding actins are undne. Red Re-applies the cleared actin histry. Up t 20 cleared actins are listed. Select the pint at which yu want t red the actins. The actin selected and all preceding actins are redne. Expand All Expand all ndes, actins and cnditins in a selected area f the cnsle. Cntext sensitive t the selected item and wrks in the navigatin tree r the wrk area. Fr example, if used when the Cmputer trigger is highlighted, all triggers and ndes within the Cmputer trigger are fully expanded. T expand all triggers and ndes in a cnfiguratin, select the Envirnment Manager item at the tp f the pane and select Expand All. In the wrk area, if a cnditin is highlighted, all sub cnditins and actins are fully expanded. Cllapse All Cllapses all ndes, actins and cnditins - wrks as Expand All but in reverse. Managing the Quick Access Tlbar The Quick Access Tlbar can be cnfigured t add and remve functins and change its psitin within the cnsle: Right-click n a ribbn buttn r file menu ptin and select Add t Quick Access Tlbar t add it t the Quick Access Tlbar. Right-click n a tlbar item and select Remve Frm Quick Access Tlbar t remve it. Right click n a ribbn r the tlbar and select Shw Quick Access Tlbar Belw the Ribbn t display the tlbar belw the ribbn. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 17 f 226

18 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Find and Replace Envirnment Manager cnfiguratins can be searched using text strings and regular expressins. The whle f the navigatin tree can be searched r individual areas, such as a nde r a trigger, can be targeted. Searches include all ndes, child ndes, cnditins and actins in a cnfiguratin r within the selected area. Find and Replace culd be used, fr example, t change the name f a server thrughut the cnfiguratin, t amend the IP address f a particular endpint r just t find where in a cnfiguratin a particular registry key is referenced. Perfrm a Find and Replace 1. In the Edit ribbn, select Find and Replace. The Find and Replace dialg displays. If yu want t target the search, select the required area f the cnfiguratin prir t pening the dialg. In the example belw, the Cmputer\Prcess Started trigger was selected. This can be changed in the dialg as explained in step In the Find field, enter the text t search fr r the regular expressin yu want t use fr the search. 3. In the In field, define which elements f the cnfiguratin yu want t search - Actins, Cnditins, Ndes and/r Reusable Ndes. 4. Check that the Where field shws the path t the area f the cnfiguratin yu want t search. If the path is incrrect: Amend the path manually Delete the path t search the whle cnfiguratin Select a previusly searched path frm the drp-dwn 5. In the Replace with field, enter the replacement text. If yu are perfrming a search, this field can be left blank. 6. Cnfigure the find ptins by selecting any cmbinatin f the check bxes: Match Case - Search fr nly thse items which match the capitalizatin f the text in the Find text Match Whle Wrd - Search fr nly thse items which match the whle wrd in the Find field. Use Regular Expressins - Return any items which match the regular expressin entered in the Find field. 7. Click Find t display all items that match yur search criteria. Search Results The search results list any item which matches the query and shw where the item is fund in the cnfiguratin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 18 f 226

19 Envirnment Manager 10.1 FR1 Plicy Prduct Guide In the example belw, the user has searched fr "CurrentVersin". The search results include the registry key "Sftware\Micrsft\Windws\CurrentVersin\Explrer". This registry key is referenced in actins fund in tw different triggers in the cnfiguratin. The path t each f the actins is displayed beneath the match. Select a path t autmatically navigate t that area f the cnfiguratin. T mve t the next match, click Find Next. If yu want t replace text, select the required match and click Replace - t replace all matches click Replace All. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 19 f 226

20 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Yu can redefine a search at any time by updating the criteria and clicking Find t update the results. Fr example, yu restrict yur search t Cnditins r fcus the search n anther area f the cnfiguratin. T view r edit an actin r cnditin in the search results, select the item and click View/Edit. The item pens in the relevant dialg. Envirnment Manager Administrative Tls Envirnment Manager is packaged with standalne utilities that help administratrs create cnfiguratins and manage the Persnalizatin Database. The tls are run independently frm Envirnment Manager and all ur ther prducts. The Administrative Tls installer is included with the Envirnment Manager installatin media in bth 32 and 64-bit versins: EnvirnmentManagerTls32 EnvirnmentManagerTls64 Once installed t the default lcatin, the fllwing tls are available: Envirnment Manager Mnitr (EmMn) Persnalizatin Server Lg Viewer Envirnment Manager File Cnversin EMP File Utility EMP Migrate Utility EMP Migrate Cmmand Line Utility EMP Registry Utility File Based Registry Explrer Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 20 f 226

21 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Service Packs Service Packs are self-cntained packages r patches that are used t update specific files within a DesktpNw applicatin withut reinstalling the full applicatin. Service packs can be applied mre ften and reduce the need fr system restarts n yur endpints. Service packs are delivered as a Windws Installer patch (MSP) file and are ften referred t as patch files. Install a Service Pack Service Packs can be installed r deplyed using the same technlgy and techniques used when installing MSIs. Bth Micrsft System Center and the Management Center 8 FR4 can deply MSPs. If neither f these prducts are available, service packs can be installed using the cmmand line interface. Fr example, the cmmand: msiexec.exe /p EnvirnmentManagerAgent64.msp installs any files that have been amended as part f the patch fr just Envirnment Manager 64 bit agent. The fllwing cmmand installs the base versin f the Envirnment Manager Agent (MSI) and the Envirnment Manager patch file (MSP) simultaneusly: msiexec.exe /i EnvirnmentManagerAgent64.msi PATCH=c:\fullpath\EnvirnmentManagerAgent64.msp A base versin must be installed befre the patch file can be applied. If the patch file cntains driver r hk files that are currently in use n the machine the patch is being applied t, yu are infrmed that a rebt is required. If yu chse t cntinue, the system is restarted when the patch has been applied. Fr infrmatin n installing and upgrading service packs using Management Center, see the DesktpNw help. Installatin Order and Dependencies It is recmmended that all cmpnents f a service pack are installed and that the PersnalizatinServerXX.MSP is installed first. All ther cmpnents have n required install rder. Rll back a Service Pack Yu can rll back r install service packs using either the Management Center (8 FR4 nwards) r the Windws Cntrl Panel. When yu uninstall a service pack, the prduct reverts t the previus latest build - whether a service pack r base versin. With the exceptin f the Persnalizatin Server cmpnent patch file (PersnalizatinServerXX.msp) All agent and cnsle service pack cmpnents can be uninstalled. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 21 f 226

22 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Rll Back a Service Pack Using the Management Center 1. In the Management Center cnsle, select Overview > Deplyment Grups tab > Deplyment Grups. 2. Highlight the Deplyment Grup and select Settings > Assigned Packages. The Assigned Packages wrk area displays a list f all the prducts and their assciated packages. 3. Highlight the required Envirnment Manager service pack and click Unassign frm the Actins menu. 4. Click Review and Submit. The Submit Changes dialg displays. 5. Check the details are crrect and click Submit. The patch is unassigned based n the deplyment grup Installatin Schedule. Rll Back a Service Pack Using the Windws Cntrl Panel Frm the Cntrl Panel select Prgrams and Features and uninstall the required patch. Best Practices fr Cnfiguratin This sectin utlines the key pints fr cnsideratin when setting up yur Envirnment Manager cnfiguratin. Mandatry vs Lcal Prfiles During design and implementatin stages, cnsideratin shuld be given t the type f prfile which needs t be used as the base t be laded fr the user befre Envirnment Manager Persnalizatin verlays the user s actual settings. Typically, Mandatry prfiles are used which are very light weight and cntribute t faster lgn times fr users. This prfile is ideal fr envirnments where all users are accessing devices which are permanently nline. If users als use laptps t wrk ffline, then yu need t lk at hw their accunt is managed when the laptp is ffline; d they: Use an Active Directry accunt? Use a Lcal Prfile and prvide Active Directry credentials when accessing cmpany resurces? In these instances, it may be easier t leave the user prfile path within Active Directry blank and allw users t lad a lcal prfile as a base. The cached cpy f the lcal prfile must be deleted using the Micrsft utility, DELPROF. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 22 f 226

23 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Anther slutin is t create the MAN file fr the Mandatry prfile, placed within the lcatin f %SYSTEMDRIVE%\Default User. This allws tw benefits: Yu d nt have t specify a path within the User prperties f Active Directry As it is a Mandatry prfile, the Windws perating system will flush this autmatically. This will require sme time t cpy t each managed device. Applicatins that use INI Files Sme applicatins that are used within an envirnment require the use f INI files r files f this type t keep certain settings fr the user. If the INI file is kept within the user s prfile this is typically nt a prblem fr Envirnment Manager Persnalizatin. When the INI file is nt kept within the user s prfile, but in anther lcatin, fr example, C:\Windws, then yu may nt want Envirnment Manager Persnalizatin t capture infrmatin frm this lcatin, due t the nature and the amunt f files in that lcatin. At this pint, yu can use Envirnment Manager Plicy actins t cpy dwn the file r flder t the lcatin during either a Lgn r a Prcess Start trigger fr the applicatin and then cpy the file r flder back up t the user s hme directry during a Lgff r Prcess Stp trigger. Persnalizatin Membership Perfrmance Each cnditin evaluates matches and queries at different speeds prviding different respnse times. These differences culd be due t sme cnditins evaluating against lcal data and therefre prviding rapid respnse times. Other cnditins may require cnnectin t the netwrk thereby increasing respnse times and relying n cnnectin speeds. The cnditins in the tables belw have been rated by perfrmance speed fr carrying ut matches and queries. By creating cnfiguratins with these respnse times in mind, perfrmance can be ptimized. Fr example, if a cnfiguratin cntains OR cnditins, place them in rder f respnse time with the quickest evaluating first. If the first cnditin matches, the cnfiguratin is nt held up by the slwer respnse time f the secnd cnditin. Directry Services Expressins Cnditin Match Query Site Membership Fast N/A Cmputer OU Membership Slw Slw User OU Membership Slw Slw Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 23 f 226

24 Envirnment Manager 10.1 FR1 Plicy Prduct Guide User Expressins Cnditin Match Query Is Administratr Fast N/A User Name Fast Fast User Grup Name Fast Medium Cmputer Expressins Cnditin Match Query Cmputer IP Address Fast Fast Cmputer Dmain Membership Fast Fast Cmputer NETBis Name Fast Fast Cmputer Grup Fast Medium Cmputer Name Slw Slw Enabling Reverse DNS Lkup n the server increases the perfrmance f the Cmputer Name cnditin. Printer Settings fr Persnalizatin If printer settings are required t be kept by the user, then the fllwing keys need t be added t Windws Settings within the Persnalizatin Server: HKEY_CURRENT_USER\Printers HKEY_CURRENT_USER\Sftware\Micrsft\Windws NT\CurrentVersin\Devices HKEY_CURRENT_USER\Sftware\Micrsft\Windws NT\CurrentVersin\Windws Masquerading Applicatins T enable managed applicatins t share user Persnalizatin settings, it is necessary t create an applicatin grup. Fr example, this culd be a Micrsft Office grup cntaining Wrd, Excel, Outlk and PwerPint. It may, hwever, be useful t use a Masquerading Applicatin t allw an applicatin access t anther applicatin s persnalizatin data withut having t create an applicatin grup. Fr example, running mlcfg32.cpl against Outlk s persnalizatin data t view its registry settings n the client. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 24 f 226

25 Envirnment Manager 10.1 FR1 Plicy Prduct Guide T d this, create an entry in the Advanced Settings dialg: Name: MasqueradingApps Value: rundll32.exe;ffice12\mlcfg32.cpl;utlk.exe; : This value equates t: <RealExe>;<RealExe Cmmandline>;<TargetExe>;<TargetExeVersin>: Fr this example, mlcfg32.cpl is gruped with Outlk t share its persnalizatin data. <TargetExeVersin> matches the versin cnfigured in the database fr Outlk. If it is set t a wildcard (.*), any versin can be supplied here. These entries can be chained tgether t prvide multiple settings. Client Specific Masquerading The MasqueradingApps setting is glbal and as such, applies n all managed end-pint devices. Hwever, t achieve the same behavir, applicatins can be launched n individual client machines with a special cmmand-line argument: /APPSENSESPECIAL. The syntax n the client is: <RealExe> /appsensespecial:<targetexe>:<targetexeversin> Sme applicatins such as regedit.exe, d nt wrk crrectly with extra cmmand-line arguments. These applicatins shuld be launched using a cmmand shell which has been run with the APPSENSESPECIAL switch. Fr example, cmd.exe /appsensespecial:ntepad.exe: wuld launch with the cmmand shell sharing the persnalizatin settings f Ntepad. Regedit.exe can nw be launched frm within the cmmand shell and will have access t Ntepad s settings. In the abve scenari, ensure that regedit.exe is nt already defined as a managed applicatin r blacklisted. There shuld be n ther instances f cmd.exe r regedit.exe running. Create Persnalizatin Caches Based n Envirnment Variables The Advanced setting, MasqueradeAppByEnvVar allws the Persnalizatin cache used by Envirnment Manager t be changed based n the existence f an envirnment variable n the end pint. This allws greater flexibility where Persnalizatin is required fr the same versin f an applicatin, acrss multiple machines where ne instance f the applicatin is using different plug-ins. Fr example, if Micrsft Excel 2007 is run n three Windws 7 devices, by design it wuld share Persnalizatin settings between all three. If ne f thse devices was running different plug-ins t the thers, it culd be useful fr this versin f Excel t use separate Persnalizatin settings. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 25 f 226

26 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnfigure Persnalizatin Caches Based n Envirnment Variables The fllwing steps shw hw t cnfigure the user interface using the Excel scenari. 1. Create the fllwing entry in the Advanced Settings dialg: Name: MasqueradeAppByEnvVar Value: TargetExe>%ENV_VAR% Fr the Excel scenari, the value wuld be Excel.exe>%MASQ%. MASQ is an envirnment variable set n the client. 2. Create the fllwing managed applicatins: Name Executable OS RegEx Versin RegEx Excel Excel.exe.*.* Excel MASQ Excel.exe.masq.*.* The Excel.exe.masq executable entry prvides an alternative t excel.exe using a different cache t allw separate Persnalizatin t be used fr the same applicatin. Client Cnfiguratin Add the envirnment variable called MASQ with a value f masq. When Excel is run, its Persnalizatin settings g int a cache called Excel MASQ. If the MASQ variable is remved, Excel settings will g int a cache called Excel. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 26 f 226

27 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Keybard Shrtcuts Envirnment Manager uses the fllwing keybard shrtcuts: Shrtcut Key Ctrl+X Ctrl+C Ctrl+V Insert Delete F2 Ctrl+T Ctrl+F Crtl+Arrw keys Enter Functin Cut ndes, actins and cnditins. Cpy ndes, actins and cnditins. Paste ndes, actins and cnditins. Used as multiple Add functins. Fr example t add a nde r trigger in Plicy cnfiguratins and t add applicatins t White and Blacklists and persnalizatin grups in User Persnalizatin. Delete navigatin tree and wrk area elements such as ndes, actins and applicatin grups. Rename a navigatin tree element such as a nde r persnalizatin grup. Disable / enable ndes, actins r cnditins. Find and replace specific text within a cnfiguratin. Mve an element within bth Plicy Cnfiguratin and User Persnalizatin navigatin trees. Edit a cnditin r actin. When a cnditin r actin is highlighted, press Enter t pen the dialg bx t edit the element. Where a keybard shrtcut is available, it will be listed by the apprpriate ptin in a drp-dwn list. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 27 f 226

28 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Wildcards and Regular Expressins This sectin cntains examples f wildcards and regular expressins and hw they can be used in Envirnment Manager. Envirnment Manager uses CAtIRegExp Class regular expressins. Fr further infrmatin n CAtIRegExp Class regular expressins, refer t Expressin ^[a-f]+ Matches "alice" matches because her name starts with a letter between a and f "jhn" des nt match because his name starts with a letter greater than f "Alice" des nt match because her name des nt start with a lwercase letter ^[a-fa-f]+ [a-za- Z]+\d\d\d$ "Alice" matches because with this expressin uppercase letters are allwed "UserWithThreeNumbers123" matches because the user name is made up f alpha numerics fllwed by 3 numbers "UserWithFurNumbers1234" des nt match because the user name has fur numbers in it The dmain name can als be specified in regular expressins. Fr example, appsense\\^[a-f]+ matches all user names which have a first letter a t h. Withut a dmain name in the regular expressin, the query matches any user names which have a first letter frm a t h in any dmain. Expressin (ntepad) (winwrd) (calc).exe Matches ntepad.exe matches because it is in the list wrdpad.exe des nt match because it is nt in the list ^!(ntepad.exe) ntepad.exe des nt match because ntepad is specifically excluded wrdpad.exe matches because it is nt ntepad ^!((ntepad.exe) (calc.exe) (winwrd.exe)) wrdpad.exe matches because it is nt in the list calc.exe des nt match because it is in the list Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 28 f 226

29 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Abut Plicy Cnfiguratin An Envirnment Manager Plicy cnfiguratin determines the behavir which applies t a machine r user based n a set f cnditins. The cnditins are applied t varius trigger pints, such as a user lgging n r a prcess starting. Once a set f cnditins is met, actins are applied t perfrm the required behavir. By creating a cnfiguratin, a plicy f cmputer usage can be defined, specifying what users have access t, hw they access it and what they can subsequently d with it. Using the hierarchical structure allws an executin rder t be set fr the cnfiguratin, creating a lgical flw f cmputer and user actins. Settings can be applied t whle rganizatins, setting general preferred behavirs r be mre specific; disabling ne ptin in an applicatin fr a particular user. Plicy Cnfiguratins are built using the framewrk prvided in the Plicy Cnfiguratin tree within the Envirnment Manager cnsle. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 29 f 226

30 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Managing Cnfiguratins Plicy Cnfiguratins are built using the framewrk prvided in the Plicy Cnfiguratin tree within the Envirnment Manager cnsle. At the tp level, the hierarchy cnsists f three fixed ndes: Library - Cntains reusable ndes and cnditins referenced in the cnfiguratin Cmputer Triggers - Cntains triggers relating specifically t the endpint User - Cntains triggers relating specifically t user actins Cnfiguratins are created within the Cmputer and User ndes by using a cmbinatin f the fllwing elements: Triggers are static elements fund within the Cmputer and User ndes which represent the events which ultimately trigger actins. Examples f triggers are Cmputer Startup and Prcess Stpped. Ndes are essentially cntainers that allw cnditins and actins t be assciated with triggers. Ndes act as the placehlders t create the hierarchy f the cnfiguratin, cntrlling dependencies and defining prcessing rder. Cnditins define the rules which specify when actins are carried ut. Fr example, a cnditin might be created which applies t certain cmputers r user names. They allw actins t be targeted allwing greater flexibility and custmizatin. Actins are applied when cnditins are met after a trigger is fired. Fr example, mapping drives and printers, creating shrtcuts and registry keys. Lckdwn actins are als available. These are prvided t disable r remve applicatin items and functinality. Fr example, disabling a menu ptin r buttn in an applicatin r prhibiting the use f certain keybard shrtcuts. By building up these elements, a cnfiguratin is created which cntrls endpint usage and user access. Fr example: Fixed Nde Trigger Nde Cnditin Actin User Lgn Map Printer Cmputer Name is Equal t Endpint 1 Map t Printer 1 The simple cnfiguratin abve maps Printer 1 at lgn fr the cmputer Endpint 1. During lgn, the Envirnment Manager agent checks the managed cmputer against that specified in the cnditin, Endpint 1. If the cnditin is met, the actin t map the printer t Printer 1 runs. If the managed cmputer is anything ther than Endpint 1, the actin is ignred. In the Envirnment Manager cnsle, the example wuld be as fllws: Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 30 f 226

31 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Advanced Cnfiguratin Settings Enable Lgn Sub-triggers In Envirnment Manager 8.5, a new Lgn trigger structure was intrduced replacing the single Lgn trigger with three sub-triggers. This increases efficiency and speeds up lgn times as Envirnment Manager actins can be cnfigured t run at their mst apprpriate pint during the user lgn prcess: Pre-Sessin - Actins take effect befre terminal services is ntified f the lgn. Registry, Grup Plicy and Envirnment actins are cmpatible with this sub-trigger. During the upgrade, actins which were previusly in the Lgn Envirnment tab are mved here. Pre-Desktp - Actins take effect when the user lgs n t the system but befre the desktp shell has started. During the upgrade, actins which were previusly in the Lgn trigger are mved here. Desktp Created - Actins take effect after the desktp shell and Explrer has started. T imprve efficiency and lgn times, any nn-critical Lgn actins shuld be added t this trigger, fr example, mapping drives and printers. Change the Lgn Sub-trigger Setting 1. Select the Plicy Cnfiguratin navigatin buttn. 2. On the Manage ribbn, select Advanced Settings. 3. Select the Cnfiguratin Settings tab. 4. Apply the Enable lgn sub-triggers ptin as required. Fr the setting t take effect n managed endpints, the Envirnment Manager Agent must be restarted. Enable lgn sub-triggers is applied by default fr new cnfiguratins. When upgrading cnfiguratins, yu are asked if yu want t upgrade t the sub-triggers mdel r keep the single Lgn trigger. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 31 f 226

32 Envirnment Manager 10.1 FR1 Plicy Prduct Guide The graphic belw shw a single cnfiguratin befre and after the Lgn trigger upgrade: After enabling Lgn sub-triggers: Lgn Cnditin 1 has been mved frm the Lgn Envirnment tab t a new Pre-Trigger nde beneath the Pre-Sessin trigger Ndes 1, 2, 3 and 4 have been mved frm the Lgn nde t the Pre-Desktp trigger The Desktp Created sub-trigger has been added Fr layered cnfiguratins, each layer must be upgraded individually r in bulk using the BatchCnfigTl befre being added back t the upgraded base cnfiguratin. If a cnfiguratin already includes ndes cnverted frm triggers, they will revert t sub-triggers when enabled. The Pre-Sessin sub-trigger is nly cmpatible with Registry, Grup Plicy and Envirnment actins. When a nde is cnverted back t the Pre-Sessin trigger, nn-cmpatible actins are remved. When yu disable sub-triggers, a nde structure is autmatically created t replicate the sub-triggers. The ptin t use the single lgn trigger is included t enable backwards cmpatibility. Functinality reverts t that f the 8 FR4 release and all changes t this feature made since 8.5 are excluded. The graphic belw shw the same cnfiguratin befre and after Lgn sub-ndes have been disabled. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 32 f 226

33 Envirnment Manager 10.1 FR1 Plicy Prduct Guide After disabling sub-triggers: Ndes 1, 2, 3 and 4 have been mved frm the Pre-Desktp sub-trigger t being direct child ndes f the Lgn trigger. Any ndes, actins and cnditins in the Pre-Sessin and Desktp Created sub-triggers are mved t newly created ndes f the same name. Any actins which are mved t the newly created DesktpCreated nde run befre the desktp is displayed t users. When switching frm sub-triggers t the single Lgn nde, we recmmend that yu review the actins in the Pre-Sessin nde fr Envirnment actins which wuld be better placed in the Lgn trigger Envirnment tab. See Trigger Envirnment. Change the Sub-trigger Setting 1. On the Manage ribbn, select Advanced Settings. 2. Select the Cnfiguratin Settings tab. 3. Apply the Enable lgn sub-triggers ptin as required. 4. Enable lgn sub-triggers is applied by default fr new cnfiguratins. When upgrading cnfiguratins, yu are asked if yu want t upgrade t the sub-triggers mdel r keep the single Lgn trigger. Fr the setting t take effect n managed endpints, the Envirnment Manager Agent must be restarted. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 33 f 226

34 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Mid-sessin Cnfig Changes Define when changes t the cnfiguratin are delivered t users. On the Manage ribbn, select Advanced Settings > Cnfiguratin Settings. Apply the Enable lgn sub-triggers ptin as required: Immediately - Changes are implemented as sn as the cnfiguratin is pushed ut t endpints. Unapply actins are als executed immediately, At lgn - When the updated cnfiguratin is deplyed, changes are implemented the next time a user lgs n, befre the User Lgn triggers are fired. Unapply actins wrk as nrmal - executed at lgff. At startup - When the updated cnfiguratin is deplyed, changes are implemented the next time the endpint is started, befre the Cmputer Startup trigger is fired. Unapply actins wrk as nrmal - executed at the next restart. Fr new cnfiguratins the default setting is At lgn. Hwever, fr upgraded cnfiguratins the Immediate setting will be applied t preserve the behavir f pre-8.5 cnfiguratins. Netwrk Events Define when the Netwrk Cnnected and Netwrk Discnnected triggers are fired. The fllwing ptins are available: Enabled - The Netwrk Cnnected and Netwrk Discnnected triggers fire when each netwrk adapter establishes r discnnects a cnnectin, regardless f whether a cnnectin t the same netwrk already exists. Disabled - The Netwrk Cnnected trigger fires when the first netwrk adapter establishes a cnnectin t the netwrk. The Netwrk Discnnected trigger fires when the last netwrk adapter discnnects a cnnectin t the netwrk. Each trigger will fire nly nce fr each netwrk. Fr new cnfiguratins the setting is enabled. Hwever, fr upgraded cnfiguratins the setting is disabled t preserve the behavir f pre-8.6 cnfiguratins. Fr the setting t take effect n managed endpints, the Envirnment Manager Agent must be restarted Cautin: Enabling this ptin increases the number f netwrk events. We recmmended that cnditins are used t restrict actins based upn netwrk cnnectin attributes. Flder Cpy Actins Define the behavir fr Flder Cpy actins that are running at lgff. The fllwing ptins are available: Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 34 f 226

35 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Enabled - Flder Cpy actins that are running at lgff are resumed at the next user lgn. Disabled - Flder Cpy actins that are running at lgff are nt resumed at the next user lgn. Custm Settings Cnfigure additinal settings which will be applied n managed endpints when an Envirnment Manager cnfiguratin is deplyed. Settings such as the default nde timeut can be cnfigured in the cnsle, remving the need t manually set the apprpriate registry keys. If a Custm Setting is added, it will be created n endpints r verride any existing setting. Custm Settings can be cnfigured t use apply the default value fr that setting r t use the value yu assign it; bth will verride existing settings. If a Custm Setting is nt added, that setting will nt exist unless it is already cnfigured n the endpint, in which case that value is used. When upgrading a cnfiguratin, a setting which already exists n an endpint will be verwritten by the value f the crrespnding Custm Setting. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 35 f 226

36 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Manage Custm Settings 1. Select the Plicy Cnfiguratin navigatin buttn. 2. Frm the Manage ribbn, select Custm Settings. The Cnfigure Custm Settings dialg displays. 3. Click Add t display the list f custm settings. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 36 f 226

37 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 4. Select the settings yu want t cnfigure and click OK. Multiple settings can be selected using the Ctrl and Shift keys r all settings can be added by pressing Ctrl + A. The selected settings are added t the Cnfigure Custm Settings dialg. Settings which are added will be cnfigured n endpints. Any settings which already exist n an endpint are used. 5. Set the values as required. All settings are initially set as Use Default, deselect the ptin t update its value. Any updated settings are displayed in bld. If Use Default is selected fr a setting, the crrespnding key is remved frm the registry as it is nt required fr the default behavir t apply. 6. Click OK. The settings are applied when the cnfiguratin is applied t managed endpints. Printer Mapping Setting Default Descriptin PrinterErrrCdes List f errr cdes separated by a cmma. AddPrinterSequential False Map printer actins can be perfrmed cncurrently r sequentially. Updating this setting t True remves issues created when the AddPrinterCnnectin API call is hit cncurrently. Certificates Setting Default Descriptin SpfPrfileFrWhleSessin False Windws mandatry prfiles have a limitatin restricting users frm installing and exprting private keys. PFX certificate types cntain embedded private keys and cannt be installed when the prfile is set t mandatry. This setting changes the sessin s Windws thinks a raming prfile is being used, allwing users t install PFX certificates with private keys. Plicy Engine Setting Default Descriptin RegexTimeut 2000 Set a timeut limit in millisecnds fr invalid regexes which may therwise evaluate fr a lng time. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 37 f 226

38 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Setting Default Descriptin NdeTimeut Set a limit in millisecnds which is given t ndes t cmplete befre the next nde is run. TriggerTimeut Infinite Set the length f time a trigger is given t cmplete its prcessing. If the value is -1 r a value is nt present, the timeut will wait frever. ShutdwnBailTimeut Infinite Timeut value in secnds fr actins still running at lgff r shutdwn. This applies t all running actins regardless f which trigger riginally instigated it. This shuld nly be used in fr lng running threads at lgff r shutdwn. Active Directry Setting Default Descriptin UseAlternativeUserGrupTest False Specifies that when checking user grup membership, it shuld be dynamic and use the OID_LDAP_MATCHING_RULE_IN_CHAIN filter. If set t true, user grup cnditins use a mre efficient methd f lkup which can als reflect grup changes during a sessin. Nte: This nly wrks if the Active Directry server is later than Server 2003 R2. ADUserGrupMembershipTimeut 120 When the UseAlternativeUserGrupTest setting is used, yu can specify a timeut value in secnds fr the OID_LDAP_MATCHING_RULE_IN_CHAIN query befre the request t the persnalizatin server and fr plicy user grup OU Membership cnditins. System Setting Default Descriptin LegacyAppInit False Set this value t True t use AppInit_DLLs value fr injecting Envirnment Manager cmpnents int prcesses during startup. If set t false, DLLs are laded by a kernel driver. EnableNestedCmputerGrupQueries False Allw the client t query Active Directry fr nested cmputer grups. This setting can affect Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 38 f 226

39 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Setting Default Descriptin the perfrmance f the client. Shell Setting Default Descriptin CreateSpecialPaths False When set t true, the flder exists check is perfrmed n CSIDs. End Pint Merging Setting Default Descriptin BaseCnfigMergeBehavir Remerge Cntrls whether new base cnfiguratins verride end pint layers r are merged with them. Remerge - When a new cnfiguratin.aemp is deplyed t endpints, a merge with the existing cnfiguratins in the MergeCnfigs directry is triggered. The new Merged_ Cnfiguratin.aemp becmes the live cnfiguratin. Replace - When the new cnfiguratin.aemp is deplyed t endpints, it replaces the Merged_Cnfiguratin.aemp as the live cnfiguratin. Custm Scripts Setting Default Descriptin PwerShellLadUserPrfile False This setting allws the PwerShell User Prfiles t lad when PwerShell Custm actins and cnditins execute. When set t False, PwerShell is hsted by Envirnment Manager and is n lnger used natively. If the PwerShellRunInHst engineering key is set t n, it verrides any setting yu have in PwerShellLadUserPrfile and PwerShell will always be hsted by Envirnment Manager. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 39 f 226

40 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Override XenDesktp Sessin Cnnect Triggers Setting Default Descriptin OverrideIcaSessinCnnectTriggers False When this setting is enabled and set t True, XenDesktp envirnments execute the Sessin Lck/Unlck triggers when a user discnnects/recnnects frm their sessin. This applies t XenDesktp versins inclusive. This setting has n affect if users are running XenDesktp 7.9 r later because these versins execute the Discnnect/Recnnect triggers anyway. Custm Setting and Engineering Key Interactin PwerShellRunInHst=0 PwerShellRunInHst=1 PwerShellLadUserPrfile=0 Hsted Hsted PwerShellLadUserPrfile=1 Native Hsted Persnalizatin Servers Plicy Enabling User Persnalizatin is a plicy decisin and the setting is cnfigured within the Plicy Cnfiguratin side f the cnsle. It is the deplyed cnfiguratin which determines whether managed endpints are subject t User Persnalizatin and t which server endpints cnnect. It is recmmended that multiple servers and/r virtual hsts are added t the Select Persnalizatin Server dialg s alternative servers can be easily selected fr failver purpses. Deply the plicy cnfiguratin that cntains a list f Persnalizatin Servers t the endpints sending the cnfiguratin.aemp t managed cmputers. The first time a user lgs n t a managed endpint, the Envirnment Manager agent cntacts the first persnalizatin server t request the actual list f servers the endpint shuld use (based n the sites cnfigured in the database). The client then cntacts the crrect server t pull dwn the User Persnalizatin cnfiguratin, cntaining the list f the applicatins which shuld be persnalized fr the user. If all attempts t cnnect t a Persnalizatin Server fail, then the User Persnalizatin cnfiguratin is nt dwnladed and User Persnalizatin des nt take place. Fr details abut cnfiguring Persnalizatin Servers, see the DesktpNw help. T cater fr such a scenari it is recmmended that the Timeut Cmmunicating with Persnalizatin Server auditing event is enabled. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 40 f 226

41 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnfigure a Persnalizatin Servers List 1. Select the Plicy Cnfiguratin navigatin buttn. 2. Frm the Manage tab select Persnalizatin Servers. The Cnfigure Persnalizatin Servers dialg displays. 3. Click the add server buttn. The Add Server dialg displays. 4. Enter the server name r click the ellipsis t search fr the required server by specifying lcatins and searching fr server names. D nt select r enter Lcalhst as the server name. If Lcalhst is entered as the server name it is added t the cnfiguratin.aemp file as the lcatin f the Persnalizatin Server. The client tries cnnecting t which is incrrect and User Persnalizatin is disabled. 5. Enter a Friendly Name fr the server. This can be any text but shuld be smething which will enable yu t identify the server. If n text is entered, the server name is used. 6. Select the required prtcl - http r https. 7. Enter the server name r brwse fr the required server by specifying lcatins and searching fr server names. 8. Enter a prt number. The prt range fr Persnalizatin servers is 7771 t 7790 and the default prt is Once the server details have been added, the URL fr the server is displayed. 9. Click OK. The server is listed in the Select Persnalizatin Server dialg. 10. Repeat steps 3 t 9 t add mre servers. Servers in the list can have their details edited r be deleted frm the list using the buttns at the tp f the dialg. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 41 f 226

42 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 11. If yu have added mre than ne server, use the arrw buttns t rerder the list. When the cnfiguratin is deplyed, endpints attempt t cnnect t each server in turn. If a cnnectin cannt be made with any server in the list, Persnalizatin des nt ccur. 12. Click OK t save the server list. When the cnfiguratin is deplyed t endpints, this list is used t determine which servers managed users cnnect t. Auditing The Auditing ptin is used t define the rules fr the capture f auditing infrmatin and the lcatin fr string the lcal event lg. It als displays the events fr which data is cllected which can be selected fr inclusin in the lcal lg. The Audit ptin is accessible frm the Hme ribbn. The events available are cntext sensitive dependent n whether Plicy Cnfiguratin r User Persnalizatin is selected. In Enterprise installatins, events can be frwarded t the Management Center via the Client Cmmunicatins Agent (CAA). When using this methd fr auditing, event data strage and filtering is cnfigured thrugh the Management Center Cnsle. Fr mre infrmatin, see the Management Center Help. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 42 f 226

43 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnfigure Auditing Settings 1. Select either the Plicy Cnfiguratin r User Persnalizatin navigatin buttns. 2. Frm the Manage ribbn, click Auditing. 3. Use the radi buttns t define the required auditing settings: Optin Send events t the Applicati n event lgsend events t the Ivanti event lg Make events annym us Send events t lcal file lg Lcal file lg frmat Descriptin Select whether t save the event and assciated applicatin data t the Applicatin r Ivanti event lg: Event Viewer > Windws Lg > Applicatin Event Viewer > Applicatins and Services Lgs > Ivanti Yu can select either Applicatin r Ivanti event lg, nt bth. Annymus lgging searches the file path fr any instances where a directry matches the user name and replaces the directry name with the string USERNAME. With this ptin set t Yes, the cmputer and user names are nt recrded fr lgged events. Write the events t a lcal file in either CSV r XML frmat. Click the ellipsis t select a lcatin fr the file. The default lcatin is: %SYSTEMDRIVE%AppSenseLgs\Auditing\EnvirnmentManagerEvents_%COM PUTERNAME%.xml (r.csv). Select whether the lcal file lg is in XML r CSV frmat. 4. In the Lcal Event Filter, select the Lg Lcally checkbx fr all the events which require lgging. When selected, events are displayed in bld. 5. Click Tggle selected t change the state between selected and cleared. 6. Click OK t save the settings. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 43 f 226

44 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Events Event ID Event Name Event Descriptin Event Lg Type 9300 Self healing prcess started 9301 Self healing registry key replaced 9302 Self healing registry key remved A prcess being mnitred fr self healing stpped and has been restarted. A registry key being mnitred fr self healing was changed and has nw been reset. A registry key being mnitred fr self healing was inserted and has nw been remved. Infrmatin Infrmatin Infrmatin 9303 Self healing file replaced A file being mnitred fr self healing was mdified r remved and has nw been replaced Self healing file remved A file being mnitred fr self healing was added and has nw been remved. Infrmatin Infrmatin 9305 Self healing service stpped A service being mnitred fr self healing started and has nw been stpped. Infrmatin 9306 Self healing service started A service being mnitred fr self healing stpped and has nw been restarted. Infrmatin 9307 Self healing registry value replaced 9308 Self healing registry remved A registry value being mnitred fr self healing was changed and has nw been reset. A registry value being mnitred fr self healing was inserted and has nw been remved. Infrmatin Infrmatin 9399 Sftware is nt licensed The Envirnment Manager sftware has nt been licensed. Errr 9400 Lckdwn edit cntrl blcked drive 9401 Lckdwn edit cntrl blcked text 9402 Lckdwn acceleratr keys blcked An edit cntrl has had a blcked drive entered int it. An edit cntrl has had blcked text entered int it. An applicatin has had acceleratr keys blcked. Infrmatin Infrmatin Infrmatin 9403 Lckdwn dialg blcked An applicatin has had a dialg bx blcked. Infrmatin Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 44 f 226

45 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Event ID Event Name Event Descriptin Event Lg Type 9404 Lckdwn MSAA access blcked An applicatin has had access blcked fr a cntrl using MSAA detectin. Infrmatin 9405 User lgn actin success A user lgn actin cmpleted successfully. Infrmatin 9406 User lgn actin fail A user lgn actin failed t cmplete successfully. Errr 9407 User lgff actin success A user lgff actin cmpleted successfully. Infrmatin 9408 User lgff actin fail A user lgff actin failed t cmplete successfully. Warning 9409 Cmputer startup actin success 9410 Cmputer startup actin fail 9413 Cmputer netwrk available 9414 Cmputer netwrk available actin fail 9420 User sessin recnnect actin success 9421 User sessin recnnect actin fail 9422 User sessin discnnect actin success 9423 User sessin discnnect actin fail 9424 User sessin lcked actin success 9425 User sessin lcked actin fail 9426 User sessin unlcked actin success A cmputer startup actin cmpleted successfully. A cmputer startup actin failed t cmplete successfully. A cmputer netwrk available actin cmpleted successfully. A cmputer netwrk available actin failed t cmplete successfully. A user sessin recnnect actin cmpleted successfully. A user sessin recnnect actin failed t cmplete successfully. A user sessin discnnect actin cmpleted successfully. A user sessin discnnect actin failed t cmplete successfully. A user sessin lcked actin cmpleted successfully. A user sessin actin failed t cmplete successfully. A user sessin unlcked actin cmpleted successfully. Infrmatin Warning Infrmatin Infrmatin Infrmatin Warning Infrmatin Warning Infrmatin Warning Infrmatin Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 45 f 226

46 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Event ID Event Name Event Descriptin Event Lg Type 9427 User sessin unlcked actin fail 9428 Prcess start actin success A user sessin unlcked actin failed t cmplete successfully. A prcess start actin cmpleted successfully. Warning Infrmatin 9429 Prcess start actin fail A prcess start actin failed t cmplete successfully. Warning 9430 Prcess stpped actin success A prcess stpped actin cmpleted successfully. Infrmatin 9431 Prcess stpped actin fail A prcess stpped actin failed t cmplete successfully. Warning 9432 Netwrk cnnectin actin success 9433 Netwrk cnnectin actin fail 9434 Netwrk discnnected actin success 9435 Netwrk discnnected actin fail 9436 User lgn (pre-sessin) actin success 9437 User lgn (pre-sessin) actin fail 9438 User lgn (pre-desktp) actin success 9439 User lgn (pre-desktp) actin fail 9440 User lgn (desktp created) actin success 9441 User lgn (desktp created) actin fail A netwrk cnnected actin cmpleted successfully. A netwrk cnnected actin failed t cmplete successfully A netwrk discnnected actin cmpleted successfully. A netwrk discnnected actin failed t cmplete successfully. A user lgn (pre-sessin) actin cmpleted successfully. A user lgn (pre-sessin) actin failed t cmplete successfully. A user lgn (pre-desktp) actin cmpleted successfully. A user lgn (pre-desktp) actin failed t cmplete successfully. A user lgn (desktp created) actin cmpleted successfully. A user lgn (desktp created) actin failed t cmplete successfully. Infrmatin Warning Infrmatin Warning Infrmatin Infrmatin Infrmatin Infrmatin Infrmatin Infrmatin Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 46 f 226

47 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Event ID Event Name Event Descriptin Event Lg Type 9480 Cnfiguratin merge update The cnfiguratin merge flder has been updated. Infrmatin 9481 Cnfiguratin merge start The cnfiguratin merge has started. Infrmatin 9482 Cnfiguratin merge cmplete The cnfiguratin merge has cmpleted successfully. Infrmatin 9483 Cnfiguratin merge fail The cnfiguratin merge has failed. Infrmatin 9484 Cnfiguratin merge timeut The cnfiguratin merge has timed ut waiting fr expected files. Infrmatin 9495 Nt cnfigured IvantiEnvirnment Manager has nt been cnfigured. Warning 9496 Cnfiguratin unsupprted An ld cnfiguratin has been fund. Warning 9650 Managed applicatin start A managed applicatin has started Infrmatin 9651 Managed applicatin stp A managed applicatin has stpped Infrmatin 9652 Persnalizatin lad errr Persnalizatin settings fr a managed applicatin failed t lad Persnalizatin save errr Persnalizatin settings fr a managed applicatin failed t save Blacklisted prcess started A managed prcess has launched a blacklisted prcess Persnalizatin nt saved Persnalizatin settings nt saved as anther grup applicatin is running. Errr Errr Infrmatin Infrmatin 9656 Offline resiliency save started 9657 Offline resiliency save cmplete 9658 Persnalizatin settings purged Offline resiliency save has been started fr a managed applicatin. Offline resiliency has successfully saved a managed applicatin s persnalizatin settings. Persnalizatin settings purged as ffline mde is disabled. Infrmatin Infrmatin Infrmatin Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 47 f 226

48 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Event ID Event Name Event Descriptin Event Lg Type 9659 Persnalizatin settings updated User persnalizatin settings updated frm persnalizatin server. Infrmatin 9660 Persnalizatin failed Persnalizatin fr a managed applicatin failed. Errr 9661 Timeut Cmmunicating with Persnalizatin Server A timeut ccurred while trying t cmmunicate with the Persnalizatin Server. Warning 9662 Trigger Actin Times All the actins have run fr the trigger. Infrmatin 9663 PreCache Applicatin Success Successfully Precached Managed Applicatin. Infrmatin 9664 PreCache Grup Success Successfully PreCached Managed Applicatin Grup. Infrmatin 9665 PreCache Managed Applicatin Failure Failed t PreCached Managed Applicatin. Errr 9666 PreCache Grup Failure Failed t PreCached Managed Applicatin Grup. Errr 9667 Persnalizatin Prfile Imprt 9680 Endpint f Self Service start failure A Prfile Imprt is Active The Endpint Self-Service prcess failed t start Infrmatin Errr Run As User Library The Run As User Library is used t create and manage user prfile infrmatin fr use in Run As r Cnnect As actins. These actins enable actins t be perfrmed using different user credentials. Fr example, a user may require mapping t a netwrk drive r the ability t launch an applicatin using different credentials. The users defined in the library are available frm the Friendly Name drp-dwn in the Run As r Cnnect As tabs in many f the actin dialg bxes fr user triggers. As well as being accessed frm the Manage tab, the Run As User Library is available by selecting the ellipsis in the Friendly Name field. This allws new users t be added t the library whilst creating actins. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 48 f 226

49 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Add a User t the Run As Library 1. Select the Plicy Cnfiguratin navigatin buttn. 2. Frm the Manage ribbn, select Run As User Library. The Run As User Library dialg displays. 3. Select Add. 4. Enter a Friendly Name which displays in the drp-dwn list n the actin Run As tab. 5. Cmplete the user name, passwrd and re-enter the passwrd t cnfirm. 6. Add further users by repeating steps 2 t Select OK t save the entry and clse the Run As User Library dialg bx. Cautin: Passwrds are stred in cnfiguratins using Public Key Encryptin. Care shuld be taken t ensure that security is nt cmprmised. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 49 f 226

50 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Grup Plicy Lcatin Grup plices are stred in administrative template files (ADM and ADMX files). By default, the files are stred in the fllwing lcatins: ADM - C:\WINDOWS\Inf ADMX - C:\WINDOWS\PlicyDefinitins Yu can change the default lcatin. If yu d, the new lcatin is used fr bth ADM and ADMX files, and is displayed when yu pen the dialg t create a Grup Plicy actin. Yu can verwrite a default lcatin n a per actin basis. The setting is stred in bth the cnfiguratin and the cnsle, which results in the fllwing: If multiple administratrs access the same cnfiguratin, they see the same default lcatin. Yu can access a cnfiguratin n multiple devices, and the lcatin remains the same. The setting persists; s if yu create a new cnfiguratin, the default lcatin is as yu set it fr the previus cnfiguratin. T set a default Grup Plicy lcatin: 1. In the Manage ribbn, select Grup Plicy Lcatin. The Grup Plicy Lcatin dialg displays. 2. Brwse t the lcatin in which yu want t stre the Grup Plicy files. 3. Click OK. Cnfiguratin Change Tracking When Change Tracking is enabled, Envirnment Manager recrds any activity which ccurs within the cnfiguratin. The infrmatin is stred in a histry.sdf file within an Envirnment Manager AEMP cnfiguratin file. Cnfiguratin changes that are recrded include adding and deleting ndes, actins and cnditins. Glbal ptins, such as adding t the Run As User Library and Persnalizatin Server List, are als recrded. Change histry is available at the fllwing levels: Nde - Each nde has its wn histry which lists changes t that nde and any child ndes Trigger - All triggers include a Histry tab shwing all ndes, actins and cnditins within that trigger which have been added r changed. Cnfiguratin - Lists every change made t a cnfiguratin including all the nde and trigger histry as well as any changes t glbal settings and ptins Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 50 f 226

51 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Enable and Disable Change Tracking Change tracking is disabled by default fr a new cnfiguratin. When a cnfiguratin is saved, s is the setting which becmes the default psitin. In the Manage ribbn, select Enable Change Tracking. Once enabled, details f each change t the cnfiguratin are saved in the histry and nde versin numbers are enabled. When enabled, select Disable Change Tracking. When Change Tracking is disabled, the histry remains but n further changes are recrded. If yu disable Change Tracking and make changes t a cnfiguratin, when re-enabled, the cnfiguratin histry shws that changes have been made whilst change tracking was disabled. It will nt shw any details f what has changed. Change the Default Psitin t Enabled 1. Right-click Ivanti Envirnment Manager Cnsle frm the Start menu r task bar, and select Prperties. 2. In the Target field, add /trackchanges t the end f the path. Ensure there is a space between the clsing qutatin marks and the parameter. The target shuld nw read: "C:\Prgram Files\AppSense\Envirnment Manager\Cnsle\EMCnsle.exe" /trackchanges When a new cnfiguratin is pened in the cnsle change tracking is enabled. This des nt impact saved cnfiguratins wh keep the setting at the state it was saved. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 51 f 226

52 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnfiguratin Histry On the Manage ribbn, select Cnfiguratin Histry t display details f all the changes made t a cnfiguratin whilst change tracking is enabled. Whenever a cnfiguratin is saved, a new versin f the histry is created utlining the changes made since the last save. In the example belw, the cnfiguratin cntains histry fr three versins. Each versin lists the changes made fr that versin. The Cnfiguratin Histry shws the fllwing infrmatin fr each change: Change - An verview f the change, fr example New Nde Added. Mre detail abut a change can be accessed by duble-clicking any entry in the histry. See Change Overview fr further details. Path - If the change relates t a nde, the path t the nde is displayed. Fr example, User\Lgn\Nde A. Fr changes t glbal ptins and settings the path will always shw Cnfiguratin. User - The username and, where apprpriate, dmain name f the user wh made the change. Date Time - The date and time the change was made. Changes can be srted in ascending r descending rder by clicking the clumn headers. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 52 f 226

53 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Nde Histry Once Change Tracking is enabled, every change made t a nde is recrded in its Histry tab which summarizes thse changes. When yu make changes t a nde, it is anntated with an asterisk t shw that there are unsaved changes within that nde. Once the cnfiguratin is saved, the asterisk is remved. Entries are added t the histry as sn as the change is made. Hwever, until the cnfiguratin is saved, the changes are nt cmmitted. If a cnfiguratin is clsed withut saving, changes are discarded and the histry deleted. Fr change tracking purpses, ndes are versined. Each time a nde is updated and the cnfiguratin is saved, a new histry versin f the nde is created. The nde histry shws each versin with the changes listed belw. In the example belw, the cnfiguratin has been saved twice since change tracking was enabled. The nde is at versin tw and the histry displays the changes made fr bth versins including wh made each change and when. The histry fr versin tw shws that a child nde has been created. Parent ndes nly shw that the child nde has been added, deleted r updated. Full details f the child nde can nly be viewed by viewing the child nde s histry. Mre detail abut a change can be accessed by duble-clicking any entry. See Change Overview fr further details. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 53 f 226

54 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Trigger Nde Histry The Histry tab fr triggers such as Startup, Prcess Started and Lg Off differs t that f ndes. Triggers are nt versined in the histry - the histry shws a cntinuus list f all changes made t child ndes and the trigger Envirnment tab since change tracking was enabled. T help yu easily identify where changes have been made, each histry entry displays the cnfiguratin path fr the relevant nde. Mve, Cpy and Imprt Ndes When yu cut and paste a nde int anther nde, the versin number remains unchanged and the entire nde histry is cpied - it is the same nde with the same histry which has been mved. This behavir applies if a nde is mved t reusable ndes. When yu cpy and paste a nde int anther nde, the versin number f the cpied nde is set at "1" and the histry nly shws ne entry stating where the nde has been cpied frm. This behavir is the same if a nde is clned r cpied t reusable ndes r imprted as a plicy template. If cpying r cutting a nde frm ne cnfiguratin t anther, the histry is as if the nde has been cpied - the histry tells yu frm which cnfiguratin the nde riginated. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 54 f 226

55 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Save a Cnfiguratin When yu save a cnfiguratin t disk, the Management Center, SCCM r as the live cnfiguratin n an endpint, an verview f the changes yu have made since the last save is displayed. Like nde and cnfiguratin histries, mre detail abut a change can be viewed by duble-clicking any entry in the histry. See Change Overview fr further details. Yu can ptinally add cmments which will be added t the Cnfiguratin Histry fr that versin f the cnfiguratin. Althugh each new versin f a cnfiguratin is identified by its wn versin number, adding cmments allws yu t add yur wn identificatin. Each time a cnfiguratin is saved, its versin number is incremented and displayed at the bttm right f the cnsle - regardless f whether change tracking is enabled r nt. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 55 f 226

56 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Change Overview Mre detailed infrmatin abut each change can be accessed by duble-clicking any histry item frm the fllwing areas: Cnfiguratin Histry Nde Histry Review Changes dialg when saving a cnfiguratin In the example belw, the Change field displays a high level verview - a Delete File actin has been updated. This is the same text which appears in the histry. The Details field shws which prperty has changed - the Ntes fr the actin were updated and the Run As setting was changed, amngst ther parameters. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 56 f 226

57 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Und and Red Changes If yu und a cnfiguratin change using the buttns in the quick access menu, the histry f that change remved. Similarly, if an undne change is redne, the histry is restred. This applies t bth cnfiguratin and nde histries. Delete the Cnfiguratin Histry Change histry can be deleted when required and the amunt f histry yu delete can be defined by date r versin number. Yu are given the ptin t exprt the histry prir t deleting. 1. Select the Plicy Cnfiguratin navigatin buttn. 2. On the Manage ribbn, select Delete Histry. 3. Select and cnfigure the histry yu want t delete: All histry - Delete the entire cnfiguratin histry. Histry lder than date - Delete the cnfiguratin histry up t the entered date. Histry up t and including selected versin - Delete the cnfiguratin histry up t the specified versin number. 4. Select whether yu want t Exprt then Delete r just Delete. If yu exprt prir t the delete the selected histry is exprted t CSV file at a selected lcatin. Deleting the histry des nt change r remve versin numbers f ndes r cnfiguratins. When the histry is deleted, the versin numbers stay the same and increment as nrmal n future saves. Exprt Cnfiguratin Histry Cnfiguratin Histry can be exprted t a CSV file. Yu can exprt the whle histry f the cnfiguratin since change tracking was enabled r yu can chse t exprt the histry up t a certain date r cnfiguratin versin. By creating a backup yu can delete all r part f the histry t reduce the cnfiguratin file size whilst ensuring that yu still have access t the change tracking data. The exprted histry file can be pened in a spreadsheet s the data can be examined and queries run. 1. Select the Plicy Cnfiguratin navigatin buttn. 2. In the Manage ribbn, click Exprt Histry. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 57 f 226

58 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 3. Select and cnfigure the histry yu want t exprt: 4. Click OK. All histry - Exprt the entire cnfiguratin histry. Histry lder than date - Exprt the cnfiguratin histry up t the entered date. Histry up t and including selected versin - Exprt the cnfiguratin histry up t the specified versin number. 5. Select a lcatin t save the CSV file and click Save. Default Timeut Settings Default timeuts are set fr triggers, ndes, cnditins and lgn actins. If a timeut limit is exceeded, the cnfiguratin element still runs t cmpletin but is cnsidered a fail and therefre child ndes d nt run. The default values, in millisecnds, can be changed by editing the fllwing keys, set under: HKLM\Sftware\AppSense\Envirnment Manager Key Type Default Details TriggerTimeut DWORD Infinite The maximum time given fr all ndes under a trigger t run, fr example, Lgn r Prcess Started. NdeTimeut DWORD 30000ms The maximum time given fr all the actins and cnditins t run. If a custm actin cntradicts a default timeut setting, the default setting is verwritten. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 58 f 226

59 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnfiguratin Tasks This sectin describes hw t save, create and imprt/exprt Envirnment Manager Cnfiguratin file (AEMP) and hw t imprt part cnfiguratin in the frm f Plicy Templates. Save a Cnfiguratin Users with nn-administrative rights perating a prduct cnsle in Standalne mde can nly view cnfiguratins with read-nly permissins. The user can interact with the cnfiguratin settings in the cnsle but the settings cannt be saved and are nt implemented r retained after the cnsle is clsed. The user can exprt a cnfiguratin t XML frmat but cannt imprt a cnfiguratin. When changes are made t a cnfiguratin, yu have the fllwing ptins: Save This is the default Save actin and is the same as Save n the Quick Access tlbar. Save and cntinue editing - Save the cnfiguratin t the Management Center and keep the cnfiguratin lcked and pen fr editing. Yu cannt deply the cnfiguratin while it is lcked. Save and Unlck - Save the current cnfiguratin in the Management Center and unlck it ready fr deplyment. Unlck withut saving - Unlck the current cnfiguratin in the Management Center withut saving changes. If Change Tracking is enabled befre the save is cmmitted, a summary f the changes yu have made will be displayed. Save As Live cnfiguratin n this cmputer - Save the current cnfiguratin n the current cmputer and apply it as the wrking cnfiguratin. Fr a live cnfiguratin t wrk successfully, the EM User Virtualizatin Service must be installed and running n the endpint. Administratin rights are required t use this ptin. Cnfiguratin in the Management Center - Create this cnfiguratin in the package stre n the selected Management Center. Cnfiguratin in System Center Cnfiguratin Manager - Saves yur cnfiguratin t the specified System Center Cnfiguratin Manager server. Cnfiguratin file n disk - Save the current cnfiguratin as a file n a lcal r netwrk drive in AEMP frmat. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 59 f 226

60 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Create a Cnfiguratin 1. Launch the Envirnment Manager cnsle frm Start > Prgrams > AppSense > Envirnment Manager. The Envirnment Manager cnsle displays. 2. Click File > New. A new cnfiguratin displays. Yu must save a new cnfiguratin befre any settings are implemented. Imprt a Cnfiguratin Cnfiguratins can be imprted in t Envirnment Manager. 1. Select the Plicy Cnfiguratin navigatin buttn. 2. Select File > Imprt & Exprt > Exprt Cnfiguratin as MSI. The Open dialg displays. 3. Navigate t the lcatin f the MSI, select it and click Open. Exprt a Cnfiguratin Cnfiguratins can be exprted frm Envirnment Manager. 1. Select the Plicy Cnfiguratin navigatin buttn. 2. Select File > Imprt & Exprt > Exprt Cnfiguratin as MSI. The Save As dialg bx displays. 3. Navigate t the lcatin t where yu want t save the MSI, click Save. Imprt a Plicy Template A library f partial cmpnents can be setup by imprting/exprting cnfiguratins as XML files t a specified lcatin. 1. In the Plicy Cnfiguratin navigatin tree, select where yu want t imprt a partial cnfiguratin. 2. Frm the Tls & Wizards ribbn, click AppSense Plicy Templates and select Imprt Template. The Open dialg bx displays. 3. Lcate the.xml file yu want t imprt and click Open. 4. The XML file is imprted int the cnfiguratin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 60 f 226

61 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Library The Library nde cntains tw fixed ndes; Reusable Ndes and Reusable Cnditins. These are ndes and cnditins that can be used multiple times within yur cnfiguratin. They are ideal fr gruping cmmn sets f actins tgether that will regularly need t run in a variety f circumstances. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 61 f 226

62 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnfiguratin Layering Cnfiguratin Layering allws cmplex cnfiguratins t be built independently and cmbined int a single deplyable cnfiguratin which maintains the rigin f each cnfiguratin item. Layering enables separate business units r teams t maintain cnfiguratins which tgether are deplyed t endpints ensuring changes can be implemented quickly and easily. Cmpnents Hst Cnfiguratin A hst is the initial cnfiguratin t which layers are added. It is the nly cnfiguratin in a layered cnfiguratin which can be edited - ndes and library items can be added, edited and deleted. A hst can be any AEMP file cmpatible with the versin f the Envirnment Manager yu are using. A hst is n different t any ther cnfiguratin - it is the term used t describe a cnfiguratin that cntains layers. Layer A layer is a cnfiguratin that has been added t a hst. Like hsts, a layer can be any AEMP file cmpatible with the versin f the Envirnment Manager yu are using. When a layer is added t a hst, its ndes and libraries are read-nly and cannt be edited r deleted frm the layered cnfiguratin. They remain part f that layer and independent frm the hst. Ndes and library items frm a layer cannt be deleted r edited in the layered cnfiguratin. The layer must be edited independently and added again t update the layered cnfiguratin. There a tw types f layer: Library Layer - Cnsists f the fllwing: Reusable Ndes Reusable Cnditins Blcked Text Library User Messages Run As User Library Full Cnfiguratin - Everything included in the library layer, plus: Cmputer triggers User triggers Cntent Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 62 f 226

63 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Layered Cnfiguratin A layered cnfiguratin is an AEMP file made up f a hst and ne r mre layers. The layers are independent frm the hst in that they are read-nly and cannt be edited. A layered cnfiguratins is n different frm any ther AEMP file in that it is a cllectin f ndes and library settings. Layered cnfiguratins prvide a way t cmbine multiple cnfiguratins int a single AEMP file, withut lsing the individual identity f the layers and can als be a layer in anther cnfiguratin. In the example belw the hst cnfiguratin cntains the Hst nde in the Cmputer Startup trigger. Tw cnfiguratins are t be added as layers, each with a nde in the Cmputer Startup trigger: Added layers are analyzed and cmbined with the hst: Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 63 f 226

64 Envirnment Manager 10.1 FR1 Plicy Prduct Guide The layers create a single cnfiguratin with each nde psitined as they are in their individual layers. Layer 1 and 2 are read nly - their ndes cannt be edited r deleted within the layered cnfiguratin. The nde in the hst cnfiguratin can be edited and deleted if required and any ndes added t the layered cnfiguratin are added t the hst. Yu can als reference ndes frm the hst as child ndes in a layer. Nested Layers Layered cnfiguratins can be added t ther hsts, nested and referenced within ther layers multiple times, as shwn belw: The hst cnfiguratin cntains three layers. Layer 3 is a layered cnfiguratin cntaining Layer 4 creating a dependency between the tw layers. Yu cannt create this type f dependency directly in the hst. In the example abve, Layer 1 cannt be mved int Layer 2. T achieve this Layer 1 wuld first need t be added int Layer 2 befre Layer 2 is added t the hst. Excluded frm Layering When a layer is added t a hst, the fllwing settings are nt included frm the layers: Custm Settings Auditing Persnalizatin Servers In a layered cnfiguratin, settings fr these sectins are set in the hst. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 64 f 226

65 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Trigger Envirnment Actins and Cnditins Trigger Envirnment actins and cnditins frm the hst and each layer are added t layered cnfiguratins. There is n change t the behavir f Envirnment actins and cnditins. T see the Trigger Envirnment fr a layer, highlight a cmpatible trigger and select the required layer frm the drp-dwn. Cmpatible triggers. Cmputer Startup Netwrk Available Shutdwn User Lgff Netwrk Cnnected Netwrk Discnnected Sessin Recnnected Sessin Discnnected Sessin Lcked Sessin Lcked Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 65 f 226

66 Envirnment Manager 10.1 FR1 Plicy Prduct Guide User Messages, Blcked Text Libraries and Run As Libraries A layered cnfiguratin includes the entries in User Messages, Blcked Text Libraries and Run As Use libraries frm all layers. Their behavir is essentially the same as ndes in layered cnfiguratins - the libraries frm layers are read-nly and when a new item is added in a layered cnfiguratin, it is added t the hst. When yu view any f the libraries yu can see which message belngs t which layer. They cannt be edited r deleted frm the layered cnfiguratin. The apprpriate layer must be remved, edited and added again. In the example belw, the Lgff Message can be edited as it belngs t the Hst but the tw ther messages are part f layers and cannt be edited. Any message can be referenced in Lckdwn cnditins in the hst and any ther layer. Manage Layered Cnfiguratins Cnfigure a Hst A hst can be any AEMP file cmpatible with the versin f the Envirnment Manager yu are using. A hst is n different t any ther cnfiguratin - it is the term used t describe a cnfiguratin that cntains layers. 1. Open a new r existing AEMP cnfiguratin in the Envirnment Manager cnsle. This initial layer will be yur hst cnfiguratin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 66 f 226

67 Envirnment Manager 10.1 FR1 Plicy Prduct Guide The cnfiguratin must have been created in the same versin as the cnsle yu are using. Older cnfiguratins must be upgraded t the cnsle versin befre they can be added as a layer. Fr further infrmatin abut Upgrading Cnfiguratins, see the DesktpNw help.. 2. Enable Change Tracking, if required. If yu want t keep the histry f layers being added t a layered cnfiguratin, Change Tracking must be enabled n the hst. 3. Cnfigure the library and trigger sectins yu need in the hst. 4. Add Custm Settings, Persnalizatin Servers and Auditing ptins. Fr a layered cnfiguratin, these ptins must be set in the hst - they will nt be included frm the layers. 5. Save the cnfiguratin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 67 f 226

68 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Add a Layer Once yu have a hst cnfiguratin, multiple AEMP cnfiguratin files can be added t create a layered cnfiguratin. When yu add a layer, it will either be new t that cnfiguratin r an update t an existing layer. When yu select a layer t add, the icns dente whether it is a new r update. 1. Befre adding a layer, ensure all the Add Layer Rules are satisfied: Layers must be valid cnfiguratins fr the Envirnment Manager cnsle they are being added t. Fr example, yu cannt add an 8.3 cnfiguratin t an 8.5 cnsle. Layers cannt be added if they are the same versin r lder than a layer already in the hst. Fr example, Layer A versin 2 exists in the layered cnfiguratin. Yu cannt add Layer A versin 1 as it is an earlier versin. Adding a new versin f a layer will update all existing references f that layer t the new versin. Cnfiguratin Histry is nly added with a layer if Change Tracking is enabled n the hst cnfiguratin. 2. Open yur hst cnfiguratin. 3. In the Manage ribbn, in the Layers grup, select Add. The Add a layer dialg displays. 4. Click the Add drp-dwn and select ne f the fllwing: Cnfiguratin file frm disk (Default - selected if the Add buttn is clicked) Cnfiguratin file frm Management Center Cnfiguratin file frm SCCM Each f these methds adds a layer. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 68 f 226

69 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 5. Select the cnfiguratin(s) yu want t add as layers - multiple cnfiguratins can be selected. The selected layers are added t the dialg and analyzed fr cmpatibility with the hst and ther layers. When adding layers t a new hst, there are rules and cnditins which a layer must satisfy. If identically named ndes frm different layers exist in the same trigger, they will run in parallel. Fr example, a new layer is added t a hst. A nde called "Nde A" exists in the Prcess Started trigger at the same level in bth cnfiguratins. The Prcess Started trigger in the layered cnfiguratin cntains tw ndes called "Nde A" which wuld run in parallel. Once analysis is cmplete, any errrs arising frm cnflicts between the layers are identified. Click the link in the Errrs clumn t view further details. 6. Fr each layer, select whether yu want t add the full cnfiguratin r just the library settings. 7. Click OK. The ndes and library settings frm the layers are added t the cnfiguratin. 8. Save the cnfiguratin. The cnfiguratin can be distributed t endpints using the Management Center r ther deplyment methd. Review Layer Changes When adding an updated layer, the new and existing versins f the layer are cmpared t see what changes have been made in the new versin. Click the View link in the Histry clumn t display a list f added, updated and deleted ndes resulting frm the incming layer. The histry will als shw details f any layers have been added r remved frm that layer. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 69 f 226

70 Envirnment Manager 10.1 FR1 Plicy Prduct Guide If Change Tracking is enabled in the cnfiguratin being added, the available histry fr that layer is displayed. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 70 f 226

71 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Remve a Layer Remving a layer deletes all f that layer's ndes and library items frm a layered cnfiguratin. Yu cannt delete a layer which has a dependency in anther layer. As yu create mre cmplicated cnfiguratins, dependencies can be created between layers and between hsts and layers. Fr example, Layer A has been added t a hst cnfiguratin. Layer A cntains a reusable nde which is referenced by the hst cnfiguratin n the lgn trigger. Yu cannt delete Layer A withut first remving the reference t the reusable nde. 1. Open a layered cnfiguratin. 2. In the Manage ribbn, in the Layers grup, select Manage. Each layer in the cnfiguratin is displayed in the Manage Layers dialg. 3. Select the layer yu want t remve frm the cnfiguratin and click Delete. The actin will be analyzed t check that deleting the layer wuld nt break a dependency with anther layer. If an errr is encuntered, yu will nt be able t remve the layer. If n errrs are encuntered, all ndes and library settings frm that layer are remved frm the layered cnfiguratin Merge a Layer Merging a layer allws yu t take wnership f that layer, breaking any links with the riginal cnfiguratin. This is equivalent t cpying every nde and library item frm the layer and pasting them int the hst, making them writable. 1. Open a layered cnfiguratin. 2. In the Manage ribbn, in the Layers grup, select Manage. Each layer in the cnfiguratin is displayed in the Manage Layers dialg. 3. Select the layer yu want t merge with the hst and click Merge r if yu want t cmbine all the layers in the cnfiguratin, click Merge All. All ndes and library settings frm the layer are added t the hst. They nw act as any ther item in the hst - they can be deleted and edited. The layer n lnger exists in the layered cnfiguratin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 71 f 226

72 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Merging Example The layered cnfiguratin cntains Layer 1 and Layer 2. Each cntains ne Cmputer Startup nde, named Nde 1 and Nde 2 respectively. Layer 1 is merged with the hst. Althugh the layered cnfiguratin lks the same, Nde 1 is nw writable and part f the hst cnfiguratin. Layer 1 is n lnger a layer in the layered cnfiguratin. If the layer being merged cntains ther layers thse layers are nt merged but becme direct dependents f the hst. In the example belw, Layer 1 cntains Layer 3. When Layer 1 is merged with the hst, Layer 3 becmes a direct layer f the hst. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 72 f 226

73 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Rllback a Layer The Rllback functin allws yu t return a layer t an earlier versin. T rllback a layer, yu must have the access t the lder versin f the layer. It is therefre recmmended that when using cnfiguratin layering, yu keep cpies f all versins f the layers yu use. 1. Open a layered cnfiguratin. 2. In the Manage ribbn, in the Layers grup, select Rllback. Each layer in the cnfiguratin is displayed in the Manage Layers dialg. 3. Highlight the layer yu want t rllback. 4. Click the Brwse drp-dwn and select ne f the fllwing: Cnfiguratin file frm disk (Default - selected if the Brwse buttn is clicked) Cnfiguratin file frm Management Center Cnfiguratin file frm SCCM Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 73 f 226

74 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 5. Select the layer yu want t rll back t. It must be an lder versin f the same layer. The layers are analyzed t check that perfrming the rllback wuld nt affect anther layer. The larger the cnfiguratin, the lnger the analysis takes. If an errr is encuntered the rllback cannt be cmpleted. The current and rllback versin numbers f the selected layer and its dependencies are displayed s yu can ensure the right versin f the layer has been selected fr rllback. 6. If there are n errrs, click OK. The layer is rlled back t the selected versin. Rllback Rules Layers cannt be rlled back if they cntain an earlier OR later versin f a layer which is referenced in anther layer. In the example belw bth layers cntain Layer C versin 3. Yu culd nt rllback t a layer which had an earlier r later versin f Layer C as versin 3 is referenced in the ther layer. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 74 f 226

75 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Layer Prperties In the Manage ribbn, in the Layers grup, select Prperties t see details f the layers within a cnfiguratin. The fllwing infrmatin is displayed: Friendly Name - Use this field t give the cnfiguratin a meaningful name which allws yu t easily identify it. Replace the AEMP filename in the Name field fr a layer when adding, merging and deleting layers r when viewing the layer prperties. Versin - The versin number f the layered cnfiguratin. Unique Identifier - The cnfiguratin ID number unique t each layer. Depends n Cnfiguratins - The cnfiguratins included in the layered cnfiguratin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 75 f 226

76 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnfiguratin Dependencies Dependencies can be created between layers and between the hst and anther layer which can affect hw Cnfiguratin Layering wrks. Ndes, reusable cnditins and message library items, frm ne layer can be referenced in anther layer. Ndes may nt be able t be deleted r rlled back where a dependency has been created between layers due t shared usage f an item. Child Nde Dependency If a nde is added t a layered cnfiguratin as a child f a nde in a layer, a dependency is created between the layer and the hst. In the example belw, the Nde L1 is part f a layer that has been added t the hst. Nde H2 has been added t the layered cnfiguratin as a child f Nde L1. The layer cannt be remved frm the cnfiguratin because the hst is dependent upn it cntaining the new nde. The layer cannt be remved frm the cnfiguratin because the hst is dependent upn it cntaining the new nde. Reusable Nde Dependency If a reusable nde frm a layer is referenced in a layered cnfiguratin a dependency is created between the layer and the hst. If a reusable nde is referenced as a child nde f a nde f anther layer, a dependency is created between the tw layers. In the example belw, reusable ndes RNde L1 and RNde L2 are cntained within layers which have been added t the hst. RNde L2 is referenced in the Cmputer Startup trigger as part f the hst and RNde L1 referenced as a child f the Nde L1. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 76 f 226

77 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Layers cntaining the reusable ndes cannt be deleted because the reusable ndes are referenced in the hst and in a nde frm anther layer. T delete the layer cntaining the reusable ndes all references in the hst and ther layers must be remved. Reusable Cnditin Dependency If a reusable cnditin frm a layer is referenced in a layered cnfiguratin a dependency is created between the layer and the hst. A reusable cnditin added t a nde in anther layer creates a dependency between the layers. In the example belw, reusable cnditin RC 1 is part f a layer which has been added t the hst. Nde 1 is in the hst cnfiguratin. The layer cntaining the reusable cnditin cannt be deleted because the reusable cnditin is referenced anther cnfiguratin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 77 f 226

78 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Message Library Dependency If a message frm a layer is used in a lckdwn cnditin added t a layered cnfiguratin, a dependency is created between the layer and the hst. The same is true if a message frm ne layer is used in a lckdwn cnditin frm a nde in anther layer. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 78 f 226

79 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnfiguratin Endpint Merging Endpint Cnfiguratin Merging uses the EM Agent t cmbine multiple AEMP cnfiguratin files, saved n ne endpint, int a single cnfiguratin. Ndes, reusable cnditins and message libraries frm each cnfiguratin are added t the merged cnfiguratin. The merge is dne by adding the individual cnfiguratins t a directry n the endpint and specifying, in a manifest file, the cnfiguratins which are t be merged. The EM Agent mnitrs the merge directry and autmatically merges cnfiguratins when a manifest file is added t the directry. Endpint Cnfiguratin Merging allws different areas f a business t wrk independently n a particular area f a cnfiguratin which can then be added t create a single cnfiguratin. Where small changes t large cnfiguratins are required, a snippet f the area that has changed can be created. The snippet can then be merged n endpints remving the need t push ut large cnfiguratins. Cmpnents in a Merge Cnfiguratin merging relies n the fllwing cmpnents. Base Cnfiguratin Every merge must have a base cnfiguratin - this is the first cnfiguratin in the merge nt which the ther cnfiguratins are added. A merged cnfiguratin takes the glbal attributes such as Custm Settings, Auditing ptins and any Persnalizatin settings, frm the base cnfiguratin. It is therefre essential that the settings which are nt merged are defined in the base. By default, the base cnfiguratin is set as the AEMP file which is created when a live cnfiguratin is saved n an endpint: %PrgramData%\AppSense\Envirnment Manager\Cnfiguratin.aemp The base cnfiguratin and all cmpnent cnfiguratins in a merge must be versin 10.0 r later f Envirnment Manager. Upgrade any lder versin cnfiguratins befre merging. Cmpnent Cnfiguratins A merged cnfiguratin is made up f a base cnfiguratin and ne r mre cmpnent cnfiguratins. Cmpnent cnfiguratins are AEMP files which are added t the base cnfiguratin during a merge. T be part f a merge, cmpnent cnfiguratins must be stred in the MergeCnfigs directry. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 79 f 226

80 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Ndes, pre-triggers, Run-As and User Messages frm cmpnents are included in a merge. Other settings such as auditing ptins are taken nly frm the base cnfiguratin. The base cnfiguratin and all cmpnent cnfiguratins in a merge must be versin 10.0 r later f Envirnment Manager. Upgrade any lder versin cnfiguratins befre merging. MergeCnfigs Directry This directry is where cmpnent cnfiguratins fr merging are stred and where a merge is triggered when a valid manifest is detected. When yu start the EMCreService n an endpint, the MergeCnfigs directry is created: %PrgramData%\AppSense\Envirnment Manager\MergeCnfigs This directry is secured s nly administratrs can write t it. This ensures that end users cannt affect the merge cnfiguratins. Manifest The manifest is an XML file that includes details f the cnfiguratins t be merged and dictates which cnfiguratin is set as the base. The merge is initiated when the agent detects a manifest in the MergeCnfigs directry. Manifests are created using the ManifestGen cmmand line tl. Belw is an example merge_manifest.xml file. <MergeManifest UseSystemBase="true" WaitFrCnfigs="true"> <MergeFiles> <FileEntry Name="cnfig2.aemp" Checksum="563621a479c06d6d357b "/> <FileEntry Name="cnfig4.aemp" Checksum="4bc481043e de15ec6993ee43f"/> </MergeFiles> </MergeManifest> Manifest Attribute and Tags Attribute/Tag MergeManifest MergeFiles FileEntry Name UseSystemBase (Optinal) Descriptin The rt nde f the cnfiguratin. The cntainer tag fr the list f AEMP files which are t be included in the merge. Identifies a cnfiguratin t be included in the merge. The file must be present in the MergeCnfigs directry t be included in a merge. Can be set t "true" r "false" and instructs whether t either include r exclude the default Cnfiguratin.aemp in the merge. This is the live Cnfiguratin.aemp file fund in %PrgramData%\AppSense\Envirnment Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 80 f 226

81 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Attribute/Tag Descriptin Manager. If set t true, the base cnfiguratin must already be present n endpints when the manifest is deplyed therwise the merge will fail. If set t false the first cnfiguratin in the MergeFiles list is used as the base cnfiguratin unless therwise defined by the BaseCnfig attribute. WaitFrCnfigs (Optinal) Checksum (Optinal) Determines the behavir when a manifest.xml is detected in the MergeCnfigs directry and nt all named cnfiguratins are present. Can be set t: True - The merge will wait indefinitely until all cnfiguratins referenced in the manifest are present and then cmplete the merge. False - The merge will fail if a manifest is detected in the MergeCnfigs directry which references a cnfiguratin which is nt present. If yu are using an installer, such as an MSI, t push ut cnfiguratins and a manifest t endpints, it is recmmended that yu set this t "true" as yu cannt guarantee in what rder the cnfiguratins and manifest will be added. This des nt apply if using the SystemBase Cnfiguratin.aemp file. If the manifest merge is triggered and the Cnfiguratin.aemp is nt present, the merge will fail - it will nt wait fr the base. An MD5 checksum unique t an AEMP file. If included the manifest, the AEMP file in the MergeCnfigs flder must have the same checksum t be included in the merge. Base cnfiguratins are nt referenced by a checksum. ManifestGen Tl The ManifestGen is a cmmand line tl which creates the XML manifest file used t define and trigger a cnfiguratin merge. The XML file cntains details f the AEMP files t be merged and can dictate whether the default Cnfiguratin.aemp r a cmpnent cnfiguratin is used as the base in the merge. If a merge_manifest.xml already exists in the utput directry, the tl fails and a new manifest is nt created - the current ne is nt verwritten. T make using the tl easier, add the lcatin t the Path envirnment variable at Advanced System Prperties > Envirnment Variables > Path: %PROGRAMFILES%\AppSense\Envirnment Manager\Cnsle Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 81 f 226

82 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Create a Manifest 1. Save the cnfiguratins yu want t be merged in the MergeCnfigs directry: 2. %PrgramData%\AppSense\Envirnment Manager\MergeCnfigs 3. Open the Cmmand Line Interface. 4. Enter cd %prgramdata%\appsense\envirnment manager t change the directry. 5. Enter manifestgen mergecnfigs\*.aemp. If yu run manifestgen in the MergeCnfigs flder, the agent will pick up the manifest as sn as it is created and immediately start the merge. If successful, a merge_manifest.xml file is created in: %PrgramData%\AppSense\Envirnment Manager The manifest can nw be used t trigger the merge and create a cnfiguratin. Additinal Cmmands Arguments can be used in the ManifestGen tl t alter the manifest and affect the merge. Yu can specify a different base cnfiguratin, utput file and create a manifest withut checksum values fr the cnfiguratins. Suffix Descriptin and Usage - Output flder- Specify where the manifest.xml file is created, fr example, manifestgen mergecnfigs\*.aemp - c:\cnfigs creates a manifest in the Cnfigs flder n the C drive. -b Base cnfiguratin - Identify the base cnfiguratin and exclude the default base cnfiguratin. Fr example, manifestgen mergecnfigs\*.aemp -b cnfig1.aemp creates a manifest that will create a merged cnfiguratin with Cnfig1.aemp set as the base cnfiguratin. -nc -nw N checksum entries - By default, each cnfiguratin listed in the manifest has an MD5 checksum which allws unique identificatin f a cnfiguratin. If the checksum in the manifest des nt match that f the cnfiguratin the merge will fail r wait fr a cnfiguratin with the crrect checksum. Using the -nc suffix with the ManifestGen tl will nt list checksums in the manifest and means that merges will succeed if the cnfiguratin file names are crrect, regardless f the checksum value. Fr example: manifestgen mergecnfigs\*.aemp -nc The default behavir when a manifest is added t the MergeCnfigs directry is t wait indefinitely until all cnfiguratins in the manifest are present and then perfrm the merge. Using the -nw suffix, a merge will fail if the cnfiguratins listed are nt present when the manifest is added t the MergeCnfigs directry. Fr example: manifestgen mergecnfigs\*.aemp -nw If the manifest lists five cnfiguratins and nly fur are Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 82 f 226

83 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Suffix Descriptin and Usage present when the manifest is added t the MergeCnfigs directry, the merge will fail. If yu are using an installer, such as an MSI, t push ut cnfiguratins and a manifest t endpints, it is recmmended that yu d nt use this suffix as yu cannt guarantee in what rder the cnfiguratins and manifest will be added. Edit a Manifest Althugh manifests can be edited and created in a text editr, it is recmmended that yu use the ManifestGen tl as it ensures the merge_manifest.xml file is in the crrect frmat. If, fr example, yu have an "&" in a file name, the ManifestGen tl will escape this t make sure it is a valid XML file. Once created, a manifest file can be edited t change the attributes such as the base cnfiguratin and the rder in which the merge shuld take place. Fr example, the cmmand: manifestgen mergecnfigs\*.aemp -b mergecnfigs\cnfig3.aemp -nc creates a manifest in which the default base cnfiguratin is nt included and cnfig3.aemp is set as the base. The WaitFrCnfigs attribute is set t the default f "true" and checksums are nt included. <MergeManifest UseSystemBase="false" WaitFrCnfigs="true"> <MergeFiles> <FileEntry Name="cnfig3.aemp" BaseCnfig="true"/> <FileEntry Name="cnfig1.aemp"/> </MergeFiles> </MergeManifest> T edit the manifest, pen the manifest in a text editr, make the required changes and save the file. In this example, UseSystemBase is set t "true" and the BaseCnfig cmmand has been remved frm Cnfig3.aemp. The rder f the merge has als been changed. <MergeManifest UseSystemBase="true" WaitFrCnfigs="true"> <MergeFiles> <FileEntry Name="cnfig1.aemp"/> <FileEntry Name="cnfig3.aemp"/> </MergeFiles> </MergeManifest> When merged, the default base Cnfiguratin.aemp file is included in the merge as the base cnfiguratin and the rder in which the cmpnent cnfiguratins are merged nt the base is reversed. Nte that the cnfiguratin set as the base, includes the glbal cnfiguratin settings such as the Custm Settings that yu want including in the merge. Therefre, care shuld be taken when selecting a different cnfiguratin as the base. Setting BaseCnfig="true" fr a cnfiguratin and UseSystemBase="true" in the same manifest will cause a cnflict and the merge will fail. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 83 f 226

84 Envirnment Manager 10.1 FR1 Plicy Prduct Guide BatchCnfig Tl Only AEMP files which are at the latest versin can be included in a merge. The BatchCnfig tl cnverts ld AEMP files and XML snippets t AEMP files f the crrect versin. Multiple files can be cnverted at the same time, prducing ne utput file per input. If ne r mre cnfiguratins frm the surce already exist in the utput directry, the tl fails and nne f the cnfiguratins are cnverted. T make using the tl easier, add the lcatin t the Path envirnment variable at Advanced System Prperties > Envirnment Variables > Path: %PROGRAMFILES%\AppSense\Envirnment Manager\Cnsle Batch Cnvert Cnfiguratin Files 1. Save r cpy the AEMP and XML files yu want t cnvert t a single flder. 2. Open the Cmmand Line Interface. 3. Enter BatchCnfigTl fllwed by details f the surce and destinatin flders in the fllwing frmat: BatchCnfigTl <surce directry\file type> - <utput directry> Batch Cnvert Examples BatchCnfigTl C:\Cnfigs\Surce\*.xml - C:\Cnfigs\Output This example cnverts XML snippets fund in the surce directry t current versin AEMP files saved in the utput directry. The same frmat can be used t update ld AEMP files t the current versin: BatchCnfigTl C:\Cnfigs\Surce\*.aemp - C:\Cnfigs\Output Yu can als cnvert bth file types simultaneusly: BatchCnfigTl C:\Cnfigs\Surce\*.aemp C:\Cnfigs\Surce\*.xml - C:\Cnfigs\Output In the example belw, the Surce directry cntained an 8.3 AEMP file and tw XML snippets. Fllwing cnversin, the utput directry cntains three current versin AEMP files. The BatchCnfig tl installs with the Envirnment Manager Cnsle. Hwever, it can be installed independently using the EnvirnmentManagerPlicyTls 32 and 64 bit installers which are included in the DesktpNw media. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 84 f 226

85 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Auditing Events - Cnfiguratin Endpint Merging New auditing events fr Cnfiguratin Endpint Merging have been added t Envirnment Manager. When viewed in Windws Event Viewer (select Windws Lg > Applicatins), the events prvide further details such as what has caused a merge failure. Merging Cnfiguratins Once a manifest is created and the cmpnent cnfiguratins are present n the endpints, yu can trigger the merge and create a new cnfiguratin. A merge is triggered when a merge_manifest.xml is detected in the MergeCnfigs directry which shuld cntain all the cnfiguratins yu want t merge. If the manifest lists cnfiguratins which are nt in the MergeCnfigs directry, the merge will be delayed until all cnfiguratins are present. The base cnfiguratin and all cmpnent cnfiguratins in a merge must be versin 10.0 f Envirnment Manager. Upgrade any lder versin cnfiguratins befre merging. T upgrade a cnfiguratin, pen it in the required versin f the Envirnment Manager and save. Fr example, pen an 8.6 cnfiguratin in the10.0 cnsle t upgrade. Using the -nw tag, a manifest can be created which will fail a merge if all cnfiguratins are nt present. Empty Manifest Adding an empty manifest t the MergeCnfigs directry autmatically merges all AEMP cnfiguratins within that directry. It will merge all cnfiguratins in alphabetical rder and set the base as the Cnfiguratin.aemp fund in: %PrgramData%\AppSense\Envirnment Manager If this AEMP is nt present, the merge will fail. T create an empty manifest, pen a new file in a text editr, create a zer-byte file and save as merge_ manifest.xml. The same merge can be achieved using a manifest that, whilst nt ttally empty, des nt include details f the AEMP files t be merged: <MergeManifest UseSystemBase="true" <MergeFiles> </MergeFiles> </MergeManifest> This prvides the same results as a blank manifest but allws yu t use the UseSystemBase attribute. If yu set this t "false" the merge will use the cnfiguratin which is first alphabetically in the MergeCnfigs directry, as the base. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 85 f 226

86 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Successful Merges If the manifest is crrect and the cnfiguratins listed are present in the MergeCnfigs directry, the Merged_Cnfiguratin.aemp is created and used as the live cnfiguratin n the endpint. In additin t the new cnfiguratin (Merged_Cnfiguratin.aemp) a cpy f the successful manifest is created, renamed as last_merge_manifest.xml, t prvide a recrd f the merge and a backup f the manifest. If present, the riginal merge_manifest.aemp file is deleted when the merge is cmplete. The Cnfiguratin.aemp file is nt altered during a merge and is n lnger used by the agent unless updated r the Merged_Cnfiguratin.aemp is nt present. Unsuccessful Merges If an errr ccurs during the merge, it will fail and a new cnfiguratin file will nt be created. Merges can fail if: The checksums specified in the manifest d nt match thse f the actual cnfiguratins and WaitFrCnfigs is set t "false" The manifest includes the -nw cmmand and ne r mre cnfiguratins listed in the manifest are nt present in the MergeCnfigs directry when it is added Friendly names in the Run As Library are the same in tw f the cnfiguratins being merged. UseSystemBase is set t "true" and a base Cnfiguratin.aemp is nt present when the merge is triggered. A manifest is invalid. One r mre cnfiguratins are crrupt. Fllwing an unsuccessful merge, the merge_manifest.xml file is deleted and a cpy f the unsuccessful manifest (failed_merge_manifest.xml) is added t the directry. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 86 f 226

87 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Merged Behavir The table belw lists the areas f a cnfiguratin and gives an explanatin f their behavir during a merge. Area Merged Behavir Ndes Yes The merged cnfiguratin cntains all the ndes frm each f the cmpnent cnfiguratins. If tw ndes which affect the same applicatin exist in the same trigger, they will run in parallel. The cntents f individual ndes are nt merged. Actin and Cnditins Yes Actins and cnditins are nt analyzed - the merged cnfiguratin will cntain all actins and cnditins frm the merged cnfiguratin. If tw cnfiguratins bth cntain actins which affect the same registry key fr example, the merged cnfiguratin will cntain bth actins. Fr such cnflicts, last write wins. This is standard cnflict behavir in Envirnment Manager. Auditing N The events frm the base are used in the merged cnfiguratin whilst the events frm the cmpnent cnfiguratins are ignred. Custm Settings N Merged cnfiguratins inherit their Custm Settings frm the base cnfiguratin. Settings frm any cmpnent cnfiguratin in the merge are discarded. It is therefre imprtant that the Custm Settings yu require in the merged cnfiguratin are added t the base cnfiguratin. This includes the BaseCnfigMergeBehavir Custm Setting. See Live Cnfiguratin Update Behavir. Run As Library Yes Entries in the Run As libraries fr all cnfiguratins are added t the merged cnfiguratin t create a single list. All friendly names must be unique. If tw cnfiguratins in the merge cntain a user with the same friendly name, the merge will fail. Blck Message Library Yes The Blck Message libraries frm all cnfiguratins are merged. The merged cnfiguratin cntains all messages frm the base and merged cnfiguratins including any duplicates. Pre-triggers Yes When cnfiguratins are merged the pre-trigger actins frm all cnfiguratins are added t the merged cnfiguratin. There is n validatin fr pre-triggers enabling duplicate and cnflicting actins t be merged. Persnalizatin Settings N Persnalizatin settings, such as the server list, are nt merged. The merged cnfiguratin takes these settings frm the base cnfiguratin. Therefre any Persnalizatin settings required in the merged cnfiguratin shuld be defined in the base cnfiguratin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 87 f 226

88 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Live Cnfiguratin Rules When a live cnfiguratin is pened r saved n an endpint, it is referred t: %PrgramData%\AppSense\Envirnment Manager\Cnfiguratin.aemp T allw fr cnfiguratin merging, the live cnfiguratin can als refer t: %PrgramData%\AppSense\Envirnment Manager\Merged_Cnfiguratin.aemp The agent mnitrs the %PrgramData%\AppSense\Envirnment Manager directry fr new cnfiguratins. When a change is detected the agent lads a new cnfiguratin using the fllwing rder f precedence: Merged_Cnfiguratin.aemp Cnfiguratin.aemp If a Merged_Cnfiguratin.aemp exists in the directry, it will be the live cnfiguratin. If remved, the agent cntinues t use the in-memry versin - when the agent is restarted, the Cnfiguratin.aemp file will becme the live cnfiguratin. Live Cnfiguratin Update Behavir The BaseCnfigMergeBehavir custm setting allws yu t define hw the live cnfiguratin is affected when a Cnfiguratin.aemp file is pushed ut t endpints by the Management Center r ther deplyment methd. Yu might be deplying a new Cnfiguratin.aemp file and want it t be the live cnfiguratin n endpints. Or the Cnfiguratin.aemp file might cntain updates which yu want t add t the current live cnfiguratin. The Custm Setting can initiate bth scenaris: Remerge - When the cnfiguratin is detected n an endpint by the agent, a merge, based n the last_merge_manifest.xml, is triggered and includes the new Cnfiguratin.aemp. The merge creates a new Merged_Cnfiguratin.aemp which replaces the current live cnfiguratin. A last_merge_manifest.xml must be present therwise the merge will fail. This is the default value fr the Custm Setting and is als the behavir if BaseCnfigMergeBehavir is nt added t a cnfiguratin as a Custm Setting. Replace - When the cnfiguratin is detected n an endpint by the agent, it replaces the Merged_Cnfiguratin.aemp as the live cnfiguratin. Fllwing the successful deplyment f the new Cnfiguratin.aemp, the Merged_Cnfiguratin.aemp is deleted frm the directry. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 88 f 226

89 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Triggers Triggers in the Envirnment Manager cnsle represent cmmn cmputer and user events such as Startup, Lgn and Sessin Discnnected. They are static elements in the Plicy Cnfiguratin navigatin tree; they cannt be edited, mved r deleted. An Envirnment Manager cnfiguratin is built arund the events t which the triggers relate. Ndes are created within triggers cntaining cnditins and actins. This creates a dependency between the trigger, cnditin and actin. When the trigger is fired, any cnditins present are validated and if met, the actin is carried ut. Fr example: Trigger Cnditin Actin Cmputer Startup Cmputer > Cmputer IP Address File & Flder > Mdify File Attributes In the example belw, the "Hidden" nde, which cntains a cnditin and assciated actin, has been added t the Startup trigger. When a managed endpint is bted up, the Envirnment Manager agent checks t see if the IP address is between and If it is, the Wrd dcument Test.dcx becmes a hidden file. If the endpint des nt meet the cnditin, the Wrd dcument prperties remain unchanged. When selected, each trigger, displayed in the wrk area, cntains tw tabs: Envirnment and Summary. The Summary tab cntains an verview f the cntents f the trigger, shwing each nde, its state (enabled r disabled) and the number f assciated actins. Triggers fall under tw fixed ndes in the Plicy Cnfiguratin navigatin tree; Cmputer and User. Cmputer Triggers Trigger Startup Netwrk Available Descriptin Executes actins when a cmputer is started. Useful t help create a cmmn image fr all standard cmputers within an rganizatin. Actins execute nce the netwrk is available. This is useful fr items Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 89 f 226

90 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Trigger Descriptin such as cnditins that perfrm AD lkups r actins that cpy files frm netwrk lcatins. These items may nt functin crrectly in the Startup trigger as the netwrk is nt always available at that pint. Shutdwn Prcess Started Prcess Stpped Executes actins when a cmputer is switched ff. Actins within this trigger are executed when a prcess is started. Actins within this trigger are executed when a prcess is stpped. User Triggers Trigger Lgn Descriptin Actins take effect when the user lgs n t the system but befre the desktp shell has started. Due t a cmpatibility issue with smart card readers, lgn actins d nt run when lgging n with smart cards. This affects Windws 7 and Windws 2008 R2 perating systems. Fr further infrmatin, see dcument Lgn > Pre-Sessin Lgn > Pre-Desktp Lgn > Desktp Created Lgff Actins take effect befre terminal services is ntified f the lgn. Registry, Grup Plicy and Envirnment actins are cmpatible with this sub-trigger. During the upgrade, actins which were previusly in the Envirnment tab f the Lgn trigger are mved here. Actins take effect when the user lgs n t the system but befre the desktp shell has started. During the upgrade, actins which were previusly in the Lgn trigger are mved here. Actins take effect after the desktp shell and Explrer has started. T imprve efficiency and lgn times, any nn-critical Lgn actins shuld be added t this trigger, fr example, mapping drives and printers. The assciated actins are executed when a user lgs ff. Envirnment Manager Lgff actins run after Grup Plicy scripts and all pstlgn actins have cmpleted. Fllwing a frced lgff pst-lgn actins still run t cmpletin fllwed by any Lgff actins. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 90 f 226

91 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Trigger Descriptin If using Remte Desktp Prtcl v6.0, use the Sessin Discnnect trigger fr lgff actins as the remte applicatin prcedure des nt lgff, it discnnects. Prcess Started Actins within this trigger are executed when a prcess is started. If using Envirnment Manager and Streamed Applicatins, refer t Streamed Applicatins. Prcess Stpped Netwrk Cnnected Netwrk Discnnected Sessin Recnnected Sessin Discnnected Sessin Lcked Sessin Unlcked Actins within this trigger are executed when a prcess is stpped. Actins and cnditins within this trigger are executed when each physical r virtual netwrk adapter establishes a cnnectin. If a Persnalizatin Server is defined within the cnfiguratin, a Persnalizatin cnfiguratin pll is als perfrmed when the trigger is fired. The trigger fires when a netwrk is detected. The trigger will nt fire if the netwrk is categrized as unknwn. Actins and cnditins within this trigger are executed when each physical r virtual netwrk adapter discnnects a cnnectin. The trigger als fires when the netwrk is categrized as unknwn. Fr example, this culd be because the dmain cntrller has stpped functining r the wireless cnnectin is ut f range. Actins within this trigger are executed when a user s discnnected sessin is recnnected. Actins within this trigger are executed when a user s live sessin is discnnected. Actins within this trigger are executed when a user s desktp is lcked. Actins within this trigger are executed when a user s desktp is unlcked. Sessin Lcked and Sessin Unlcked triggers will nt apply t published applicatins. They nly apply t the sessin in which the applicatin is running. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 91 f 226

92 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Triggers fr XenDesktp Cnnectins and Backwards Cmpatibility Prir t Envirnment Manger 10.1, when using XenDesktp versins 7.8 r earlier, if yu lgged n, discnnected, recnnected, lcked, and unlcked, the fllwing triggers were fired: User Behavir Actual Trigger (RDP) Actual Trigger (ICA) Lgn Lgn Lgn Discnnect Discnnect Lck Recnnect Recnnect Unlck Lck Lck Lck Unlck Unlck Unlck This was because fr ICA sessins, Lck and Unlck actins were triggered when the user discnnected and recnnected. This behavir is crrected fr XenDesktp 7.9 and later, but fr users running earlier versins, Envirnment Manager can nw detect discnnectins and recnnectins in XenDesktp envirnments. This detectin is enabled by default fr versin 10.1 cnfiguratins. When upgrading lder versin cnfiguratins (versin 10.0 and lder), the detectin mechanism is disabled by default. If yu are using XenDesktp versins inclusive, yu can verride this using the IcaSessinCnnectinOverride setting in Advanced Settings. Fr mre infrmatin, see Advanced Cnfiguratin Settings. Lgn Trigger In Envirnment Manager 8.5, a new Lgn trigger structure was intrduced. The single Lgn trigger and Envirnment tab was replaced by three sub-triggers - Pre-Sessin, Pre-Desktp and Desktp Created. A new cnfiguratin pened in the 8.5 cnsle uses the Lgn sub-triggers. Hwever t ensure backwards cmpatibility, when upgrading a cnfiguratin yu can select whether t use the new r ld lgn trigger methds. Yu can switch between methds using the Advanced Optins in the Manage tab. Fr further infrmatin abut the Lgn Trigger see Enable Lgn Sub-triggers. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 92 f 226

93 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Prcess Start and Stp Triggers When creating tp level ndes within bth Cmputer and User Prcess Start and Stp triggers, different behavir applies: Ndes must have a Prcess Name cnditin applied - When adding a nde t a Prcess Start r Stp trigger the Prcess Name cnditin dialg bx is autmatically displayed. A cnditin must be specified fr the nde. Pressing Cancel deletes the nde. Actins and cnditins can nly be added by selecting the prcess cnditin within the wrk area. Unlike ther triggers, actins and cnditins cannt be added by highlighting the trigger in the navigatin tree. The exceptin t this is ther Prcess Name cnditins which can be added by selecting the prcess trigger. The initial Prcess Name cnditin cannt be deleted frm within the nde. T remve, the nde must be deleted. Stp if fails cannt be disabled fr the Prcess Name cnditin. If the cnditin fails, nthing within the cnditin will run. Any reusable nde can be added t a Prcess Start/Stp trigger prving the actins cntained are cmpatible with the trigger. When entering an applicatin int the Match field, the file extensin must be added; calc des nt wrk but calc.exe des. Prir t 8.1 a Prcess Name cnditin did nt have t be applied t a Prcess Start/Stp trigger. On upgrade, any actins and cnditins are still created but in the absence f a Prcess Name Cnditin, all tp level actins and cnditins in nde will run fr every prcess that starts during the user/cmputer sessin. This culd have a detrimental effect n perfrmance. T ensure perfrmance is nt affected, add a prcess name cnditin and add the existing actins and cnditins. These behavirs d nt apply t child ndes created in Prcess Start and Stp cnditins. Cmputer Prcess Start and Stp triggers nly detect system prcesses and User Prcess Start and Stp triggers nly detect user prcesses. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 93 f 226

94 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Netwrk Triggers The Netwrk Cnnected and Netwrk Discnnected triggers fire when each individual netwrk adapter cnnects r discnnects. Sessin Variables can be used within the Netwrk Available, Netwrk Cnnected and Netwrk Discnnected triggers t determine attributes f the netwrk cnnectin. The built-in Sessin Variables persist fr the duratin f the netwrk trigger and will nt be available after the trigger has cmpleted executing all f its ndes. The fllwing built-in Sessin Variables are available n the Netwrk Available triggers: Sessin Variable Descriptin Example Netwrk.Dmain Netwrk.DmainType DNS suffix f the adapter, specific t the cnnectin. Nte: This is the dmain name f the cnnectin, rather than the dmain t which the machine is jined. Dmain type f the cnnected netwrk. The pssible values are as fllws: 0 - Wrkgrup machine cnnected t a private netwrk 1 - Wrkgrup machine cnnected t a dmain netwrk 2 - Dmain-jined machine cnnected t a dmain netwrk dmain.lcal 2 Netwrk.Id GUID t uniquely identify the netwrk. {9A445C40- B550-4B79-8F4F BCB5FCA} The fllwing built-in Sessin Variables are available n the Netwrk Available, Netwrk Cnnected and Netwrk Discnnected triggers: Sessin Variable Descriptin Example Netwrk.Dmain Netwrk.DmainType DNS suffix f the adapter, specific t the cnnectin. Nte: This is the dmain name f the cnnectin, rather than the dmain t which the machine is jined. Dmain type f the cnnected netwrk. The pssible values are as fllws: dmain.lcal 2 Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 94 f 226

95 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Sessin Variable Descriptin Example 0 - Wrkgrup machine cnnected t a private netwrk 1 - Wrkgrup machine cnnected t a dmain netwrk 2 - Dmain-jined machine cnnected t a dmain netwrk Netwrk.Id GUID t uniquely identify the netwrk. {9A445C40-B550-4B79-8F4F BCB5FCA} Netwrk.Adapter.BSSID Netwrk.Adapter.Descriptin Netwrk.Adapter.FriendlyName Netwrk.Adapter.Id Media Access Cntrl (MAC) address f the access pint. Descriptin f the netwrk adapter. This is usually the manufacturer r type f the netwrk adapter Friendly name f the netwrk adapter This is the name f the adapter as displayed in the Netwrk and Sharing Center. GUID t uniquely identify the netwrk adapter. 6E:DD:3A:91:F2:8D Intel(R) 82577LC Gigabit Netwrk Cnnect Lcal Area Cnnectin {F2DD3B93-5BD8-489CA7C7-32E2964AA0D5} Netwrk.Adapter.IPv4Address IPv4 address f the netwrk adapter Netwrk.Adapter.IPv4SubnetMask IPv6 address f the netwrk adapter in a shrthand ntatin If the netwrk is nt an IPv6 netwrk, then the address is a lcal-link address starting fe80: and is nn-rutable. Netwrk.Adapter.IPv6Address Netwrk.Adapter.IsVirtual IPv6 prefix length f the netwrk adapter Returns True if the netwrk adapter is sftware-based r False if the netwrk adapter is physical. 64 True Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 95 f 226

96 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Sessin Variable Descriptin Example Netwrk.Adapter.IsWireless Netwrk.Adapter.MAC Returns True if the netwrk adapter is IEEE wireless r False if the netwrk adapter is wired. Media Access Cntrl (MAC) address f the netwrk adapter. False 3D:C5:DB:AC:46:B6 Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 96 f 226

97 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Trigger Envirnment The trigger Envirnment ptimizes efficiency when running cnfiguratins cntaining Envirnment actins. Prir t versin 8.1, envirnment variable actins were added t ndes in the same way as ther actins. When envirnment variables were run in this way, envirnment refreshes had a ptential impact n the running f the ther actins in the trigger. It is recmmended that all envirnment and sessin variables are added t the required trigger envirnments when upgrading a cnfiguratin t frm a pre-8.1 versin t 8.1 r later. Envirnment actins which are in ndes within a trigger will nt run r be refreshed until after all the ther actins in that trigger have run. Actins within the Envirnment tab will nt execute unless a nde exists within the trigger. The trigger envirnment behaves in much the same way as ndes in that any cnditin apprpriate t the trigger can be added. Hwever, nly Envirnment actins can be added; all ther actins are unavailable fr selectin. The trigger Envirnment is available fr the fllwing triggers: Cmputer User Startup Netwrk Available Shutdwn Lgff Netwrk Cnnected Netwrk Discnnected Sessin Recnnected Sessin Discnnected Sessin Lcked Sessin Lcked The example belw shws the Startup Envirnment tab cntaining ne cnditin with an Envirnment actin and three further Envirnment actins. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 97 f 226

98 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 98 f 226

99 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnfigure the Trigger Envirnment 1. In the Plicy Cnfiguratin navigatin tree, select a trigger. 2. Select the Envirnment tab. 3. Select the Cnditins tab and add any required cnditins. It is nt mandatry t use cnditins in the envirnment tab; Envirnment actins can be added directly. 4. Click Actins > Envirnment and select the required actin: Set Envirnment Variable Append Envirnment Variable Delete Envirnment Variable Set Sessin Variable Delete Sessin Variable Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 99 f 226

100 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Nde Management Ndes are used t help build up the structure f an Envirnment Manager cnfiguratin. They prvide cntainers which huse cnditins and actins within triggers. By creating a hierarchy f ndes cntrlling the relatinship between actins and the events which trigger thse actins, a plicy f cmputer usage is defined. Ndes prvide extra flw cntrl t the cnfiguratin by frming the bridge between triggers and actins, allwing the dependency between trigger and actin t be set. Cnfiguring Ndes Ndes are cnfigured using the Ndes ribbn. The ptins are als available frm the nde shrtcut menu and by using Keybard Shrtcuts. Add Nde Ndes can be added t any trigger r existing nde in the Plicy Cnfiguratin navigatin tree. The Add Nde ptin creates a new nde as a child f the selected trigger r nde in a cnfiguratin. Delete Nde Select a nde, cnditin r actin, click Delete frm the Edit tab, the shrtcut menu r press the Delete key and cnfirm. Rename Select a nde, cnditin r actin, click Rename frm the Edit tab, the shrtcut menu r press the F2 key. Enter the new name and press Enter. Disable/Enable When a nde is disabled, it remains present in the cnfiguratin but is nt passed t the Envirnment Manager agent at run-time. This is useful when trubleshting t help discver errrs in a cnfiguratin. T disable a nde, cnditin r actin, click Disable frm the Edit tab, the shrtcut menu r press Ctrl+T. A banner displays at the tp f the wrk area when a nde is disabled. The nde icn is faded and assciated cnditins and actins are displayed in gray, italic text. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 100 f 226

101 Envirnment Manager 10.1 FR1 Plicy Prduct Guide T enable a nde, cnditin r actin, click Enable frm the Edit tab, the shrtcut menu r press Ctrl+T. A nde can als be enabled by clicking the link in the yellw banner at the tp f the wrk area. When a nde is disabled r enabled, any child ndes, actins and cnditins, autmatically match the state f the parent. Individual actins and cnditins can be enabled and disabled using the same ribbn buttn, shrtcut menu ptin and keys. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 101 f 226

102 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Nde Descriptins Vide: Nde Descriptins In large envirnments, where multiple administratrs need t view and edit cnfiguratins, nde descriptins prvide a versatile methd f adding free-text anntatins. The feature is useful fr dcumenting cnfiguratin changes and describing nde behavir. There are three types f nde descriptins: Descriptins - Click the text t add further infrmatin t a nde, which can be viewed at a glance. Cmments - Highlight a nde, actin r cnditin in the Actin tab f a nde and select Cmment frm the shrtcut menu. Ntes - Select the Nde tab f a nde t add mre cmprehensive text descriptins. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 102 f 226

103 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Nde Scheduling Vide: Nde Scheduling Schedule Envirnment Manager plicy actins t ccur at specified times and frequencies. This allws tasks t run withut specific triggers being met and at regular intervals s plicies can be reapplied. The actins in a scheduled nde are added as a task in Windws Task Scheduler, run at a time and frequency specified in the nde. Using nde scheduling, tasks that are deplyed with Grup Plicy Objects can be managed by Envirnment Manager. This feature can be used with the fllwing triggers: Cmputer > Startup User Lgn > Pre-Desktp User Lgn > Desktp Created Select the Schedule tab in a nde under a cmpatible trigger and select Create as a scheduled task t cnfigure the schedule. T run the nde's tasks when the trigger fires, select Execute the nde and all sub ndes immediately - therwise the tasks will run nly when scheduled and nt when the trigger is fired. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 103 f 226

104 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Optin Schedule name Schedule type Descriptin The name that appears in the Windws Task Scheduler. Use a descriptin f the nde functinality t make it easy t identify tasks. The schedule type is used in cnjunctin with the schedule date t define when the task will ccur. Select ne f the fllwing: One time - The task will run at the scheduled start date and time. Daily - The task will run daily, frm the start date and time and at the specified recurrence interval. Fr example, if Recur is set t 1, the task will ccur daily - if set t 2, the task will run every ther day at the scheduled time. Weekly - The task will run n the selected days f the week frm the start date and time and at the specified recurrence interval. Fr example, if Recur set t 1, the task will run n the selected days every week - if set t 2 the task will run n thse days every ther week. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 104 f 226

105 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Optin Descriptin Mnthly - The task will run frm the start date n the selected days each mnth. Yu can specify the dates fr the selected mnths r schedule the task t run n particular days. Fr example, the first Mnday f each selected mnth. Schedule date Recur Repeat task Delay task Select the date and time frm which the schedule will start. Select the recurrence interval fr daily and weekly schedules. Select the interval between task repeats and fr hw lng the task will repeat. The task will run n the start date and repeat at the set time interval fr the specified duratin. Select hw lng t delay the task frm running after the task is triggered. The delay time will be a randm time between the time the task is triggered and the specified delay time. Fr example, if the task is scheduled t run at 3.00 AM with a delay time f 10 minutes, the task will start between 3.00 and 3.10 AM. Windws Task Scheduler Default Values Creating tasks in Windws Task Scheduler with Envirnment Manager is subject t the fllwing registry keys that can limit the number f queued and cncurrent tasks: TasksInMemryQueue [Default = 75, Max = 1000] TasksPerLeastPrivEngine [Default = 50, Max = 1000] Fr further infrmatin see Micrsft article Add New Nde t a Cnfiguratin r Prcess Trigger Add a new nde t a cnfiguratin 1. In the Plicy Cnfiguratin navigatin tree, select the trigger r nde that yu want t add a new nde t. 2. In the Ndes ribbn, select Nde. A new child nde is added t the highlighted nde r trigger. Add a new nde t a prcess trigger 1. There are tw prcess triggers within the Cmputer and User fixed ndes: Prcess Started and Prcess Stpped. Any ndes added t a prcess trigger must have a cnditin applied which Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 105 f 226

106 Envirnment Manager 10.1 FR1 Plicy Prduct Guide specifies a prcess r applicatin fr cnditins and actins within the nde 2. Select ne f the prcess triggers, r a nde within a prcess trigger. 3. In the Ndes ribbn, select Nde. The Cmputer Prcess Name dialg displays. 4. Select a Cnditin t apply t the applicatin r prcess; Equal, Nt Equal, Query r Regular Expressin. 5. In the Match field: Use the ellipsis t select the EXE file fr the required applicatin r prcess. Manually enter the file path r EXE name. Enter a regular expressin t match the required applicatins and prcesses. Fr example:%programfiles%\\micrsft Office\\Office\d\d\\winwrd\.exe The regular expressin \d matches any single digit. Micrsft Office uses different default installatin paths fr each versin - Office 2003 uses Office11 and Office 2013 uses Office15. Including Office\d\d in the file path ensures all versins f Wrd are fund. 6. Select whether yu want t nly target thse prcesses that are the same case as the letters in the Match field. 7. Select Match case t nly search fr prcesses with the same capitalizatin as the text in the Match field. 8. If required, select the Match Parameters checkbx t enable further validatin t be added t the match in the Parameters field. 9. Click OK t create the nde with the cnditin applied. Any actins attached t the nde will nly apply when triggered by the defined applicatin r prcess. Field Reference Optin Equal Nt Equal Query Regular Expressin Parameters Usage Actins are applied fr the applicatin r prcess defined in the Match field. The Equal cnditin can als be used in cnjunctin with the Parameters field t apply further validatin. Actins are applied fr all applicatins r prcesses ther than that specified in the Match field. Fr example, enter excel.exe in the match field t apply the assciated actins t all applicatins ther than Micrsft Excel. Targets all prcesses and applicatins which match the criteria specified in the Match field. Wildcards can be used t target a range f applicatins and prcesses. Use regular expressins t specify prcesses and applicatins. Further validatin can be added fr Equal cnditins by selecting the Match Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 106 f 226

107 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Optin Usage Parameters checkbx and adding extra definitin in the Parameters field. Fr example, yu might want t apply different cnditins and actins fr users wh use Micrsft Access 2010 Retail and Runtime versins. T target the runtime versin: Match field: C:\Prgram Files\Micrsft Office\Office14\msaccess.exeParameters field: /runtime Any actins applied t the prcess cnditin will nly be applicable t the Runtime versin f access. Example Yu have a requirement t apply different cnditins and actins fr users wh use Micrsft Access 2010 Retail and Runtime versins. T create a cnditin t target the Runtime versin: Match: %PROGRAMFILES%\Micrsft Office\Office14\msaccess.exe Parameters: /runtime Actins applied t the prcess cnditin will nly be applicable t the Runtime versin f access. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 107 f 226

108 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Arrange Ndes The rder in which the ndes are displayed in the Plicy Cnfiguratin navigatin tree determines the level f dependency. If all the ndes are at the same level in the hierarchy then their cnfigured cntents are executed in parallel. Hwever, if the ndes are at different levels in the hierarchy, a dependency n the nde abve is created and actins are executed in sequence. In the example abve, Ndes 1, 3 and 7 will execute simultaneusly. Nde 2 and Ndes 4 and 5, will nly execute nce Ndes 1 and 3 respectively, are cmplete. Likewise, Nde 6 will nly execute nce Nde 5 is cmplete. All ndes have a default timeut setting f 30 secnds. Child ndes will start autmatically after the 30 secnd timeut, regardless f whether the actins within the parent nde are cmplete r nt. The default timeut can be amended by editing the apprpriate key in the registry. The default timeut is verridden by any Custm Actin r Custm Cnditin which cntradict the value. Custm Actins and Cnditins enable a maximum time fr running the script t be set, which takes pririty ver the default setting fr the nde timeut. T arrange ndes, highlight and use ne f the fllwing methds: Press Ctrl and the apprpriate arrw key. Drag and drp. Click the arrw buttns n the Ndes ribbn. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 108 f 226

109 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Right-click t display the cntext menu and select Mve Left, Mve Right, Mve Up, r Mve Dwn. Click Cut, Cpy and Paste frm the Edit ribbn r use the crrespnding shrtcut menu ptins r keybard shrtcut. Stp Sub Ndes n Fail When applied, the Stp sub ndes n fail setting prevents any dependent sub ndes executing if a cnditin is nt met r an actin fails t run t cmpletin. The setting can be applied t any actin r cnditin and is enabled fr new cnditins by default. T apply, select a nde and set the Stp sub ndes n fail checkbx fr each actin and cnditin as required. Yu can see the Stp if sub ndes n fail status f each nde in the navigatin tree: Nde Grups The Nde Grup ptin creates a nde t which multiple reusable ndes can be added that must run t a successful cnclusin befre any assciated child ndes are run. Essentially, this means that child ndes can be dependent n multiple parent ndes. Withut nde grups the dependency can nly be created between ne parent and its child ndes. Nde grup behavir is defined by the fllwing rules: Only reusable ndes can be used within a nde grup but child ndes can be any apprpriate t the trigger. Reusable ndes within a nde grup run in parallel. If any f the reusable ndes within the grup fail, the child ndes will nt run Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 109 f 226

110 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Example The nde grup in the Cmputer > Startup trigger cntains three reusable ndes; seen in the wrk area by selecting the nde grup. Fr the child nde t run, all three f the reusable ndes must successfully cmplete. Create all required Reusable Ndes prir t setting up a nde grup. Only ndes which exist in Library > Reusable Ndes can be added t the wrk area. Create a Nde Grup 1. In the Plicy Cnfiguratin navigatin tree, select a trigger, r nde within a trigger, within which the nde grup is t be created. 2. In the Nde ribbn, select Nde Grup. A nde is created in the Plicy Cnfiguratin navigatin tree. 3. Highlight the new nde and click in the cnsle wrk area. 4. On the Nde tab, in the Add grup, select Nde Grup Member and chse the required reusable ndes. 5. Select a Reusable Nde. The nde is added t the nde grup nde. Each added nde can be Enabled r Disabled as required, using the crrespnding checkbx in the wrk area. 6. Repeat steps 4 and 5 t add further ndes. 7. When all required reusable ndes have been added, create the dependent child ndes. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 110 f 226

111 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Clne The Clne feature allws ndes, with r withut their child ndes, t be cpied, mved and used as reusable ndes. Clne ndes with child ndes Select the nde yu want t cpy and n the Nde ribbn, select Clne > Clne Nde with Child Ndes. The nde, its child ndes and assciated actins and cnditins are cpied t the same lcatin as the riginal and renamed with a prefix f "Clne f". Mve t reusable ndes Select the nde yu want t mve and n the Nde ribbn, select Clne > Mve t reusable ndes. The nde, its child ndes and assciated actins and cnditins are mve t reusable ndes Cpy t reusable ndes Select the nde yu want t mve and n the Nde ribbn, select Clne > Cpy t reusable ndes. The nde and any assciated actins and cnditins are cpied t reusable ndes and renamed with a prefix f "Clne f". Child ndes are nt cpied. Cpy t reusable ndes with child ndes Select the nde yu want t mve and n the Nde ribbn, select Clne > Cpy t reusable ndes. The nde, its child ndes and assciated actins and cnditins are cpied t the same lcatin as the riginal and renamed with a prefix f "Clne f". Cpy t reusable cnditins Select the cnditin yu want t mve and n the Nde ribbn, select Clne > Cpy t reusable cnditins. The cnditin is cpied t reusable cnditins and renamed 'Reusable Cnditin'. Stp sub ndes n fail is nt supprted fr reusable cnditins. If Stp Sub Ndes n Fail is enabled n the cnditin being cpied, it will be remved in the Reusable Cnditins nde. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 111 f 226

112 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Reusable Ndes The Reusable Nde functinality in the Envirnment Manager cnsle changed in versin 8.1 f Envirnment Manager. Hwever, when upgrading a cnfiguratin fr use in the 8.1 r later versin cnsles, the previus Run Nde functinality is enabled. See Reusable Ndes and Pre-8.1 Cnfiguratins. Reusable ndes enable a single nde t be referenced multiple times within a cnfiguratin. They can be added t any trigger which supprts its actins and cnditins. Reusable ndes are stred in the Library and any change here reflects in each ccurrence within the cnfiguratin. T view where reusable ndes are referenced in the cnfiguratin, click Reusable Ndes in the Library. Each reusable nde is listed tgether with the path within the navigatin tree f each instance. In the cnfiguratin belw, ndes RU Nde 1 and RU Nde 2 are reusable and have been referenced within the Cmputer Startup and Desktp Created ndes. The Summary, lists the ndes and where they are referenced in the cnfiguratin. Click n a reference t a reusable nde in the Summary t select the reference in the navigatin tree and view its cntents. New reusable ndes can be created directly in the Library r existing ndes in the cnfiguratin can be clned and autmatically added t the Library. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 112 f 226

113 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Actins and cnditins within reusable ndes cannt be referenced t run in triggers which d nt allw that actin r cnditin. Fr example, Drive & Printers actins d nt run in Cmputer triggers. A reusable nde cntaining Drive & Printers actins will nt be available frm the Reusable Nde r Run Nde drp-dwn with a Cmputer trigger selected. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 113 f 226

114 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Create Reusable Ndes Create a reusable nde 1. In the Plicy Cnfiguratin navigatin tree, select Library > Reusable Ndes. 2. In the Ndes ribbn, select Nde. 3. Highlight the new nde and create the required cnditins and actins. The nde is nw available as a Reusable Nde in the cnfiguratin. Create a reusable nde frm an existing nde When a nde has been mved t Reusable Ndes, it is remved frm its psitin in the cnfiguratin and a reference t the reusable nde must be created in its place if required. 1. In the Plicy Cnfiguratin navigatin tree, select the nde yu want t make reusable. 2. In the Ndes ribbn, select Clne and select ne f the sub ptins: Mve t Reusable Ndes - The nde, its actins, cnditins and all child ndes are mved t Reusable Ndes. Cpy t Reusable Ndes - The nde is cpied, with assciated cnditins and actins but withut child ndes, t Reusable Ndes and renamed with a prefix f "Clne f". Cpy t Reusable Ndes with Child Ndes - The nde, its actins, cnditins and all child ndes are cpied t Reusable Ndes. The nde and all child ndes are prefixed with "Clne Of". If either f the Cpy t ptins is selected, the nde in its riginal psitin will nt be a reusable nde. If required, delete the riginal and replace with the reusable nde. The nde, r an exact cpy f the nde, is available as a Reusable Nde in the cnfiguratin. Reference a reusable nde in a cnfiguratin 1. In the Plicy Cnfiguratin navigatin tree, select the trigger r nde t which yu want t add a reusable nde. 2. In the Ndes ribbn, in the Add grup, select Reusable Nde. 3. Select a reusable nde frm the list f thse available. The actins in the reusable nde are referenced t run frm within the selected nde. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 114 f 226

115 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnvert a Reusable Nde t a Nrmal Nde 1. Select a reference t a reusable nde in the navigatin tree. 2. In the Ndes ribbn, in the Edit grup, select Cnvert t Nrmal. All links t the reusable nde are remved. The nde can be edited independently withut affecting the reusable nde and its references. Stp Sub Ndes n Fail fr Reusable Ndes The Stp Sub Ndes n Fail instructin fr actins and cnditins in reusable ndes is enabled and disabled within the Library. The setting is applied unifrmly t each reference f that reusable nde in the cnfiguratin and cannt be changed fr individual references within the cnfiguratin. If a reusable nde cntains multiple actins r cnditins with the Stp Sub Ndes n Fail setting applied, when referenced in a cnfiguratin, any child ndes will nly run if each nde and cnditin is successful. If ne actin with Stp Sub Ndes n Fail applied des fail, the child nde will nt run. In the example belw, the Reusable Nde (RU Nde 1) has ne dependent ndes: Nde 1. Bth ndes cntain ne actin, each with Stp Sub Ndes n Fail enabled. The reusable nde is referenced in a cnfiguratin and a dependent child is added at the level belw. The Child Nde will nly run if all actins in RU Nde, Nde 1 and Nde 2 are successful. If any actin fails, it will nt run. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 115 f 226

116 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Stp Sub Ndes n Fail fr Reusable Ndes n Upgrade Prir t 8.1 reusable ndes were executed as actins cnfigured within the actins wrk area f a nde. Fr 8.1and later versins f Envirnment Manager, reusable ndes can nly be referenced as ndes under a trigger. They can be added directly t triggers in a cnfiguratin. This affects the way Stp sub ndes n fail wrks fr reusable ndes and this must be cnsidered when upgrading cnfiguratins t 8.1 and later versins. In pre-8.1 cnsles, Stp sub ndes n fail culd nt be applied t actins and cnditins within the Reusable Ndes library. Stp sub ndes n fail was nly available at reusable nde reference level fr reusable ndes referenced within a cnfiguratin. Fr 8.1 and later versins, each actin and cnditin in a reusable nde within the library has a Stp sub nde n fail instructin. When an 8.0 cnfiguratin is upgraded, all actins and cnditins within reusable ndes have Stp sub nde n fail enabled. Therefre, if any actin fails within a reusable nde, child ndes will nt run. As this culd ptentially change the behavir in a cnfiguratin, cnsideratin must be given t the impact an upgrade may have. Althugh, Stp sub nde n fail can be disabled fr each actin r cnditin as required, this may nt create the desired behavir and the cnfiguratin may require a mre cmprehensive update. Reusable Ndes and Pre-8.1 Cnfiguratins Cnfiguratins are upgraded by imprting the MSI r XML files created in a previus versin f Envirnment Manager, int the 8.1 cnsle. AppSense Envirnment Manager Package (AEMP) files are als upgraded in the same way. In lder versins f the cnsle, a reference t a reusable nde is added t a cnfiguratin using the Run Nde buttn n the Actins ribbn. In 8.x cnsles, the Run Nde buttn has been remved and replaced with the Reusable Ndes buttn in the Ndes ribbn. When a cnfiguratin is upgraded and pened in an 8.x cnsle the Reusable Nde buttn is added t the Actins ribbn t replicate the functinality f previus versins. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 116 f 226

117 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnditin Management Cnditins are used t create rules which enable actins t be executed based n wh, where frm r hw a user is cnnecting t a cmputer r applicatin. Cnditins based n Directry Membership, User, Cmputer, Sessin and Client can be used t create a cnfiguratin which can define cmputer usage thrughut an rganizatin. They are the bridge between triggers and actins t prvide cntext fr applying the actin. Fr example: Trigger Cnditin Actin User > Lgn User > User Name Map Drive The actin is t map a drive when a user lgs n. The cnditin allws a user t be specified s the drive is mapped nly fr that particular user. Withut the cnditin, the drive wuld be mapped fr all users at lgn. Actins can be set t execute when the criteria within the cnditin is true r false fr the user r their cmputer. Fr example, a cnditin can be created which applies the assciated actins t a specified cmputer r the actins culd be set t execute fr any cmputer ther than that specified. Regular expressins and ranges can als be used t create advanced cnditins which apply t multiple matches. Simple regular expressins can be used such as entering [abc] will match anything which includes any f the characters within the brackets. Mre cmplex queries can als be used, fr example, ^[a-f]+ will match any user name which begins with a letter frm a t f. Fr further infrmatin see Wildcards and Regular Expressins. The psitining f a cnditin within the Plicy Cnfiguratin navigatin tree determines hw it is applied. Cnditins at the same level within in the tree are evaluated simultaneusly. A cnditin which is a child f anther cnditin, will nly evaluate nce the parent cnditin has been successfully executed. All cnditins, with the exceptin f Cunter, can als be added t the Envirnment tab in mst triggers. Fr any cnditin which queries the Active Directry, the Envirnment Manager administratr must be a member f the target dmain r have sufficient permissins t access and query the dmain. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 117 f 226

118 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Create a Cnditin This sectin applies t creating Directry Membership, User, Cmputer and Sessin & Client cnditins nly as the dialg bxes these cnditins use fllw the same frmat. 1. In the Plicy Cnfiguratin navigatin tree, select a nde r create a new nde within the trigger yu want t apply the cnditin t. The cnditin can be added directly t the trigger in the Envirnment tab. 2. In the Cnditins ribbn, select the required cnditin. The cnditin tab, specific t the cnditin type displays by default. This tab allws the parameters t be set using a cmmn grup f ptins and fields. See Cnditin Variables fr further details. 3. Define the cnditin using the available fields and checkbxes. 4. Select the General tab. 5. Enter a descriptin and any ptinal ntes. The descriptin is used as the display name fr cnditins. If this field is left blank the display name is autmatically set frm the cnfigured cnditin. 6. Click OK t save the cnditin. The Envirnment Manager agent uses the cnditin t find a match with the same criteria fr a lgged n user. If a match is fund, any actins attached t the cnditin are executed. Once created yu can prevent a failed actin frm cntinuing t execute any dependent sub ndes by selecting the Stp sub nde n fail check bx in the nde wrk area. By default, Stp sub nde n fail is enabled fr new cnditins. Cnditin Variables Each type f cnditin can be specified using variatins f the fllwing fields, drp-dwns and checkbxes: Equal - A cmparisn is made against the cntents f the Match field t target the users r cmputers which fulfill thse criteria. Enter the criteria int the Match field r use the ellipsis (...) t search r select as required. Nt Equal - Targets all users r cmputers which d nt fulfill the criteria in the Match field. Enter the criteria in the Match field r use the ellipsis t search r select as required. Query - Targets all users r cmputers which match the criteria specified in the Query field. Using wildcards in the query allws a wide range f matches, fr example: *Windws - target users r cmputers ending in the text Windws. Windws* - target users r cmputers starting with the text Windws. *Windws* - target users r cmputers cntaining the text Windws. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 118 f 226

119 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Regular Expressin - Use regular expressins t specify advanced queries fr users r cmputers. Between - Used fr cnditins where a range f values can be set. Fr example, a cnditin culd be created t apply t a selected range f IP addresses. Evaluate nce per sessin - When selected, a cnditin is evaluated and the result is cached. If the cnditin is run again, the result is btained frm the cache rather than evaluating the cnditin again. If yu want multiple instances f the same cnditin t evaluate nly nce, a reusable cnditin must be created and referenced multiple times. If yu create multiple cnditins, they will each be run ne. If a reusable nde is referenced multiple times, evaluatin nly ccurs nce in the sessin. This ptin is nt available fr cnditins within Prcess Start and Prcess Stp triggers. The behavir surrunding this ptin changed in 8.1. Prir t 8.1 the ptin was evaluated when the cnfiguratin was parsed and cached fr the sessin. In 8.1 and later versins, the ptin is nt evaluated until the trigger is fired when the result is cached fr the whle sessin. Fr example, a Prcess Start cnditin is created fr calc.exe with the Evaluate nce per sessin checkbx selected. In 8.0 the result wuld be cached fr the sessin when the cnfiguratin is parsed at lgn. In 8.x the result is nt cached until calc.exe is run. Cnditin Cnfiguratin Examples The simple cnfiguratin belw maps Printer 1 at lgn fr Endpint 1. During lgn, the Envirnment Manager agent checks the managed cmputer against that specified in the cnditin; Endpint 1. If the cnditin is met, the actin t map the printer t Printer 1 runs. If the managed cmputer is anything ther than Endpint 1, the actin is ignred. In the Envirnment Manager cnsle, the example wuld be as fllws: Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 119 f 226

120 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Adding a further cnditin at the same level creates an OR cnditin. This cnfiguratin maps Printer 1 at lgn fr Endpint 1 OR Endpint 5. If the cmputer is ne f thse specified, the actin t map the printer t Printer 1 runs. If the managed cmputer is anything ther than Endpint 1 r Endpint 5, the actin is ignred. If a cnditin is a child f anther, an AND cnditin is created. A cnditin which checks if the user is an administratr has been added as a child f anther cnditin. By adding this, the actin will run fr the cmputers specified AND the user is an administratr. AND and OR statements can be cmbined t create AND OR cnditins. This cnfiguratin maps Printer 1 at lgn fr Endpint 1 OR Endpint 5 fr users which have administratr rights. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 120 f 226

121 Envirnment Manager 10.1 FR1 Plicy Prduct Guide There is n limit t the number f cnditins yu can add t AND and OR cnditins r the number f AND OR cnditins that can be used. The AND OR labels and the item backgrund clrs can be turned n and ff in the Optins Ribbn. Field Validatin The table belw lists the strings which are acceptable in the fields f the varius cnditins. Cnditin Field Allwed String Example User Grup Match dmain\grup appsense/sales matches the grup sales in the appsesnse dmain. LDAP CN=sales, DC=appsense, DC=cm matches the sales grup in the appsense.cm dmain. Query dmain\gr* appsense\sal* matches grup names starting with "sal" in the appsense dmain. dmain\*gr dmain\*gr* appsense\*les matches grup names ending with "les" in the appsense dmain. appsense\*ale* matches grup names cntaining "ale" in the appsense dmain. User Name Match dmain\user appsense\smithj matches the user name "smithj" in the appsense dmain Query dmain\use* appsense\smit* matches grup names starting with "smit", in the appsense dmain. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 121 f 226

122 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnditin Field Allwed String Example dmain\*use dmain\*use* appsense\*ith matches grup names ending with "ith", in the appsense dmain. appsense\*ith* matches grup names cntaining "ith", in the appsense dmain. Cmputer Grup Match dmain\grup appsense/sales matches the grup sales in the appsesnse dmain. LDAP CN=sales, DC=appsense, DC=cm matches the sales grup in the appsense.cm dmain. Query dmain\gr* appsense\sal* matches grup names starting with "sal" in the appsense dmain. dmain\*gr dmain\*gr* appsense\*les matches grup names ending with "les" in the appsense dmain. appsense\*ale* matches grup names cntaining "ale" in the appsense dmain. Cmputer Name Match cmputer SalesDesk01 matches the cmputer name "SalesDesk01" Query cmp* SalesDesk* matches all cmputer names starting "SalesDesk" *cmp *cmp* Desk01* matches all cmputer names ending with "Desk01" Desk* matches all cmputer names cntaining "Desk" Cmputer Dmain Match dmain appsense matches the dmain name "appsense". dmain appsense.cm matches the dmain name "appsense.cm" Query dm* app* matches all cmputer dmains starting "app" *dm *dm* *sense matches all cmputer dmains ending "sense" *sen* matches the dmains cntaining "sen". Cmputer Match cmputer SalesDesk01 matches the cmputer NETBIIOS Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 122 f 226

123 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnditin Field Allwed String Example NETBIOS name "SalesDesk01". Query cmp* SalesDesk* matches all cmputer names starting "SalesDesk" *cmp *cmp* Desk01* matches all cmputer names ending with "Desk01" Desk* matches all cmputer names cntaining "Desk" Cmputer IP Address User OU Membership Match xxxx.xxxx.xxxx.xxxx matches the IP address Between xxxx.xxxx.xxxx.xxxx yyyy.yyyy.yyyy.yyyy IP Address 1: , IP Address 2: matches all IP addresses between " " and " ". Match LDAP CN=sales, DC=appsense, DC=cm matches the directry membership f user OU "sales" in the appsense.cm dmain. Query u* sales* matches user OU names starting with "sales" *u *u* *sales matches user OU names ending with "sales" *sales* matches user OU names cntaining "sales" Cmputer OU Membership Match LDAP CN=sales, DC=appsense, DC=cm matches the directry membership f cmputer OU "sales" in the appsense.cm dmain. Query u* sales* matches cmputer OU names starting with "sales" *u *u* *sales matches cmputer OU names ending with "sales" *sales* matches cmputer OU names cntaining "sales" Directry Site Match sitename testsite matches the site name "testsite" Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 123 f 226

124 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Registry Cnditins Registry cnditins check whether r nt registry keys and values exist n managed endpints befre applying any assciated actins. Cnditin Descriptin Cmputer Trigger User Trigger Registry Key Exists A cnditin which checks fr the existence f specified registry keys n managed endpints and applies assciated actins accrdingly. The registry can be brwsed t find keys and sub keys can be identified if required. The Cmparisn drp-dwn allws the cnditin t check whether any specified key and sub key exists r des nt exist. Yes Yes Registry Value Exists A cnditin which checks fr registry values n managed endpints and applies assciated actins accrdingly. Define the main and sub keys t be searched fr the entered value. The value can be set using parameters t define the value name, type and actual value. Yes Yes Create a Registry Value Exists Cnditin The Registry Key Exists cnditin is created in a similar dialg t the Registry Value Exists cnditin but with fewer fields; Main Key, Sub Key and Cmparisn. 1. In the Plicy Cnfiguratin navigatin tree, select the nde r trigger t which yu want t add the cnditin. This can be: A new nde An existing nde The Envirnment tab f a trigger 2. In the Cnditins ribbn, select Registry > Registry Value Exists t display the Registry Value Exists dialg. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 124 f 226

125 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 3. Cmplete the fllwing fields: Hive - Brwse t the required registry value. A standard registry brwser is used t select the value. The Key, Value name, Value type and Value are autmatically ppulated frm the selected registry item but can be manually edited. Cmparisn - Select the required ptin frm the drp-dwn list: Optin Exists Des Nt Exist Value Type Exists Equal T Descriptin Checks if a registry value name exists regardless f type and value. The sub key can be set r left blank s that the user can check fr a value name set under the main key nly. Checks if a registry value des nt exist. Uses the same behavir as the Exists cmparisn. Checks the existence f a value name f a specific type e.g. REG_SZ, REG_DWORD etc. The Value type is available fr selectin and the main and sub key behavir is the same as Exists. Checks if the registry value is equal t a specific value. The sub key can be set r left blank s that the user can check fr a value name set under the main key nly. The value type can be set, different value editrs are displayed dependent n the selectin. The Value field can be left blank as empty values are allwed in the registry. Nt Equal T Less Than Less Than r Equal T Greater Than Checks if the registry value is nt equal t that which is specified. Uses the same behavir as the Equal t cmparisn. Checks the registry value against the selected cmparisn. These are nly available n the REG_ DWORD & REG_QWORD value types. Uses the same behavir as the Equal t cmparisn. Greater Than r Equal T 4. Select the required numerical system fr the registry value - this can be either Hexadecimal r Decimal. 5. Click OK t save the cnditin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 125 f 226

126 Envirnment Manager 10.1 FR1 Plicy Prduct Guide File and Flder Cnditins File and Flder cnditins check whether r nt specific files and flders exist n managed endpints befre applying the assciated actins. In additin t a search fr the existence f files, a cnditin can be set up t apply actins if a text file cntains specific text. Cnditin Descriptin Cmputer Trigger User Trigger File Exists A cnditin which checks whether a file des r des nt exist n managed endpints based n the name and lcatin f the file, the date the file was created, mdified r accessed and its size Yes Yes Text File Search A cnditin which searches fr files n managed endpints which d r d nt cntain a specified text string. Set the file lcatin and enter the text t search the file fr. The Text File Search cnditin supprts searching fr bth expanded and unexpanded envirnment variables. On upgrade, single % envirnment variables are replaced by duble % envirnment variables, fr example, %UserName% is changed t %%UserName%% fllwing an upgrade. This ensures existing behavir is maintained fllwing an upgrade. Yes Yes Flder Exists A cnditin which checks whether a flder des r des nt exist n managed endpints based n the name and lcatin f the flder, the date the flder was created, mdified r accessed and its size. Yes Yes Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 126 f 226

127 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Create a File r Flder Exists Cnditin 1. In the Plicy Cnfiguratin navigatin tree, select the nde r trigger t which yu want t add the cnditin. This can be: A new nde An existing nde The Envirnment tab f a trigger 2. On the Cnditins tab, select File & Flder > File Exist r Flder Exists t display the crrespnding dialg. 3. Cmplete the fllwing fields: Cnditin - Select Exists r Des Nt Exist. File r Flder - Brwse t the required file r flder r manually enter the path and file r flder name. Date - Select the checkbx and define the date criteria fr the file r flder. Size - Select the checkbx and define the size criteria fr the file r flder. 4. Click OK t save the cnditin. Create a Text File Search Cnditin 1. In the Plicy Cnfiguratin navigatin tree, select the nde r trigger t which yu want t add the cnditin. This can be: A new nde An existing nde The Envirnment tab f a trigger 2. On the Cnditins tab, select File & Flder > Text File Search t display the Text File Search dialg. 3. Cmplete the fllwing fields: File - Brwse t the required text file r flder r manually enter the path and file name. Cnditin - Select whether the cnditin will lk fr the existence r absence f the text. Text - Enter the text fr the cnditin t evaluate against. 4. Select the required checkbxes: Match Case - T match the cnditin, the text must have the same capitalizatin. Use Regular Expressins - Regular expressins can be used in the Text field. 5. Click OK t save the cnditin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 127 f 226

128 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Directry Membership Cnditins These cnditins check Organizatinal Unit (OU) membership, within Active Directry. Envirnment Manager cnnects t Active Directry and cmpares the OU specified in the cnditin with that f the current user r cmputer. If a match is made, any assciated actins are executed. Match criteria is selected using the brwse buttn which brwses fr OU cntainers. Yu must be a member f an Active Directry dmain t brwse fr an OU cntainer. This cnditin culd be used t ensure that nly users in certain OUs can undertake certain actins. Select the Include sub-ous in match checkbx t search all sub-ous f any specified OU. Withut this checkbx selected, the sub-ous are ignred and nly the OU in questin is included in the cnditin. Cnditin User OU Membership Cmputer OU Membership Client Cmputer OU Membership Site Membership Descriptin A cnditin based n a user s membership f a specified OU. Select whether the cnditin shuld equal r nt equal the entered OU r enter a query t apply the cnditin t OUs. A cnditin based n a cmputer s membership f a specified OU. Uses the same criteria as User OU Membership. A cnditin based n the membership f a specified OU fr a server based r virtual client cmputer. Uses the same criteria as User OU Membership. A cnditin based n the membership f a specific Active Directry Dmain Site. This typically relates t an rganizatin s departments r a gegraphical lcatin which hsts netwrks. Envirnment Manager interrgates the dmain t lcate sites, prviding them fr selectin frm the brwse buttn in the Match field. T brwse fr sites, yur lcatin must be assciated with an Active Directry dmain. The OU name in the Match field fr the User, Cmputer and Client Cmputer OU Membership cnditins are case sensitive. OU names entered with incrrect case will nt match. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 128 f 226

129 Envirnment Manager 10.1 FR1 Plicy Prduct Guide User Cnditins Create cnditins fr particular users r grups f users identified using Active Directry accunt name. The defined criteria are cmpared t that f the lgged n user and the assciated actins are executed. By ding this yu can target actins t users r grups f users t ensure that they can nly perfrm the actins which that user r grup requires. Cnditin Descriptin Cmputer Trigger User Trigger User Name A cnditin fr an individual user based n user name. The user name must be prefixed by the apprpriate dmain name: dmain\user name. N Yes User Grup A cnditin fr a specific grup f users such as Pwer Users r Guests. The agent cnnects t the Active Directry specified in the cnditin criteria and cllates a list f Security Identifiers (SID) fr all the grups the user is a member. A cmparisn is made with the list against the SID fr the cnfiguratin. N Yes Is Administratr A cnditin based n the administratr rights f the user. N Yes Primary Grup A cnditin based n membership f an Active Setup Primary Grup. All Active Directry users have a Primary Grup, used t supprt certain prducts. The default setting fr Primary Grup is Dmain Users fr all Active Directry users. N Yes User Prcess Name A cnditin t specify a prcess. Enter, brwse r use a regular expressin t target the executable fr the prcess yu want t create actins fr. Can nly be used in User Prcess Started and Prcess Stpped triggers. N Yes Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 129 f 226

130 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cmputer Cnditins These cnditins target individual cmputers r grups f cmputers using varius identifiers. Actins can be applied t a cmputer regardless f wh is using it. The Envirnment Manager agent checks the specified criteria against that f the managed cmputer and applies any assciated cnditins t the cmputer r grup f cmputers. LSA supprt is nt available n Cmputer cnditins. Cnditin Descriptin Cmputer Trigger User Trigger Is Laptp A cnditin t check if the endpint is a laptp. The agent checks the endpint fr a battery. If ne exists, any laptp specific actins are perfrmed. Yes Yes Cmputer Name A cnditin fr a specific cmputer. The cmputer name can be entered directly r searched fr using specified criteria n selected lcatins. Yes Yes Cmputer Dmain A cnditin fr a defined netwrk f cmputers. Use the Name Reslutin Type drp-dwn t specify whether the cnditin uses the DNS Dmain r Windws Dmain naming cnventins. The dmain entered in the Match field must be in the frmat used in yur rganizatin fr the selected naming cnventin. Fr example, a DNS dmain name culd be testing.xyz.lcal whereas the Windws dmain name wuld just be testing. Yes Yes Cmputer NETBIOS Name A cnditin fr a cmputer identified by its NETBIOS name. Yes Yes Cmputer Grup A cnditin based n a user grup fr a particular cmputer. The agent checks the specified active directry grup r grups exist and cmpares the Security Identifier (SID) against the SID f the user s cmputer fr a match. The cnditin nly matches cmputers in the specified grup - t include nested grups, select the Search nested grups checkbx. Yes Yes Cmputer IP Address A cnditin based n an IP address entered int the IP Address1 field. A range f IP addresses can be defined using the Between radi buttn and IP Address 2 field. Yes Yes Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 130 f 226

131 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnditin Descriptin Cmputer Trigger User Trigger Fr ranges, the IP address is nt treated as a whle number but based upn the value f each ctet. Fr example, if the range was frm t , wuld pass but wuld nt as the third ctet is nt within the set range. MAC Address A cnditin defined by the Media Access Cntrl (MAC) address f the netwrk cards within a cmputer. Yes Yes Cmputer Prcess Name A cnditin t specify a prcess. Enter, brwse r use a regular expressin t target the executable fr the prcess yu want t create actins fr. This can nly be used in Cmputer Prcess Started and Prcess Stpped triggers. N N Operating System A cnditin that applies actins nly when the specified perating system is matched. The perating system can be further defined t versin, service pack, build number, editin, CPU architecture and Terminal Services enabled. The Versin text bx prvides a drp-dwn t select the perating system versin. It als supprts free text, allwing yu t enter any RTM number. Fr example, if yu wanted t specify Windws 8, enter the RTM number Fr Build Number, select a cnditin, such as Greater than r Equal t in the drp-dwn, then enter a build number in the field. Yu cannt include a dt character (.) in the build number. If the build number is , fr example, yu enter T ensure yu have the crrect build number, yu can check the relevant Micrsft release infrmatin. Fr example, t view build numbers fr Windws 10 releases, g t Yes Yes Is VDI A cnditin which applies actins nly when the endpint is ne f the fllwing virtual desktps: Yes Yes Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 131 f 226

132 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnditin Descriptin Cmputer Trigger User Trigger Xen Desktp 5 Xen Desktp 7 VMware view Quest vwrkspace Sessin & Client Cnditins These cnditins use client and sessin attributes t target actins. These cnditins lk fr a match within the lgged n user s sessin r client. Fr example, a client Screen Reslutin cnditin culd be cnfigured s that a particular applicatin can nly be used n all clients with a screen reslutin f 1024x768 and abve. Cnditin Descriptin Cmputer Trigger User Trigger Published Applicatin Name A cnditin based n the use f a particular published applicatin. N Yes Client Cnnectin Prtcl A cnditin based n whether the user cnnectin is by cnsle, Independent Cmputing Architecture (ICA), Remte Desktp Prtcl (RDP) r PC ver IP (PCIP). N Yes Client IP Address A cnditin defined by the endpint s IP address entered int the IP Address 1 field. A range f IP addresses can be defined using the Between radi buttn and IP Address 2 field. N Yes Fr ranges, the IP address is nt treated as a whle number but based upn the value f each ctet. Fr example, if the range was frm t , wuld pass but wuld nt as the third ctet is nt within the set range. Client NETBIOS Name A cnditin fr the cnnecting device identified by its NETBIOS name. N Yes Client Screen A cnditin based n the screen reslutin f the N Yes Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 132 f 226

133 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnditin Descriptin Cmputer Trigger User Trigger Reslutin cnnecting device. A specific reslutin r a range can be used t define when an actin applies. This cnditin is available fr Remte Desktp Prtcl (RDP) and Independent Cmputing Architecture (IDP) clients nly. It will nt wrk n the cnsle. Client Clr Screen Depth A cnditin based n the clr screen depth f the cnnecting device. Use the slider and radi buttns t select the required value r range f values. This cnditin is available fr Remte Desktp Prtcl (RDP) and Independent Cmputing Architecture (IDP) clients nly. It will nt wrk n the cnsle. N Yes Client Cmputer Dmain A cnditin fr a defined netwrk f client cmputers. Use the Name Reslutin Type drpdwn t specify whether the cnditin uses the DNS Dmain r Windws Dmain naming cnventins. The dmain entered in the Match field must be in the frmat used in yur rganizatin fr the selected naming cnventin. Fr example, a DNS dmain name culd be testing.xyz.lcal whereas the Windws dmain name wuld just be testing. N Yes Client Cmputer Grup A cnditin based n an Active Directry client cmputer grup. N Yes Citrix Client Settings A cnditin based n attributes f the cnnecting client. Ntes N Yes The Client OS cnditin is nt cmpatible with the Netwrk Discnnected trigger. The Client Versin cnditin uses the versin number used in the marketplace, rather than the build versin number. Fr example, Citrix Receiver relates t build versin number The Client Encryptin attribute cnditin is nt cmpatible with Citrix XenDesktp. The NetScaler Sessin Plicies and NetScaler Hstname cnditins are nt cmpatible with Citrix XenApp. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 133 f 226

134 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnditin Descriptin Cmputer Trigger User Trigger The Client Versin, Client Encryptin, NetScaler Sessin Plicies and NetScaler Hstname cnditins require the fllwing t be installed: The Citrix PwerShell Brker Snap-in n the client. This snap-in can be installed n the client by running Brker_PwerShellSnapIn_x86.msi r Brker_ PwerShellSnapIn_x64.msi frm the Citrix installatin media. Fr Citrix XenApp, PwerShell 3.0 r later n the server. Fr Citrix XenDesktp, PwerShell 3.0 r later n the Virtual Desktp Agent client. Fr further infrmatin see Add a Citrix_ Client Settings Cnditin. Citrix vdisk Client Settings A cnditin t determine whether a Citrix vdisk is in use and, if s, whether it is running in Standard r Private mde. N Yes VMware Variables A cnditin based n attributes f the brker r cnnecting client. This cnditin is available n all User triggers, except Pre-Sessin and Pre-Desktp triggers. N Yes Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 134 f 226

135 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Add a Citrix Client Settings Cnditin 1. In the Plicy Cnfiguratin navigatin tree, create a new nde r select an existing nde under the Lgn Pre-Desktp sub-trigger. 2. Click Cnditins > Sessin & Client > Citrix Client Settings. The Citrix Client Settings dialg displays. If required, enter a descriptin and any additinal infrmatin relating t the Citrix Client Setting in the fields prvided n the General tab. 3. Select the Client Settings tab. 4. Select the Citrix Client Settings cnditin criteria frm the fllwing: Attributes Clients OS Client Type Client Versin Client Encryptin NetScaler Sessin Plicies NetScaler Hstname Descriptin Match the client s perating system, such as Andrid, ios, Mac r Windws. Match the type f client, such as a phne, tablet r ther device Match the versin number f the Citrix Receiver client. This uses the build versin number, rather than the versin number used in the marketplace. Fr example, Citrix Receiver relates t build versin number T view the build versin number, see the Abut bx within the Citrix Receiver. Match the client encryptin type frm Basic, Lgn Only, RC5 (40 bit), RC5 (56 bit) and RC5 (128 bit). The encryptin levels available fr XenApp and XenDesktp are Basic and RC5 (128 bit) nly. Match NetScaler sessin plicies. Separate multiple plicies with cmmas Match the hstname f the NetScaler. 5. Click OK. The Citrix PwerShell Brker Snap-in is required fr the Client Versin, Client Encryptin, NetScaler Sessin Plicies and NetScaler Hstname cnditins. This snapin can be installed n the client by running Brker_PwerShellSnapIn_x86.msi r Brker_PwerShellSnapIn_x64.msi frm the Citrix installatin media. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 135 f 226

136 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Custm Cnditins Use the Custm cnditin t create, imprt and exprt cnditins using PwerShell, Visual Basic r Java Script. Custm cnditins can be used t cater fr scenaris which are nt available as standard frm the Envirnment Manager cnsle. Fr example, t check if the Windws Firewall is switched n. The scripts are held within the AEMP cnfiguratin, cpied t disk at runtime, executed and then deleted upn cmpletin. Scripts can be imprted and exprted t enable reuse. Large scripts and high numbers f scripts increase the size f an AEMP cnfiguratin which can impact the time required t deply cnfiguratins t end pints and affect cnfiguratin executin time. It is recmmended that custm cnditins using PwerShell scripts shuld nt be used n the Lgn trigger as running these scripts can cause slw lgn times. As Custm cnditin scripts are run in batch mde, any prmpts r message bxes are nt displayed and the script times-ut withut being executed. T ensure that a cnditin script runs crrectly, remve r cmment ut any prmpts r message bxes frm the script. Custm cnditins can be applied t bth cmputer and user triggers. Exit Cdes All custm scripts must specify an exit cde which when returned, is used by the Envirnment Manager agent t determine whether the script has passed r failed. Fr scripts withut an exit cde a success (0 value) is assumed by the agent. Each script type must use a specific exit statement. Language VBScript JScript PwerShell Exit Statement WScript.Quit [value] WScript.Quit([value]) exit ([value]) Replace [value] with the exit cde fr the script: 0 fr success and 1 fr failure. Fr example: WScript.Quit 0, WScript.Quit(0), exit (0). Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 136 f 226

137 Envirnment Manager 10.1 FR1 Plicy Prduct Guide PwerShell Scripts Windws PwerShell scripts use varius executin plicies which can prevent the scripts frm running r nly allw thse signed by trusted publishers t run. Envirnment Manager verrides executin plicies and bypasses any restrictins t enable the PwerShell scripts t run. Executin plices fr users and cmputers can als be set thrugh Grup Plicy which verride all PwerShell executin plicies. A user plicy which des nt allw any scripts, r nly thse which are signed, will nt affect the running f PwerShell Custm cnditins if they are run as System. Hwever, if run as the current user the user plicy will nt allw the scripts and the Custm cnditin will fail. A cmputer plicy which des nt allw any scripts, r nly thse which are signed, will nt allw the running f any PwerShell Custm cnditins. Therefre, t successfully run Custm cnditins which use PwerShell, yur Grup Plicy must be set t allw these scripts t run fr users and cmputers. Envirnment Manager is cmpatible with PwerShell versins 1.0, 2.0 and 3.0. Create a Custm Cnditin 1. In the Plicy Cnfiguratin navigatin tree, select the nde r trigger t which yu want t add the cnditin. This can be: A new nde An existing nde The Envirnment tab f a trigger 2. In the Cnditins ribbn, select Custm t display the Custm Cnditin dialg. 3. Select the Type f scripting; PwerShell, VBScript r JScript. 4. Set the Time allwed t run. This is the number f secnds after which the script is terminated. Setting the value t zer r leaving the field blank gives the script infinite time t cmplete. Custm cnditins verride default nde and cnditin timeuts. 5. Click the Optins drp-dwn and cnfigure the fllwing ptins as required: Evaluate Once Per Sessin - Select this ptin t run the cnditin nce and cache the result fr the duratin f the sessin. Otherwise the cnditin is evaluated each time it is called upn within a cnfiguratin. Run As System User - Select this ptin t enable the script t use functinality which wuld nt therwise be accessible t the currently lgged n user. Fr user triggers, if this ptin is nt selected, the script runs in the cntext f the lgged n user. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 137 f 226

138 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 6. Enter the script using ne f the fllwing methds: Type directly int the field Drag and drp r cpy and paste frm anther lcatin. Click the imprt buttn and select a file t pen and use in the script field. Sessin Variables can be added t the script frm the Insert menu. The drp-dwn cntains any user-defined Sessin Variables and the fllwing inbuilt variables: SessinID - The current Sessin ID UserSID - The user s Security Identifier UserTemp - The lcatin f user s Temprary Directry 7. On the Netwrk Available, Netwrk Cnnected and Netwrk Discnnected triggers, further built-in Sessin Variables can be added t the script t determine cnnectin attributes. These built-in Sessin Variables cannt be amended r deleted. 8. Click OK t save the script. When triggered, the script runs t its cmpletin and the resulting success r failure f the cnditin is detailed in the debug lg files. Custm scripts which timeut are classed as failing and any child ndes and their assciated actins will nt run. Exprt Custm Scripts Scripts can be exprted and saved frm the Custm Actin dialg and imprted int ther cnditins and cnfiguratins. 1. Open a Custm cnditin. 2. Click the exprt buttn and select a lcatin t save the PwerShell, VBS r JS file. 3. Click Save t cmplete the exprt. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 138 f 226

139 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Reusable Cnditins Reusable cnditins enable cmmn cnditins t be applied multiple times within a cnfiguratin, withut the need t create a new cnditin fr each ccurrence. The prperties and settings fr a reusable cnditin are identical t every instance f that cnditin in the cnfiguratin and any changes made t the reusable cnditin are reflected thrughut the cnfiguratin. This culd be used fr a cnditin which identifies a cmmnly used applicatin r which uses the Is Administratr cnditin; any cnditin which is required fr repeated use. Reusable cnditins can be created as a new cnditin r existing cnditins can be saved as reusable cnditins. Click the Reusable Cnditins trigger t see where reusable cnditins have been referenced in the Plicy Cnfiguratin navigatin tree. Each reusable cnditin is listed with the path f each usage instance displayed beneath. The Stp sub ndes n fail setting is applied individually fr each instance f a reusable cnditin in the Plicy Cnfiguratin and cannt be applied universally t all instances. The setting nly becmes available when a reusable cnditin is added t a trigger. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 139 f 226

140 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Create a reusable cnditin 1. In the Plicy Cnfiguratin navigatin tree, select Library > Reusable Cnditins. 2. Create a new nde and name the nde relevant t the cnditin. 3. Highlight the new nde and create the required cnditin(s) frm the Cnditins ribbn. The cnditin is nw available fr use in ther triggers and ndes frm the Reusable Cnditins buttn in the Cnditins tab. Create a reusable cnditin frm an existing cnditin In the Plicy Cnfiguratin navigatin tree, select the nde cntaining the cnditin yu want t make reusable. Highlight the required cnditin in the actins wrk area and select Cpy t Reusable Cnditins frm the shrtcut menu. The ptin is als available frm the Clne buttn in the Ndes tab. If the cnditin yu are cpying has Stp if fails enabled, yu are prmpted that this ptin is nt available in the reusable cnditins library. As references t reusable cnditins cntain the Stp Sub Ndes n Fail feature, it is nt required in the library. A new nde is autmatically created in the Reusable Cnditins trigger cntaining a duplicate cnditin which is nw available as a Reusable Cnditin. When a reusable cnditin is created frm an existing cnditin, a cpy is made f the riginal cnditin which is identical fr every subsequent use. Hwever, this actin des nt link the riginal and it is independent t the reusable cnditin. Add a reusable cnditin t a cnfiguratin 1. In the Plicy Cnfiguratin navigatin tree, select the nde t which yu want t add the cnditin. 2. In the Cnditins ribbn, select Reusable Cnditins and chse a reusable cnditin. The cnditin is added t the nde and highlighted in range. Envirnment Cnditins Envirnment cnditins allw actins t be carried ut when specified Envirnment and Sessin variables exist, d nt exist r match a defined value n an endpint. Sessin variables prvide an alternative t Envirnment variables, enabling data t be passed thrugh a cnfiguratin mre efficiently as they take less time t set and are internal t Envirnment Manager. Sessin variables set in cmputer triggers are run in the System Sessin and are nly available fr cmputer triggers. Likewise, thse set in user triggers are run in the User Sessin and are nly available fr user triggers. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 140 f 226

141 Envirnment Manager 10.1 FR1 Plicy Prduct Guide A further Envirnment cnditin can als be set t run actins n an endpint n specified days, times and dates. Cnditin Envirnment Variable Sessin Variable Time and Date Descriptin A cnditin based n matching envirnment variables. The cnditin culd be t check fr the existence f the envirnment variable n endpints r t match the value f the variable. A cnditin based n matching sessin variables. Input the sessin variable name and create a cnditin which matches r des nt match the specified value. A cnditin which defines a time frame used t set when actins will apply n endpints. Individual days can be selected and date and time ranges can be specified. Create an Envirnment Variable Cnditin 1. In the Plicy Cnfiguratin navigatin tree, create a new nde r select an existing nde t which yu want t add the cnditin. 2. In the Cnditins ribbn, select Envirnment > Envirnment Variable t display the Envirnment Variable dialg displays. 3. Enter the Envirnment Variable Name. 4. Select a Cnditin frm the drp-dwn t gvern whether r nt assciated actins will run: Exists - The entered envirnment variable is fund n managed endpints Des Nt Exist - The envirnment variable is nt fund n managed endpints Equal T - The envirnment variable exists n the endpint and matches the Value field Nt Equal T - The envirnment variable exists n the endpint but des nt match the Value field Cntains - The envirnment variable exists n the endpint and includes the string in the Value field 5. Fr Equal T, Nt Equal T and Cntains cnditins, enter the Value which will be used fr the match. 6. Click OK t save. Create a Sessin Variable Cnditin 1. In the Plicy Cnfiguratin navigatin tree, create a new nde r select an existing nde t which yu want t add the cnditin. 2. In the Cnditins ribbn, select Envirnment > Sessin Variable. The Sessin Variable dialg displays. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 141 f 226

142 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 3. Enter the Sessin variable Name. 4. Select a Cnditin frm the drp-dwn bx which will gvern whether r nt assciated actins will run: Equal T - The sessin variable exists n the endpint and matches the Value field Nt Equal T - The sessin variable exists n the endpint but des nt match the Value field 5. Enter the Value which will be used validate the cnditin cnditins. 6. Click OK t save. Create a Date and Time Cnditin 1. In the Plicy Cnfiguratin navigatin tree, create a new nde r select an existing nde t which yu want t add the cnditin. 2. In the Cnditins ribbn, select Envirnment > Date and Time t display the Date and Time cnditin dialg displays. 3. Use a cmbinatin f the checkbxes and drp-dwns t define the days, dates and times n which any dependent actins will run. 4. Click OK t save the cnditin. Flw Cntrl Cnditins The Flw Cntrl cnditin grup cntains the fllwing cnditins: Cnditin Descriptin Cmputer Trigger User Trigger If Cnditin (and Else If Cnditins) These create cntainers fr cnditins within an If Else grup that enable advanced flw cntrl by allwing standard If/Else If/Else lgic fund in mst prgramming languages Yes Yes Cunter A cnditin t cntrl the number f times child actins and cnditins are run r evaluated in a single sessin. Use the cunter field t select the required number; the minimum value that can be added is 1; there is n maximum value. Yes Yes Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 142 f 226

143 Envirnment Manager 10.1 FR1 Plicy Prduct Guide If Cnditins An If cnditin creates a lgical cntainer in which a grup f cnditins can be cnfigured tgether and evaluated in turn. When ne f the cnditins is met, any assciated cnditins and actins are run and evaluatin f the grup stps. A final, default actin can be cnfigured t apply if nne f the cnditins are met. The cnditin is created using an expressin builder which by default cntains an If cnditin and an Else sectin. Optinal Else If cnditins can be added as required. Create an If Cnditin 1. In the Plicy Cnfiguratin navigatin tree, create a new nde r select an existing nde t which yu want t add the cnditin. If cnditins cannt be created within Reusable cnditins. 2. On the Cnditins ribbn, select Flw Cntrl > If Cnditin. The Expressin Builder is displayed in the If Cnditin dialg. The Expressin Builder is used when creating If and Else if cntainers t cnfigure the cnditins which the user r endpint is evaluated against. Cnditins and Reusable Cnditins are added t the Expressin Builder and cnfigured using the same dialgs and in the same way as cnditins are in any nde. Any number f cnditins can be added t the Expressin builder and the same AND and OR rules which apply t cnditins in any ther ndes. Nrmal rules als apply as t which triggers cnditins can be applied. Fr example, User cnditins cannt be created in Cmputer Startup triggers. 3. Select the Cnditins r Reusable Cnditins drp-dwn and chse the required cnditins t be added t the Expressin Builder. 4. Select the Stp Sub Ndes n Fail and the Enabled checkbxes t the cnditin as required. At least ne cnditin must be enabled. 5. Repeat steps 3 and 4 t add mre cnditins. 6. Enter a Descriptin in the Expressin Builder. This text is used t name the first (If) cnditin in the cnfiguratin and is mandatry. 7. Enter an If Grup Descriptin. This text is used t name the grup f cnditins in the cnfiguratin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 143 f 226

144 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 8. Click OK. An If Else Grup is created in the selected nde. The grup cntains the If cnditin as cnfigured in the Expressin Builder and an Else sectin which is autmatically created. 9. Select the If cnditin and add the required actin(s) and cnditin(s) frm the apprpriate tab. Multiple actins and cnditins can be added at the same level r nested t as many levels as required. 10. Select the Else sectin and add the required actin(s) and cnditin(s). Multiple actins and cnditins can be added at the same level r nested t as many levels as required r the sectin can be left empty. If the Else sectin is left empty and nne f the If r Else If cnditins are met, prcessing fr the grup cmpletes withut an actin being carried ut. 11. Select the Stp Sub Ndes n Fail and the Enabled checkbxes fr added actins and cnditins as required. If cnditins and Else sectins cannt be cut, cpied r pasted. Hwever, the cnditins and actins within can be cut, cpied and pasted as nrmal behavir fr actins and cnditins. If Cnditin Example Cnfiguratins The cnfiguratin belw shws a default If Else grup with ne If cnditin and ne Else sectin: Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 144 f 226

145 Envirnment Manager 10.1 FR1 Plicy Prduct Guide When the trigger is fired the grup is evaluated as fllws: The If cnditin is met - The assciated actin is carried ut and evaluatin f the prcessing f this grup stps. The If cnditin is nt met - The actin is ignred and the Else actin is carried ut. An actin is nt assciated with the Else sectin - N actin is carried ut fr the whle grup. Further cnditins can be added t If cnditins and the Else sectin t add extra levels f evaluatin: When the trigger is fired, the grup is evaluated as fllws: The If cnditin is met - The child cnditin is evaluated. If this cnditin is met the assciated actin is carried ut and grup prcessing stps. If the child cnditin is nt met the Else sectin is evaluated. The Else child cnditin is met - The assciated actin is carried ut and prcessing stps. The Else child cnditin is nt met - N actins are carried ut fr the entire grup. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 145 f 226

146 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Create an Else If Cnditin An Else If cnditin is an ptinal If cnditin which can be added between an If cnditin and an Else sectin. Else If cnditins functin in exactly the same as an If cnditin in that any number f cnditins and actins can be applied. 1. Select an If r an existing Else If cnditin. 2. On the Cnditins ribbn, select Flw Cntrl > Else If Cnditin. 3. Click the Cnditins r Reusable Cnditins drp-dwn and select the required cnditin. As many cnditins can be added t the Expressin Builder as required. 4. Enter a Descriptin. This text is used t name the Else If expressin in the grup and is mandatry. 5. Click OK. The Else If cnditin is created. 6. Select the Else If cnditin and add the required actin(s) frm the Actins tab. Multiple actins can be added as required. Multiple Else If cnditins can be added at the same level in the cnfiguratin. Repeat the abve prcess t add further Else If cnditins. Else If cnditins wrk in the same way as If cnditins; if the cnditin is met the assciated actin is carried ut and evaluatin f the grup ceases and if the cnditin is nt met, the actin is ignred and the next Else If cnditin r Else sectin is evaluated. Else If cnditins and the actins and cnditins within, can be cut, cpied and pasted. Else If Cnditin Example Cnfiguratins The example grup belw evaluates the user grup at lgn and creates a relevant flder n their C drive. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 146 f 226

147 Envirnment Manager 10.1 FR1 Plicy Prduct Guide When a user in the Administratrs user grup lgs nt a managed endpint, the fllwing evaluatin takes place: Is the user a member f the Users grup? N. The related actin is nt applied and the next cnditin is evaluated. Is the user a member f the Administratrs grup? Yes. The actin assciated with that cnditin is carried ut; a flder called Administratrs is created n the user s C drive. As a cnditin has been met, n further evaluatin ccurs fr this grup. When a user in the Develpers user grup lgs nt a managed endpint, the fllwing evaluatin takes place: Is the user a member f the Users grup? N. The related actin is nt applied and the next cnditin is evaluated. Is the user a member f the Administratrs grup? N. The related actin is nt applied and the next cnditin is evaluated. Is the user a member f the Pwer Users grup? N. The related actin is nt applied and the next cnditin is evaluated. The user is nt a member f any f the user grups specified in the cnditins. The Else actin applies by default and a flder called Guests is created n the user s C drive. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 147 f 226

148 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Stp Sub Ndes n Fail and If Cnditins The Stp sub ndes n fail ptin prevents a failed actin cntinuing t execute any dependent sub actins r cnditins. Nrmal Stp sub ndes n fail behavir applies t actins and cnditins within If cnditins. Hwever, Stp sub ndes n fail cannt be applied at the grup level r t any f the fllwing: If cnditins Else if cnditins The Else sectin The Stp Sub Ndes n Fail checkbx fr these cnditins and cntainers cannt be selected. Delete If Cnditins The fllwing deletin rules apply fr If cnditins: If cnditins cannt be deleted frm a grup The Else sectin cannt be deleted frm a grup Else If cnditins can be deleted and multiple Else If cnditins can be deleted when selected using Ctrl r Shift. The delete will nt wrk if an If cnditin r the Else sectin is included in the selectin Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 148 f 226

149 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cunter The Cunter cnditin allws the child actins and cnditins t be run a specified number f times within a single sessin. Fr example, an actin culd be set t run nly fr the first three times an applicatin is used in a sessin. If the applicatin is run again, the actin will nt run. Where multiple Cunter cnditins exist within a single trigger, the uppermst cnditin in a hierarchy verrides any child cnditins. In the example belw, all actins run nce as defined by the first cnditin. The child cnditin t run twice per sessin is ignred. Flw Cntrl replaces the Run Once cnditin in the 8.0 cnsle which can be replicated by setting the cunter t 1. On upgrade frm 8.0, any Run Once cnditins are upgraded t Flw Cntrl cnditins autmatically. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 149 f 226

150 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Create a Cunter Cnditin 1. In the Plicy Cnfiguratin navigatin pane, select a nde r create a new ne. 2. Cunter cnditins can be added t all triggers except the fllwing as these nly run nce per user sessin r n endpint startup: Cmputer Startup Cmputer Shutdwn User Lgn User Lgff 3. In the wrk area, select an actin r cnditin. 4. In the Cnditins ribbn, select Flw Cntrl > Cunter and select the number f times child cnditins and actins will run. The minimum value that can be added is 1; there is n maximum value. 5. Click OK. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 150 f 226

151 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Actin Management Actins are the behavirs which are applied n managed endpints when cnditins are met upn user and cmputer triggers. Within the Plicy Cnfiguratin navigatin tree actins can be added t ndes directly beneath a trigger r t a cnditin within a trigger. When added directly t a trigger, the actin executes fr all cmputers r users. Applied t a cnditin, the actin can be targeted t execute nly when that cnditin is satisfied. The placement f actins determines whether they run sequentially r cncurrently and dictates dependencies between them. Actins at the same level in the hierarchy within a nde run simultaneusly. Child actins run in sequence. A child actin will run upn the successful cmpletin f the parent r when a timeut elapses; whichever event ccurs first. Cnfiguring Actins Selecting an actin displays a dialg fr defining the parameters and fr that actin. Fr mst actins yu click Add t create a rw in the dialg with which t define the actin. Multiple rws can be added, each f which create an individual actin in the nde. This behavir applies t the majrity f actins. Where this is nt the case it is detailed in the sectins fr the specific actins in this chapter. Each actin dialg cntains a tab specific t cnfiguring that actin. Fr example, the Cpy File actin cntains the Files t Cpy tab and the Set Printer cntains the Printer tab. In additin, the fllwing tabs are standard acrss multiple actins dialgs. General This tab cntains ptinal Descriptin and Ntes fields and enables yu t identify the specific instance f an actin. The text entered in the Descriptin field becmes the name f the actin in the wrk area. If the field is left blank, a default name is created. The Nte field can be used t add any additinal text fr the actin. This culd be t add a mre detailed descriptin abut what the actin des r any ther relevant infrmatin. Run As Enables actins t run using different user credentials. Fr example, a user may require mapping t a netwrk drive r the ability t launch an applicatin using different credentials. The user can be the Current User, System r a User can be selected frm the Run As User Library. Fr further infrmatin n cnfiguring the Run As User Library see Run As. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 151 f 226

152 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Persnalizatin Plicy actins can be cnfigured at prcess start that cnflict with persnalizatin behavir. Fr example, setting a registry key that is applied t the native registry that is als being managed by Persnalizatin in the virtual cache fr the applicatin. In such cases, it is necessary t determine which behavir takes precedence. This is cnfigured in relevant Plicy actin dialgs using the Persnalizatin tab. The tab gives the fllwing tw ptins: Plicy Cnfiguratin takes precedence ver User Persnalizatin - When this ptin is selected, Envirnment Manager applies the Plicy setting t the real registry r file system and the virtual cache. Therefre the prcess always applies the plicy setting even if the registry key r file path is virtualized. Althugh nt seen in the user interface, this is achieved by adding the virtual actins t the cnfiguratin. User Persnalizatin takes precedence ver Plicy Cnfiguratin - When this ptin is selected, the Plicy setting is applied t the native registry r file system but nt t the virtual cache. As Persnalizatin settings are applied t the endpint after plicy is applied, they are read in preference t the native settings fr any managed paths. The Persnalizatin tab is nly available fr the fllwing actins and nly when thse actins are in a nde beneath the Prcess Started trigger. Registry File and Flder Grup Plicy Create Key Delete Key Set Value Delete Value Set Default Value Cpy File Delete File Mve File Rename File Create Flder Cpy Flder Delete Flder Set ADM Plicy Set ADMX Plicy Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 152 f 226

153 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnditins Specify criteria relating t file and flder dates and size. The actin will nt take place if the selected cnditin is nt met: Date - Specify a mdified, accessed, r created date fr the identified file r flder. Fr example, nly files that were created befre a certain date are deleted. Fr file and flder delete actins, yu can use the Is Older Than ptin t specify that files and flders can be deleted if a certain number f days have passed since they were created, last accessed, r mdified. In this case, yu dn't enter a date. Yu specify a whle number f days frm Fr example, flders that have nt been accessed in the last 100 days are deleted. Size - Set a cnditin based n the size f the file r flder. Fr example, nly flders which are belw 1mb will be cpied. These file cnditins cannt be used simultaneusly. Fr Cpy File, Mve File and Cpy Flder this tab cntains checkbxes fr Cmpare t destinatin timestamp and Cmpare t destinatin size. These ptins enable a cmparisn between the surce and destinatin files f the same name. This culd be used t set up a cnditin which will nly cpy the file if it was created at a later date than the ne in the target lcatin r is f a bigger size. This remves the need t set a specific date r file size. File Extensin Exclusins This tab is specific t File and Flder actins and enables a list f file extensins t be defined which will nt be included in the actin. Any files which are f an excluded type are ignred. File extensins can be entered with r withut the preceding full stp. Fr example, bth txt and.txt are crrect. Wildcards can als be used t define multiple file extensins. Fr example, dc* wuld exclude all types f Micrsft Wrd dcuments such as.dc,.dcx,.dcm. Path Exclusin Select specific flders r individual files which will nt be included in the actin. This tab is nly available t the Cpy Flder actin. Applies t the Cpy Flder actin nly and can nly be defined nce the surce and target flders have been selected. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 153 f 226

154 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Registry Actins Registry manipulatin enables registry keys and values t be setup fr the user fr the delivered applicatin set. Mst applicatins require sme frm f default cnfiguratin t be present in rder fr crrect peratin. Registry Key actins allw registry keys t be created r deleted and enable registry key values t be set, created and deleted. Imprting a registry file enables an area f the registry f a lcal r remte endpint t be added t the registry f managed endpints. This enables multiple registry keys and values t be created and deleted withut having t create each actin individually. Additinally, it is pssible t imprt desired state settings frm an existing machine r exprted registry file r even manipulate registry settings using registry hiving. Create Registry Actins 1. In the Plicy Cnfiguratin navigatin tree, create a new nde r select an existing nde. 2. In the Actins ribbn, select Registry and chse the required ptin: 3. Click Add. Create Key - Cnfigure a list f registry keys which will be created n managed endpints when triggers and cnditins apply. Keys are identified by selecting the relevant hive and brwsing t r entering the key. Delete Key - Cnfigure a list f registry keys t delete n managed endpints. Set Value - Identify a registry key and enter a value which will be set fr that key. Delete Value - Delete the value entered fr the selected key n managed endpints. Set Default Value - Identify a registry key and enter a value which will be set as the default value fr that key. 4. Cmplete the fields as required. Each f these cnditins uses as cmbinatin f the fllwing fields: Hive - Select the hive cntaining the registry key. Key - Enter r brwse t the key within the registry. Value Name - Enter r brwse t the required value fr the key. 5. Click OK t create the actin. 6. Keys and values can be remved frm the dialg bxes by selecting and clicking Remve. The Create Registry Key and Delete Registry Key actins nly include the Hive and Key fields. Registry Value Actins The Registry Value actins use the same fields as the Set Default Value dialg bx abve. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 154 f 226

155 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Imprt a Registry File 1. In the Plicy Cnfiguratin navigatin tree, create a new nde r select an existing nde. 2. In the Actins ribbn, select Registry > Imprt a Registry File t display the Registry Imprt dialg. 3. Select the required ptin: Imprt File - Add the registry keys and values frm a registry file exprted frm an endpint using Regedit r ther registry tl. Brwse - Examine the registry f the lcal r a remte endpint t select an area f the registry t be imprted int managed endpints when triggered. Keys and sub keys are displayed n the left side f the dialg bx and any values fr a selected key are displayed n the right. 4. Select the Delete checkbx fr all thse keys, sub keys and values yu wish t delete n managed endpints. Thse nt selected will be created and have values and default values set. 5. Click OK. Actins are created fr each create, delete and set value defined in the registry imprt. Create a User Lgff Registry Hive Actin 1. In the Plicy Cnfiguratin navigatin tree, create a new nde in the User > Lgff trigger. 2. Rename the nde t Exprt Registry Settings r similar. 3. In the Actins ribbn, select Registry > Registry Hiving t display the Registry Hiving dialg. 4. Enter a Title fr example, Save User Prfile Settings. 5. Enter r brwse t the lcatin where the settings will be saved, preferably n a netwrk share s that settings can be accessed frm multiple cmputers. It is nt necessary t create separate flders fr each user as Envirnment Manager will separate the user infrmatin being saved using the fllwing frmat: <registry key name>.<dmain>_<username> 6. Select Exprt the hive frm the registry t file. 7. Click Add. The Registry Key dialg bx displays. 8. Enter the key r select the ellipsis in the Key bx t display the Brwse Registry dialg bx. 9. Select the areas f the HKCU registry yu want t hive ut. This can be frm the lcal cmputer registry r a registry n anther machine. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 155 f 226

156 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 10. Enter the Value fr the key and select the required ptins: Use default value name - Use the default value name frm the registry fr the key. If selected and the value des nt cntain any data, the hive will fail. Restre Frmat: Replace - Exprts as a binary file which replaces any existing values r sub-keys n imprt. Merge - Exprts as a Micrsft Regedit 5 file which merges with any existing values r sub-keys n imprt. Override File Name - Deselect Use registry key as file name t edit the default file path in the File Name field set when selecting the key. 11. Click OK t add the registry key t the Registry Hiving dialg bx. 12. Repeat the Add prcess fr each registry key yu want t hive ut. 13. Click OK t save the actin. Once yu have created the registry hive actins that will apply at lgff, yu must cnfigure Envirnment Manager t imprt these registry settings when the user next lgs n. Create a User Lgn Registry Hive Actin 1. Prir t using this prcedure, yu first need t create the registry hive actins that will apply at lgff. Use the link belw t access that prcedure. 2. In the Plicy Cnfiguratin navigatin tree, create a new nde in the User > Lgff nde. 3. Rename the nde Imprt Registry Settings r similar. 4. In the Actins ribbn, select Registry > Registry Hiving t display the Registry Hiving dialg. 5. Navigate back t User > Lgff >Exprt Registry Settings nde created earlier. 6. Right-click n the Save User Prfile Settings actin and select Cpy. 7. Navigate back t User > Lgn >Imprt Registry Settings nde. 8. Right-click in the Actins list in the Nde wrk area and select Paste. 9. Duble-click the Hive Registry actin that has just been cpied. The Registry Hiving dialg bx displays. 10. Rename the title t Lad User Prfile Settings. 11. Select Imprt the hive frm file t the registry and click OK. The actin is saved and renamed. Registry Key Manipulatin Registry settings can be used t persnalize applicatins and Windws Settings. This can be dne in Plicy Cnfiguratin and User Persnalizatin. Hwever, it is recmmended yu nly use Plicy Cnfiguratin r User Persnalizatin t manage persnalizatin t ensure ptimum perfrmance. The Windws registry is divided int five separate keys: Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 156 f 226

157 Envirnment Manager 10.1 FR1 Plicy Prduct Guide HKEY_CLASSES_ROOT - Cntains infrmatin relating t file assciatins and fr bject linking and embedding. HKEY_CURRENT_USER - Cntains the prfile settings fr the current user. HKEY_LOCAL_MACHINE - Cntains cnfiguratin settings fr the cmputer itself. HKEY_USERS - Cntains all the actively laded user prfiles n the cmputer. HKEY_CURRENT_CONFIG - Cntains settings related t installed sftware and device drivers. Whenever a user makes any changes t their persnal settings, the infrmatin is stred in the HKEY_ CURRENT_USER (HKCU) hive area f the registry. Therefre, if the registry settings are saved ut when the user lgs ff and re-imprted the next time the user lgs n, the user's persnal settings are available t ram with them, even if they are using a mandatry prfile. This is achieved using the Registry Hiving actin within Envirnment Manager. Registry Hiving Whenever a user makes any changes t their persnal settings, the infrmatin is stred in the HKEY_ CURRENT_USER (HKCU) hive area f the registry. Therefre, if the registry settings are saved ut when the user lgs ff and re-imprted the next time the user lgs n, the user s persnal settings are available t ram with them, even if they are using a mandatry prfile. This is achieved using the Registry Hiving actin within Envirnment Manager. This sectin describes hw t create a User Lgff Registry Actin and a User Lgn Registry Actin t hive ut and back in user prfile settings. Yu first need t create the registry hive actins that will apply at lgff, and then yu need t cnfigure Envirnment Manager t imprt these registry settings when the user next lgs n. Merge and Replace Restre Frmats Registry hives can be exprted in ne f tw frmats using the Registry Hive actin: Replace r Merge. It is imprtant t select the right frmat fr each key as sme keys may nt be suitable fr a particular frmat due t the different behavir f the frmats. The Replace frmat is a binary file whereas an exprt in Merge frmat prduces a text file in the Micrsft Regedit 5 frmat. Bth cntain the data fr the exprted registry key, all sub-keys and values. When imprting a binary file exprted in Replace mde, the entire key is replaced with the cntents f the file. As a result, any values r sub-keys which have been added since the exprt, are deleted. When a Merge mde text file is imprted, nly the keys and values present in the exprt are applied t the registry. As a result, any values r sub-keys which have been added since the exprt, will still be present in the registry fllwing the imprt. Registry values, if individually selected, are always exprted as a text file regardless f the mde. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 157 f 226

158 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Example 1 HKCU\Sftware\AppSense is exprted in Replace mde. Sub-key HKCU\Sftware\AppSense\Settings is added after the exprt. On imprt, the sub-key is deleted. Example 2 HKCU\Sftware\AppSense is exprted in Merge mde. Sub-key HKCU\Sftware\AppSense\Settings is added after the exprt. On imprt, the sub-key is nt deleted. File and Flder Actins Use these actins t manage files and flders n user endpints. Flders can be created, cpied and deleted at any f the defined trigger pints. Files can be cpied, deleted, mved, renamed and have certain attributes amended. When used in cnjunctin with triggers and cnditin, these actins enable user access t be cntrlled ensuring they have access t thse files and flders they require and restrict access t thse they d nt require. Using triggers and cnditins, a flder plicy can be created fr different types f user, tailring a sessin t their specific needs. In the Actins ribbn, select File & Flder and chse ne f the actin types. Cpy File Actin Cpy a file frm ne lcatin t anther when a trigger r cnditin is satisfied. Fr example, cpy an updated file frm the user s C drive t a netwrk drive at shutdwn. Use the Files t Cpy tab t select where t cpy the files frm and t. The surce file can be renamed n cpy by adding a new filename and extensin t the target path. Fr example: Field Surce Target Change the target t Value %USERPROFILE%\Dcuments\AppSense\cnfig.aemp %USERPROFILE%\Desktp %USERPROFILE%\Desktp\AppSense.aemp The surce file is cpied t the user s desktp but will be named AppSense.aemp. If multiple files are added in the Files t Cpy tab a separate actin is autmatically created fr each in the wrk area. Select the Fail if Exists checkbx t stp the actin fr endpints where the file already exists. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 158 f 226

159 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Create a Cpy File Actin 1. In the Plicy Cnfiguratin navigatin tree, select a nde r cnditin. 2. In the Actins ribbn, select File & Flder > Cpy File. The Cpy File dialg displays shwing the Files t Cpy tab. 3. Click Add. 4. In the Surce field, use the ellipsis (...) t navigate t the file yu want t cpy. 5. In the Target field, navigate t the flder t which the surce file will be cpied when the actin is triggered. If the target path is fllwed by a backslash, the target flder is created if it des nt exist. The surce file can be renamed n cpy by adding a new filename with extensin t the target path. Fr example, Surce - %SystemDrive%\Dcuments\Wrk\Tday.dc Target - \\Server01\Update\Archive1.dc The surce file, Tday.dc, is cpied but renamed t Archive1 in the target flder. 6. If required, select the Fail if Exists checkbx. This stps the actin fr endpints where the flder already exists at the target. 7. Repeat steps 3 t 6 t create further actins within the dialg. A separate actin is created fr each actin in the selected nde. Highlight an actin and click Remve t delete an actin frm the dialg bx. 8. Cmplete the ptinal tabs as required. General Run As Persnalizatin Cnditins File Extensin Exclusins See "Cnfiguring Actins" n page Click OK. 10. Each actin cnfigured in the dialg is created in the selected nde. Delete File Actin Specify a path and file name t delete when a trigger and/r cnditin is satisfied. Fr example, this cnditin culd be used t delete a file cntaining sensitive infrmatin, when any user withut Administratr rights lgs n. Cnditins and File Exclusins can be cnfigured using the apprpriate standard tabs. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 159 f 226

160 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Create a Delete File Actin 1. Select the Plicy Cnfiguratin navigatin buttn. 2. Select a nde r cnditin. 3. In the Actins ribbn, select File & Flder > Delete File. The Delete File dialg displays shwing the Select File tab. 4. Click Add. 5. In the Surce field, use the ellipsis (...) t navigate t the file yu want t delete. 6. If required, select the Frce delete checkbx. This ignres the Read-nly attribute enabling the file t be deleted. If this ptin is nt selected, read-nly files are nt deleted. 7. Repeat steps 3 t 6 t create further actins within the dialg. A separate actin is created fr each actin in the selected nde. Highlight an actin and click Remve t delete an actin frm the dialg bx. 8. Cmplete the ptinal tabs as required: General Run As Persnalizatin Cnditins File Extensin Exclusins See Cnfiguring Actins 9. Click OK. Each actin in the dialg is created in the selected nde. Example: Delete a file if it was last accessed mre than a year ag 1. Select the Plicy Cnfiguratin navigatin buttn. 2. Select a nde r cnditin. 3. In the Actins ribbn, select File & Flder > Delete File. The Delete File dialg displays shwing the Select File tab. 4. Click Add. 5. In the Surce field, click the ellipsis (...) and navigate t the file yu want t delete. 6. If required, select the Frce delete checkbx. This ignres the Read-nly attribute enabling the file t be deleted. If this ptin is nt selected, read-nly files are nt deleted. 7. Select the Cnditin tab. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 160 f 226

161 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 8. Select Use file cnditins. The cnditin ptins in the dialg becme active. 9. In the Prperty drp-dwn, select Last Mdified Time. 10. In the When drp-dwn, select Is Older Than. The Date/Time bxes becme inactive. 11. In the Days spinbx, enter a time perid in whle days, in this case 365. Yu can enter between days. Yu cannt enter fractins f days. 12. Click OK. The actin is added t the selected nde. 13. Save the cnfiguratin. Mve File Actin This actin uses the same features and ptins as the Cpy File actin t mve a file frm ne lcatin t anther when a trigger r cnditin is satisfied. Create a Mve File Actin 1. Select the Plicy Cnfiguratin navigatin buttn. 2. Select a nde r cnditin. 3. In the Actins ribbn, select File & Flder > Mve File. The Mve File dialg displays shwing the Files t Mve tab. 4. Click Add. 5. In the Surce field, use the ellipsis (...) t navigate t the file yu want t mve. 6. In the Target field, navigate t the flder t which the surce file will be mved when the actin is triggered. The surce file can be renamed by adding a new filename and extensin t the target path. Fr example, Surce - %SystemDrive%\Dcuments\Wrk\Tday.dc Target - \\Server01\Update\Archive1.dc The surce file, Tday.dc, is mved but renamed t Archive1 in the target flder. 7. If required, select the Fail if Exists checkbx. This stps the actin fr endpints where the flder already exists at the target. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 161 f 226

162 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 8. Repeat steps 3 t 6 t create further actins within the dialg. A separate actin is created fr each actin in the selected nde. Highlight an actin and click Remve t delete an actin frm the dialg bx. The actin will nt be created. 9. Cmplete the ptinal tabs as required: General Run As Persnalizatn Cnditins File Extensin Exclusins See Cnfiguring Actins. 10. Click OK. Each actin in the dialg is created in the selected nde. Rename File Actin Rename a file at a specified lcatin when a trigger r cnditin is satisfied. Create a Rename File Actin 1. Select the Plicy Cnfiguratin navigatin buttn. 2. Select a nde r cnditin. 3. In the Actins ribbn, select File & Flder > Rename File. The Rename File dialg displays shwing the File t Rename tab. 4. Click Add. 5. In the Rename Frm field, use the ellipsis (...) t navigate t the file yu want t rename. 6. In the Rename T field, enter the new name fr the file including the file extensin. 7. Repeat steps 3 t 6 t create further actins within the dialg. A separate actin is created fr each actin in the selected nde. Highlight an actin and click Remve t delete an actin frm the dialg bx. The actin will nt be created. 8. Cmplete the ptinal tabs as required: General Run As Persnalizatin See "Cnfiguring Actins" n page 151. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 162 f 226

163 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 9. Click OK. 10. Each actin in the dialg is created in the selected nde. Mdify File Attributes Actin Change the attributes, cmmnly fund within the prperties f an existing file. Fr example, yu culd make a file writable fr administratrs but read nly fr all ther users, at lgn. Each attribute can be Set, Unset r Ignred. When the actin is triggered n a user s endpint, thse attributes defined, will be applied t the selected file. Create a Mdify File Attribute Actin 1. Select the Plicy Cnfiguratin navigatin buttn. 2. Select the nde r cnditin. 3. In the Actins ribbn, select File & Flder > Mdify File Attributes. The Mdify File Attributes dialg displays shwing the Set File Attribute tab. 4. In the File field, use the ellipsis (...) t navigate t the file yu want t update. 5. Select an actin fr each f the fllwing attributes: Read-Only Hidden System Archive Temprary Each attribute can be set t ne f the fllwing: Set - Applies the attribute Unset - Des nt alter the attribute Ignre - Des nt alter the current setting 6. Cmplete the ptinal tabs as required: General Run As See Cnfiguring Actins. 7. Click OK. 8. The actin is created in the selected nde. When the actin is triggered n a user s endpint, the attributes defined, are applied t the selected file. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 163 f 226

164 Envirnment Manager 10.1 FR1 Plicy Prduct Guide File Type Assciatins Actin This actin sets default file extensins fr selected applicatins. File assciatins created frm this actin verwrite default assciatins but users maintain the ability t verride using the Open with... cmmand r the Default Prgrams Cntrl Panel settings. When an assciatin is made, files use the icn assciated with the executable when displayed in Windws. 1. In the Plicy Cnfiguratin navigatin tree, select r create a nde r cnditin n the Pre- Desktp, Sessin Unlck r Sessin Recnnect trigger. 2. Frm the Actins ribbn, select File & Flder > File Type Assciatins. 3. Enter a valid applicatin path r use the ellipsis t navigate t the required applicatin. 4. Click Add. When the actin runs, clients d nt check that applicatins exists. File type assciatins are created regardless f whether an applicatin exists n endpints. 5. Enter an extensin r use the ellipsis t navigate t ne. 6. Multiple file extensins can be assciated with an applicatin. Use CTRL t select multiple file extensins frm the list r repeat steps 3 and Click OK t save the actin. Create Text File Actin When triggered, this actin creates a text file at a specified lcatin. This culd be any type f plain text file such as LOG, CSV, TXT r JS. 1. In the Plicy Cnfiguratin navigatin tree, select r create a nde r cnditin. 2. In the Actins ribbn, select File & Flder > Create Text File. 3. In the File field, enter the required path and filename r use the ellipsis (...) t navigate t the text file t create n managed endpints. If the path des nt already exist n an endpint, it will be created. 4. Apply the required behavir if the file already exists n an endpint: Fail if file already exists - The actin fails and the existing file remains n endpints. A fail event is reprted t any cnfigured lg. If the ptin is nt selected, the actin fails but des nt recrd an errr. Overwrite existing file - The existing file is replaced by the file defined in this actin. 5. In the Editr field, enter any text r script t ppulate the file with. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 164 f 226

165 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 6. Select the file attributes t apply t the created file: Read-nly Hidden System Archive Temprary 7. Select the required character encding fr the file: ANSI UTF-8 Unicde (UTF-16) 8. Cmplete the ptinal tabs as required: General Run As See "Cnfiguring Actins" n page Click OK t create the actin. Update Text File Actin When triggered, this actin replaces text in an editable text file. This culd be any type f plain text file such as LOG, CSV, TXT r JS. Create an Update Text File Actin 1. Select the nde r cnditin t add the actin. 2. In the Actins ribbn, select File & Flder > Text File Update. 3. In the File field, use the ellipsis (...) t navigate t the text file yu want t update. 4. In the Search Fr field, enter the text which yu want t update. The search will lk fr the exact sequence f wrds entered. 5. Use the checkbxes t apply the fllwing settings. Match Case - Will nly match text which has the same case as the Search Fr text Use Regular Expressins - Allws regular expressins t be used t braden the search criteria Multi-Line Mde - Select if either text field cntains mre than ne line f text. 6. In the Replace With field, enter the text yu want t update the file with. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 165 f 226

166 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 7. Cmplete the ptinal tabs as required. General Run As See "Cnfiguring Actins" n page Click OK t create the actin. Create Flder Actin When triggered, creates a flder at a defined lcatin n a user s endpint. Cpy Flder Actins There are three different actins which can be used t cpy flders. Cpy Cpy the cntents f a flder frm the surce t the target flder as defined in the Cpy Existing Flder tab. Only the cntents f the flder are cpied, the actual flder is nt recreated at the destinatin lcatin. Fr example, if the flder %USERPROFILE%\Dcuments\Infrmatin is specified as the surce flder and %USERPROFILE%\Desktp is set as the target, the cntents f the Infrmatin flder are cpied directly t the desktp. In rder t place them in a crrespnding flder, manually amend the target field t: %USERPROFILE%\Desktp\Infrmatin. If a flder cpy actin cntains files and all thse files fail t match the cnditins set in the actin, the files are nt cpied but the flder is still created. Prir t Envirnment Manager 8.1 the target flder is nt created if the files fail the cnditins. Mirrr The Mirrr Cpy Flder actin creates an exact cpy f a flder r flder structure and all the files cntained within, at the target lcatin specified in the Cpy Flder dialg. Files which already exist in the target are verwritten frm the surce and any supplementary files in the target are deleted. Synchrnize The Synchrnize Cpy Flder actin cmbines the cntents f tw flders t prduce a file and flder structure which is identical in bth lcatins. If tw files f the same name, type and lcatin are encuntered, the mst recently mdified is synchrnized. Use the Cpy Flder dialg t specify the surce and target flders t be synchrnized when triggered. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 166 f 226

167 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Create a Cpy Flder Actin 1. Select the Plicy Cnfiguratin navigatin buttn. 2. On the Actins ribbn, select File & Flder > Cpy Flder. The Cpy Flder dialg displays shwing the Cpy Existing Flder tab. When using Cpy Flder actins, Read-nly and Hidden attributes f flders and files are cpied - if a file being cpied is read-nly in the surce, it will be read-nly when cpied t the target. Advanced attributes fr archiving, indexing, cmpressing and encrypting are nt cpied and revert t their default settings. 3. Select the type f cpy yu want t perfrm: Cpy - Cpy the cntents f a flder frm the surce t the target flder as defined in the Cpy Existing Flder tab. Only the cntents f the flder are cpied, the actual flder is nt recreated at the destinatin lcatin. Mirrr - The Mirrr Flder actin creates an exact cpy f a flder r flder structure and all the files cntained within, at the target lcatin specified in the Mirrr Flder dialg. Files which already exist in the target are verwritten frm the surce and any supplementary files in the target are deleted. Sync - The Synchrnize Flder actin cmbines the cntents f tw flders t prduce a file and flder structure which is identical in bth lcatins. If tw files f the same name, type and lcatin are encuntered, the mst recently mdified is synchrnized. Use the Synchrnize Flder dialg t specify the surce and target flders t be synchrnized when triggered. 4. Frm the Cpy sub-flders drp-dwn, select the required behavir: 5. Click Add. Nne - Only the tp level flder and its cntents are cpied. All - All sub flders are cpied. Specify the number f sub-flder levels - Sub-flders and their cntents are cpied t the level selected. 6. In the Surce field, use the ellipsis (...) t navigate t the flder yu want t cpy. 7. In the Target field, navigate t the flder t which the surce flder will be cpied when the actin is triggered. 8. Files which already exist in the target flder are cpied if the same file in the surce flder has changed. Envirnment Manager uses the file size and time stamp t determine whether a file has changed. Updated file attributes, such as Read-nly, d nt dente a changed file. 9. Click the Optins field and select as required. The available ptins are dependent n the type f Cpy Flder actin selected. See Cpy Flder Optins fr details. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 167 f 226

168 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 10. Repeat steps 3 t 7 t create further actins within the dialg. Highlight an actin and click Remve t delete an actin frm the dialg bx. The actin will nt be created. 11. Cmplete the ptinal tabs as required: General Run As Persnalizatin Cnditins File Extensin Exclusins Path Exclusin See "Cnfiguring Actins" n page Click OK. Each actin cnfigured in the dialg is created in the selected nde. If a flder cpy actin cntains files and all thse files fail t match the cnditins set in the actin, the files are nt cpied but the flder is still created. Cpy Flder Optins Depending n the type f cpy, a cmbinatin f the fllwing ptins are available frm the Optins clumn fr the actin: Optin Cpy Mirrr Sync Cntinue n errr - If selected and an errr ccurs during executin, the cpy actin cntinues. With this ptin checked and multiple files selected fr cpying, if ne file fails t cpy the actin cntinues and the actin is attempted fr the remaining files. Failed cpies are nt retried. If the ptin is nt checked, an errr will be thrwn and the actin stps. The verall status f the actin will still be a fail if this ptin is selected and an errr ccurs. Overwrite newer files - Use this ptin t determine the behavir when attempting t cpy files which already exist in the Destinatin flder. If the ptin is selected and a newer versin f a file exists in the Surce flder, the versin in the Destinatin flder is verwritten. If the ptin is nt selected, the versin f the file in the Destinatin flder is nt verwritten. This des nt cause the actin t fail but t mve n t the next file in the cpy actin. This ptin is selected by default. Fail if flder exists - Select t ignre the peratin if a crrespnding flder exists in the target. The actin fails if the target flder already exists. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 168 f 226

169 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Optin Cpy Mirrr Sync Exclude junctin pints - Select whether t include r exclude flders and files identified as NTFS junctin pints r symblic links in cpy flder actins. Fr further infrmatin abut junctin pints, see Cpy file attributes - Includes the Read-nly and Hidden attributes f the surce flder in the cpy - if a file being cpied as part f a Cpy Flder actin is read-nly in the surce, it will be read-nly when cpied t the target. Advanced attributes fr archiving, indexing, cmpressing and encrypting are nt cpied and revert t their default settings. Cpy security attributes - Include the security permissins settings fr each user and grup that has been assigned access rights fr the flder being cpied. Nte: The accunt executing the actin must have the apprpriate security permissins fr this setting. Cpy wner infrmatin - Cpy wner infrmatin frm the surce. Nte The accunt executing the actin must have the apprpriate security permissins fr this setting. Include deleted files - When flders are synchrnized, any files which have been remved frm either the surce r the target flder since the last sync, are remved frm the crrespnding lcatin. This ptin is selected by default. Fr Cpy Flder actins, exclusins and cnditins can be applied using the standard actin tabs. Mirrr and Synchrnize Flder Actins Cnfiguratin Parallel cpy actins between the same flder shuld be avided. Fr example: Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 169 f 226

170 Envirnment Manager 10.1 FR1 Plicy Prduct Guide When a nde cntaining the abve actins is run, unexpected behavir culd ccur as it is nt clear whether flders A and B shuld be mirrred r synchrnized first. In such scenaris the actins shuld be cnfigured sequentially t clearly define the actin: The flders have been synchrnized prir t the mirrr. Parallel cpy actins between unrelated flders functin as nrmal. Synchrnize Flder Behavir The sectins belw explain Synchrnize Flder behavir in varius circumstances. Delete Behavir Fllwing synchrnizatin, the surce and target flders cntain the same files. If a file is deleted frm ne f the lcatins, it will be cpied back when the flders are next synchrnized - files are always synchrnized, never deleted. Actin Surce Target Create file in Surce flder File A Synchrnize Surce and Target File A File A Delete file frm Target flder File A Synchrnize Target and Surce File A File A Hwever, if yu select the Include deleted files ptin, when synchrnized, the deletin f File A frm the target flder wuld be reflected in the surce: Actin Surce Target Create file in Surce flder File A Synchrnize Surce and Target File A File A Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 170 f 226

171 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Actin Surce Target Delete file frm Target flder File A Synchrnize Target and Surce Rename Behavir Fllwing a flder synchrnize, if a file is renamed in either the surce r target flder, when the flders are next synchrnized, the riginal file and the renamed file will be present in bth lcatins. Actin Surce Target Create file in Surce flder File A Synchrnize Surce and Target File A File A Rename file in Target Flder File A File B Synchrnize Target and Surce File A File B File A File B As with deletes, the results are different if yu select the Include deleted files ptin. When synchrnized, a file renamed in either the surce r target flder, will be renamed in the ppsite lcatin. In the example belw, in the target lcatin, File A is renamed t the File B. When the lcatins are synchrnized, the file is renamed in the surce. Actin Surce Target Create file in Surce flder File A Synchrnize Surce and Target File A File A Rename file in Target Flder File A File B Synchrnize Target and Surce File B File B Delete Flder Actin Delete a selected flder frm the user s endpint. The flder and all cntents are deleted when the assciated trigger and/r cnditin is satisfied. Create a Delete Flder Actin 1. Select the Plicy Cnfiguratin navigatin buttn. 2. Select a nde r cnditin. 3. In the Actins ribbn, select File & Flder > Delete Flder. The Delete Flder dialg displays shwing the Delete Flder tab. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 171 f 226

172 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 4. Click Add. 5. In the Surce field, use the ellipsis (...) t navigate t the file yu want t delete. 6. If required, select the Frce delete checkbx. This ignres the Read-nly attribute enabling the file t be deleted. If this ptin is nt selected, read-nly files are nt deleted. 7. Repeat steps 3 t 6 t create further actins within the dialg. A separate actin is created fr each actin in the selected nde.; Highlight an actin and click Remve t delete an actin frm the dialg bx. The actin will nt be created. 8. Cmplete the ptinal tabs as required: General Run As Persnalizatin Cnditins See Cnfiguring Actins. 9. Click OK. Each actin in the dialg is created in the selected nde. Flder Redirectin Actin Flder redirectin allws a user s persnal files and settings t be saved t anther lcatin at lgn. Flders can be redirected t any available lcatin including a lcal flder, a netwrk drive r the user s hme drive, which is utside the prfile itself. This helps users maintain access t their files and settings when raming between machines and imprves lading times during lgn. Create a Flder Redirectin Actin 1. Select the Plicy Cnfiguratin navigatin buttn. 2. Create a new nde r select and existing nde in the User > Lgn trigger. 3. Select File & Flder > Flder Redirectin frm the Actins ribbn. The Flder Redirectin dialg displays. 4. Frm the Surce drp-dwn, select the flder yu want t redirect. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 172 f 226

173 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 5. Select the destinatin fr the redirectin r use the ellipses (...) t navigate t the required flder. UNC paths (including mapped drives which pint t a netwrk lcatin) are nt supprted as destinatins fr the Histry, Temprary Burn Flder (CD Burning) and Temprary Internet Files (Cache) flders. 6. Select the cpy methd: D Nt Cpy - Files are nt cpied frm the riginal flder t the redirected flder. Use Flder Redirectin Cpy - Files are cpied frm the riginal flder t the redirected flder using the Windws flder redirectin actin. Use Envirnment Manager Cpy - Files are cpied frm the riginal flder t the redirected flder using an Envirnment Manager Flder Cpy actin. 7. Select the Optins t apply t the redirectin: Only cpy mdified files - Cpy files that have been mdified in the riginal flder since the previus cpy. Available nly if Use Envirnment Manager Cpy is selected. D nt redirect if cpy fails - D nt apply the flder redirectin if the cpy actin fails. Available nly if Use Envirnment Manager Cpy is selected. Delete cntents frm riginal flder after cpying - Delete files and subflders frm the riginal flder after the cpy is cmplete and the redirectin is applied. Available nly if Use Flder Redirectin Cpy r Use Envirnment Manager Cpy is selected. Only user has permissin t access redirected flder - Permissins are set n the redirected flder t allw nly the lgged n user t access the flder. Maintain access permissins t the surce flder - Fllwing the redirectin, access t the riginal flder is maintained fr the lgged n user. Make redirected flder available ffline - The redirected flder is available if the end pint enters an ffline state after the redirectin. Remve the flder redirectin at lg ff r cnfiguratin change - The flder redirectin is nt applied permanently and is remved at user lg ff r when the cnfiguratin changes. 8. The Only user has permissin t access the redirected flder and Maintain access permissins t the surce flder cannt be enabled in the same actin. 9. Click OK t save the actin. Flder Redirectin Surces The fllwing flders can be used in the Flder Redirectin actin and are cmpatible with the perating systems as shwn. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 173 f 226

174 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Surce Win7 Win8 Win10 Administrative Tls AppData (Raming) Cntacts Ckies Desktp Dcuments (My Dcuments) Dwnlads Favrites Histry Links Music (My Music) Netwrk Shrtcuts (NetHd) Pictures (My Pictures) Printer Shrtcuts (PrintHd) Prgrams Quick Launch Recent Items (My Recent Dcuments) Saved Games Searches SendT Slide Shws Start Menu Startup Templates Temprary Burn Flder (CD Burning) Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 174 f 226

175 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Surce Win7 Win8 Win10 Temprary Internet Files (Cache) Vides (My Vides) Drives and Printers Actins These actins map and unmap printers and drives as specified. They are useful fr setting printers and mapping drives when users lg n t a specific cmputer, giving access t printers and drives apprpriate t their lcatin. Map Drive Create an actin t map a drive n managed endpints when triggered. Fr example, mapping users t a shared drive at lgn s they have access t required resurces. Drives are autmatically unmapped at the end f a user sessin r fllwing a cnfiguratin change unless the actin is created under cmpatible triggers and the Permanent ptin is selected. Any drive can be mapped including SharePint drives and lcal flders. 1. In the Plicy Cnfiguratin navigatin tree, select r create a nde r cnditin. 2. In the Actins ribbn, select Drives & Printers > Map Drive. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 175 f 226

176 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 3. Click Add and cnfigure the fllwing settings: Field/Setting Drive Descriptin Select which letter the drive maps t. The Next ptin is available n the Pre-Desktp and Desktp Created Lgn triggers. This will attempt t map t the next unused drive letter. If yu are using a mixture f actins that set specific drives and actins that use 'Next' drive setting, run the specific drive mappings first. This ensures all drives map crrectly. T d this, make 'Next' map drive actins dependent children f specific drive mappings r create them in dependent child ndes. Exclude Path Friendly Name Override Hide Permanent Select which drive letters are ignred when the next available drive ptin is selected. The next available drive which is nt n the exclude list is mapped. This is available n the Pre-Desktp and Desktp Created Lgn triggers if Next has been selected as the drive. Enter the path r use the ellipsis t navigate t the required lcatin. A name that will be displayed instead f the path n managed endpints. The friendly name persists n endpints unless explicitly cleared by mapping the same drive withut a friendly name. Unmapping the drive des nt clear the name. Remves existing mapping t the specified drive n endpints and remaps the drive based n the settings defined in the actin. The drive is mapped but is nt visible in Windws Explrer n endpints. Hidden drives can still be accessed by entering the drive letter in the Windws Explrer address bar r in a cmmand windw. This ptin is nly available if the actin is added t the Pre-Destp Lgn trigger. The drive mapping persists n managed endpints beynd the current sessin. If nt selected, the drive is unmapped at lgff r fllwing a cnfiguratin change. This ptin is nly available n cmpatible triggers. The Permanent ptin is nt available n the fllwing triggers: Pre-Desktp, Prcess Started, Netwrk Cnnected, Sessin Recnnected, Sessin Lcked, and Sessin Unlcked. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 176 f 226

177 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 4. Cmplete the ptinal tabs as required: General Cnnect As See "Cnfiguring Actins" n page Click OK t save the actin. Unmap Drive Create an actin which unmaps a drive when triggered. Fr example, unmapping a drive when a user discnnects frm the netwrk. 1. In the Plicy Cnfiguratin navigatin tree, select r create a nde r cnditin. 2. In the Actins ribbn, select Drives & Printers > Unmap Drive. 3. Select the drive t discnnect. 4. Cmplete the ptinal tabs as required. General Run As See "Cnfiguring Actins" n page Click OK t save the actin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 177 f 226

178 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Map Printer Create an actin t map a printer fr users. Fr example, by cmbining this actin with Cmputer IP Address cnditins, users are autmatically cnnected t the crrect printer fr their lcatin. 1. In the Plicy Cnfiguratin navigatin tree, select r create a nde r cnditin. 2. In the Actins ribbn, select Drives & Printers > Map Printer. The Map Printer dialg displays. 3. Cmplete the fllwing fields and apply the required settings: Field/Setting Remte printer path Friendly Name Unmap at lgff Set as default printer Retries Timeut (secs) Driver Lcatin Driver Name Descriptin Enter the printer address r click the ellipses and select the required printer. The address can be in UNC, Direct IP r HTTP. If using an IP address, the default prt, 9100, is used. T use an alternative prt, add it t the end f the IP address, separated by a cln, fr example, :9101. If using an IP address fr a printer, enter an ptinal friendly name. This allws yu t easily identify the printer. Apply as required t determine whether the printer mapping persists beynd the user's current sessin r is unmapped when the user lgs ff. Select t make this printer the users' default. Enter the number f times endpints will attempt t cnnect t the selected printer. If the number f retries is exceeded, the printer is nt mapped. Enter the time, in secnds, t wait between cnnectin attempts. If using an IP address fr a printer, enter r select the lcatin f the relevant printer driver INF file. If the driver specified in the Driver Name field des nt already exist n an endpint, the driver installs frm the specified lcatin. If the driver fails t install, the printer is nt mapped. If using an IP address fr a printer, enter the name f the required driver. If already installed n endpints, the printer is mapped. If nt installed, the driver is installed frm the specified driver lcatin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 178 f 226

179 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 4. Cmplete the ptinal tabs as required. General Cnnect As See "Cnfiguring Actins" n page Click OK t save the actin. Set Default Printer Create an actin t set the default printer fr users. Fr example, by cmbining this actin with Cmputer IP Address cnditins, users are autmatically cnnected t the crrect printer fr their lcatin. 1. In the Plicy Cnfiguratin navigatin tree, select r create a nde r cnditin. 2. In the Actins ribbn, select Drives & Printers > Set Default Printer. 3. Enter the Remte printer path r click the ellipses and select the required printer. 4. The address can be in UNC, Direct IP r HTTP. If using an IP address, the default prt, 9100, is used. T use an alternative prt, add it t the end f the IP address, separated by a cln, fr example, : Apply the Unmap at lgff setting as required t determine whether the printer mapping persists beynd the user's current sessin r is unmapped when the user lgs ff. 6. Cmplete the ptinal tabs as required. General Cnnect As See "Cnfiguring Actins" n page Click OK t save the actin. Unmap Printer Create an actin t unmap a specific printer r all existing printer cnnectins when triggered. 1. In the Plicy Cnfiguratin navigatin tree, select r create a nde r cnditin. 2. In the Actins ribbn, select Drives & Printers > Unmap Printer. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 179 f 226

180 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 3. D ne f the fllwing: T unmap all existing printer cnnectins, select Unmap All. T unmap a specific printer, enter the Remte printer path r click the ellipses and select the required printer. The address can be in UNC, Direct IP r HTTP. If using an IP address, the default prt, 9100, is used. T use an alternative prt, add it t the end f the IP address, separated by a cln, fr example, : Click OK t save the actin. ODBC (Open Database Cnnectivity) Actins Create, Amend and Delete ODBC actins. An actin culd be triggered when a user pens a particular applicatin, enabling access t a database cntaining relevant data. ODBC cnnectins enable a cmputer t access data frm any applicatin, regardless f the database management system (DBMS). Use this actin t establish a cnnectin between a cmputer and a database stred n anther system. The fllwing actins are available: Create ODBC Cnnectin Amend ODBC Cnnectin Delete ODBC Cnnectin T specify an ODBC cnnectin fr any f the three actins select the Cnnectin Details tab and cmplete the fllwing fields: Field Cnnectin Name Driver Type Current Cnnectins Descriptin A unique name t identify the cnnectin. A drp dwn list cntaining the available driver types The list is autmatically ppulated with all available cnnectins n the current cmputer, based n the driver type selected. Once the cnnectin is defined, specific prgrams can be tld t use the cnnectin t access infrmatin n that database. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 180 f 226

181 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Custm and Execute Actins Custm Actin Custm Actins can be created using PwerShell, Visual Basic r Java Script t allw prcessing nt available frm ther Envirnment Manager actins. The scripts are held within the XML cnfiguratin, cpied t disk at runtime, executed and then deleted upn cmpletin. Actins with invalid scripts return a fail and any child actins d nt run. Prir t Envirnment Manager 8.1 custm actins passed whether the script was valid r nt. Separate auditing events are created fr successful and unsuccessful actins, these can be viewed thrugh the Auditing buttn in the Manage ribbn. Example script ' ========================================================== ' Checks t see if a prcess (EMCreService.exe) is running ' ========================================================= strcmputer = "." Set bjwmiservice = GetObject("winmgmts:\\" & strcmputer & "\rt\cimv2") Set bjshell = CreateObject("Wscript.Shell") Set clprcesses = bjwmiservice.execquery _ ("Select * frm Win32_Prcess Where Name = 'EMCreService.exe'") If clprcesses.cunt =0 Then Wscript.Ech "There are n instances f EMCreService.exe running" Wscript.Quit 0 Else Wscript.Ech "EMCreService.exe is running" Wscript.Quit 1 End If Separate auditing events are created fr successful and unsuccessful actins. These can be viewed thrugh the Auditing buttn in the Manage ribbn. Select the Type f script required; PwerShell, Visual Basic r Java Script and enter the script directly int the dialg. Scripts can als be added using cpy and paste r imprted using the imprt buttn. The fllwing settings can be applied which affect the behavir f the actin: Timeut - Set a timeut fr the cmpletin f the script. If the time set is reached the actin will fail. The maximum value that can be set is 60 secnds unless set t 0 which is infinite. Timeuts set in Custm Actins verwrite the default nde settings. See Cnfiguring Ndes and Default Timeut Settings fr further details. Prevent script frm running interactively - This ptin is selected by default and means that scripts will run withut pp-ups that require user interactin. Apply envirnment variables t cnfiguratin - With this ptin selected, any envirnment variable set in the script is als set in the registry and EM Client enabling it t be used utside f the script. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 181 f 226

182 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Insert - Select a Sessin Variable t add t the script. The list includes the fllwing built-in variables: SessinID - The current Sessin ID UserSID - The user's Security Identifier UserTemp - The lcatin f user's Temprary Directry In the Netwrk Available, Netwrk Cnnected and Netwrk Discnnected triggers, further built-in Sessin Variables can be added t the script t determine cnnectin attributes. Exit Cdes All custm scripts must specify an exit cde which when returned, is used by the Envirnment Manager agent t determine whether the script has passed r failed. Fr scripts withut an exit cde a success (0 value) is assumed by the agent. Each script type must use a specific exit statement: VBScript: WScript.Quit [value] JScript - WScript.Quit([value]) PwerShell: exit ([value]) Replace [value] with the exit cde fr the script: 0 fr success and 1 fr failure. Fr example: WScript.Quit 0, WScript.Quit(0), exit (0) PwerShell Scripts Windws PwerShell scripts use varius executin plicies which can prevent the scripts frm running r nly allw thse signed by trusted publishers t run. Envirnment Manager verrides executin plicies and bypasses any restrictins t enable the PwerShell scripts t run. Executin plices fr users and cmputers can als be set thrugh Grup Plicy which verride all PwerShell executin plicies. A user plicy which des nt allw any scripts, r nly thse which are signed, will nt affect the running f PwerShell Custm actins if they are run as System. Hwever, if run as the current user the user plicy will nt allw the scripts and the Custm actin will fail. A cmputer plicy which des nt allw any scripts, r nly thse which are signed, will nt allw the running f any PwerShell Custm actins. Therefre, t successfully run Custm actins which use PwerShell, yur Grup Plicy must be set t allw these scripts t run fr users and cmputers. Envirnment Manager is cmpatible with PwerShell versins 1.0, 2.0 and 3.0. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 182 f 226

183 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Execute Actin These actins execute an applicatin r prcess when triggered. Brwse t the applicatin frm the Filename field. The Wrking Directry is autmatically added when the applicatin is selected. Additinal Parameters can be added t pass t the prgram. T enable the prcess t run using different user credentials, select the Run As tab and select the user as required. If the D nt create windw (Cnsle based applicatins) checkbx is selected, any cmmand windws assciated with an applicatin r prcess are hidden frm the user. Avid including Execute actins at lgn in ndes set t execute in sequence fr files which require user interactin t cmplete, such as prgram files. Otherwise, the lgn prcess is halted indefinitely as the lgn script waits fr the execute script t cmplete. Fr example, if the Execute actin launches ntepad.exe, the lgn script waits fr Ntepad t end befre prceeding with the lgn prcess. If the D nt execute children f this actin until the prcess has exited ptin is unchecked this scenari will nt be held up as user interactin is turned ff. Grup Plicy Actins Grup plicy is a set f cnfiguratin rules relating t the wrking envirnment f users and cmputers. Yu can add Grup Plicy rules t actins in a cnfiguratin. Settings fr perating systems, applicatins, and users can restrict r allw user functinality. Fr example, yu can use Grup Plicy t prhibit access t the Cntrl Panel r t limit user prfiles t a specific size. Grup plices are stred in administrative template files that describe where the registry-based settings are stred. There are tw types f files: ADM - Administrative template files that stre settings fr Windws XP and Windws Server ADMX - Administrative template XML files that stre the settings fr Windws Vista and Windws Server 2008 and higher. By default, Grup Plicy files are stred in the fllwing lcatins: ADM - C:\WINDOWS\Inf ADMX - C:\WINDOWS\PlicyDefinitins Yu can change the default lcatin fr string Grup Plicy files in the Grup Plicy Lcatin dialg, which yu access in the Manage ribbn. Fr mre infrmatin, see Grup Plicy Lcatin. Yu create Grup Plicy Actins in the Set Plicy dialg. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 183 f 226

184 Envirnment Manager 10.1 FR1 Plicy Prduct Guide The dialg lists infrmatin abut Grup Plicy settings in the fllwing clumns: Categry - The parent path f the Grup Plicy setting accrding t the hierarchy in which settings are rganized in the dialg, fr example Windws Cmpnents\FileExplrer\Explrer Frame Pane. Plicy - The name f the plicy, fr example Hide specified Cntrl Panel items. State - A plicy can be Enabled, Disabled, r Nt Cnfigured. Value - Sme plicy settings need a value setting, such as a date r file size. File Name - The name f the ADM r ADMX file within the plicy itself. Yu can use the clumns' shrtcut menu t chse which clumns t display and hw: The plicy details listed in the dialg are als included in the reprt prduced by the Cnfiguratin Prfiler: Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 184 f 226

185 Envirnment Manager 10.1 FR1 Plicy Prduct Guide When yu create a Grup Plicy actin, yu can add multiple Grup Plicy settings t a single actin. Yu can use the Create as individual actins ptin t cnvert each plicy setting int an actin f its wn. Splitting multiple Grup Settings int separate actins is irreversible. Yu cannt regrup the new actins. Hwever, nce the actins are created, yu can edit an individual actin and add additinal Grup Plicy settings t it. Plicy settings applied thugh Envirnment Manager are autmatically remved frm managed endpints at lgff r when a cnfiguratin changes. If the Apply plicy settings permanently checkbx is selected, the remve is nt applied and the plicy setting remains active n the endpint. Grup plicy administrative templates such as Site t Zne Assignment List fr Internet Explrer, require Client Side Extensins (CSE) t run. In previus versins f Envirnment Manager, these plicies culd be cnfigured but the agent was unable t run the CSEs. The Envirnment Manager agent nw supprts these CSEs. Flder Redirectin using CSEs is nt supprted, as the CSE cannt be cnfigured thrugh ADMX. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 185 f 226

186 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Create a Grup Plicy Actin 1. In the Plicy Cnfiguratin navigatin tree, create a new nde r select an existing nde. 2. In the Actins tab, select Grup Plicy > Set ADMX Plicy r Set ADM Plicy. The Set ADMX Plicy dialg displays. 3. In the Plicy flder text bx, accept the default plicy flder. Or click Brwse t navigate t a flder frm which t select ADMX plicy templates. 4. T add a plicy setting, click Add. The Plicies dialg displays. 5. In the navigatin tree in the left-hand pane, select a categry. Yu can use the Filter lcate the required categry mre quickly. The individual plicies fr that categry display in the right-hand pane. 6. Duble-click the required plicy in the right-hand pane t cnfigure its settings. The Set Plicy Values dialg bx displays. It has tw tabs: Optins and Help. Click Help t view a descriptin f the plicy setting. Click Previus Setting and Next Setting t scrll thrugh the settings in the selected plicy flder. 7. In the Optins tab, cnfigure the setting as required: Enabled, Disabled, r Nt Cnfigured. When Enabled is selected, sme plicies have additinal settings t enter, such as a date r file size. 8. Click OK t add the plicy t the Set ADMX Plicy dialg. 9. Repeat steps 4-9 t add mre plicies. Yu can use the Edit and Remve buttns t adjust the settings. 10. If required, select the Apply plicy settings permanently checkbx. Plicy settings applied thugh Envirnment Manager are autmatically remved frm managed endpints at lgff r when a cnfiguratin changes. If yu select the checkbx, the remve is nt applied and the plicy setting remains active n the endpint. 11. T split multiple settings int single actins, select the Create as individual actins checkbx. Plices cannt be regruped nce yu split them. 12. Click OK. An actin is created cntaining all the cnfigured grup plicy settings. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 186 f 226

187 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Envirnment Actins Envirnment actins enable bth Envirnment Variables and Sessin Variables t be cnfigured n managed endpints. When triggered, bth types f variables can be set r deleted whilst Envirnment Variables can als be appended. Envirnment Variables There are tw cmmn types f envirnment variables user envirnment and system envirnment variables. User envirnment variables are set n the User triggers in Envirnment Manager, and system envirnment variables n Cmputer triggers. Envirnment variables set in actins are available t all child actins r triggers and n any future triggers. Variables are als available t ther applicatins, such as Windws Explrer, but nly after the trigger cntaining the actin cmpletes. User envirnment variables typically stre infrmatin related t resurces and settings wned by the user. Examples f user envirnment variables include %TEMP% which pints t a specific user s flder fr string temprary files r %HOMEPATH% which pints t a user s prfile directry. System envirnment variables typically refer t lcatins f critical perating system resurces r architecture. Examples f system envirnment variables include %windir% which is the path t the Windws directry r %PrgramFiles% which pints t the lcatin f the Prgram Files directry Sessin Variables Sessin variables prvide an alternative t envirnment variables, allwing data t be passed thrugh an Envirnment Manager cnfiguratin withut the limitatins n lifetime and scpe that apply t envirnment variables - sessin variables extend acrss multiple prcesses fr a given user and sessin. Sessin variables can be used and expanded anywhere within Envirnment Manager where envirnment variables can be used. They can be used fr applying bespke file paths fr map drive and flder redirectin actins and are particularly useful when used in the scripts within Custm actins and cnditins. Envirnment Variable and Sessin Variable Actins Set Envirnment Variable Enter the Variable Name and Variable Value. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 187 f 226

188 Envirnment Manager 10.1 FR1 Plicy Prduct Guide A list f existing envirnment variables available n the cmputer n which the Envirnment Manager Cnsle is running is displayed. These can be selected and their variable values edited as required. The Envirnment Variable is set n managed endpints with the value as entered. Append Envirnment Variable Enter the Variable Name, Variable Value t be appended and select the Separatr t be used between the existing Variables and Append values. The selected envirnment variable is updated t include the append value using the entered separatr. A list f existing envirnment variables available n the cmputer n which the Envirnment Manager Cnsle is running is displayed. These can be selected and appended t by entering the Variable Value t be appended and the Separatr. Fr example, yu culd append the PATH Envirnment Variable with a new lcatin, specifying the separatr as a semi-cln. Delete Envirnment Variable Enter the Variable Name t be deleted frm managed endpints. A list f existing envirnment variables available n the cmputer n which the Envirnment Manager cnsle is running is displayed. These can be selected fr deletin. Set Sessin Variable Enter the VariableName and VariableValue t be used within the Envirnment Manager cnfiguratin. The Sessin variable is set n managed endpints with the value as entered. Delete Sessin Variable Enter the Sessin VariableName t be deleted frm use within the Envirnment Manager cnfiguratin. Sessin Variable Frmat Sessin variables are case insensitive and are referenced by enclsing rund brackets and a preceding $. Fr example: $(SessinVariable) Incrrectly frmatted sessin variables d nt expand. The table belw gives sme examples f successful and unsuccessful expansins. In these examples, the variable valid_variable has been set t SessinVariableValue. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 188 f 226

189 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Reference $(valid_variable) $(variable_des_nt_exist) Expansin SessinVariableValue $(variable_des_nt_exist) $() $() $n_brackets_defined $(missing_clsing_bracket $missing_pening_bracket) $(valid_variable) $(Valid_Variable) $(valid_variable) $(VALID_ VARIABLE) $(valid_variable$(valid_variable)) $(valid_variable)) $((valid_variable) $n_brackets_defined $(missing_clsing_bracket $missing_pening_bracket) SessinVariableValue $(valid_variable$(valid_ variable)) SessinVariableValue) $((valid_variable) Default Sessin Variables Envirnment Manager includes three in-built sessin variables: SessinID - The current Sessin ID UserSID - The user s Security Identifier UserTemp - The lcatin f user s Temprary Directry These can used in actins and cnditins and in particular, can be quickly added t custm scripts using the Insert functin. Sessin Variable Examples Using Sessin Variables in Plicy Actins In the example belw a sessin variable is used t map a drive when users pen Wrd. The sessin variable is set at lgn and is dependent n their Active Directry Organizatinal Unit (OU) membership. An If Else cnditin, run at lgn, checks the OU f a user and sets a UserGrup sessin variable relative t that grup. Fr example, if the user is a member f Sales, UserGrup sessin variable is set t sales. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 189 f 226

190 Envirnment Manager 10.1 FR1 Plicy Prduct Guide A Map Drive actin runs when a user pens Wrd mapping a drive t the fllwing lcatin: \\Dcs\$(UserGrup) The $(UserGrup) expands t the value set at lgn. Fr example, if the user is a member f Sales, the sessin variable will expand mapping the drive t: \\Dcs\Sales Using Sessin Variables in Custm Actins This example demnstrates hw sessin variables can be used in scripts with Envirnment Manager custm actins. Tw actins have been added t the Lgn > Pre-Desktp trigger - ne which sets tw sessin variables and the ther which maps a drive using thse variables. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 190 f 226

191 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Custm Actin The fllwing script in a Custm actin btains the user name frm the envirnment and sets tw sessin variables - $(first_letter) and $(first_tw_letters). $user = $env:username if ($user.length -gt 1) { $first_letter = $user[0] $first_bj = New-Object -CmObject "EmClient.SetValue" $first_bj.name = "first_letter" $first_bj.value = $first_letter $first_bj.apply("") $first_tw_letters = $user[0] + $user[1] $secnd_bj = New-Object -CmObject "EmClient.SetValue" $secnd_bj.name = "first_tw_letters" $secnd_bj.value = $first_tw_letters $secnd_bj.apply("") } Map File Actin The sessin variables set in the Custm actin are used in the Map Drive actin t map a drive fr each managed user: %SYSTEMDRIVE%\%SESSIONNAME%\$(first_letter)\$(first_tw_letters)\Hme Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 191 f 226

192 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Shrtcut Actins When triggered, these actins create shrtcuts n managed endpints. The shrtcuts can be thse that are created in Windws Explrer r thse that are pinned t the Windws Start menu r taskbar. Create a Shrtcut Actin 1. Cnfigure an actin t create a shrtcut n endpints. 2. In the Plicy Cnfiguratin navigatin tree, select r create a nde r cnditin. 3. In the Actins ribbn, select Shrtcut > Shrtcut Management t display the Shrtcut Management dialg. 4. Select whether the actin will Create r Delete a shrtcut frm endpints. 5. In the Shrtcut file path field, use the ellipsis t navigate t the required shrtcut r enter the path and filename. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 192 f 226

193 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 6. Select whether the shrtcut remains n managed endpints after lg ff. The default setting is Apply Permanently. Deselect this ptin t remve shrtcuts frm managed endpints at lgff. The fllwing fields are autmatically ppulated frm the Shrtcut file path but yu can edit them if required: Target - The lcatin f the prgram that the shrtcut accesses. Parameters - Define further parameters fr the target prgram. Fr example, the prgram culd be Micrsft Wrd. If yu enter a particular dcument in the target parameters, that dcument will pen in Wrd. Start in Directry - The wrking directry f the prgram. Run - Select whether the assciated prgram shuld pen, maximized, minimized, r using the default view. Cmment - The text that displays when yu hver ver the shrtcut icn. Icn Filename - The lcatin f the shrtcut icn. Icn - The icn used fr the shrtcut. 7. Click OK t save the actin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 193 f 226

194 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Imprt Multiple Shrtcuts 1. Imprt existing shrtcuts int the wizard t create multiple shrtcuts n managed endpints. 2. Select r create a nde r cnditin. 3. Frm the Actins ribbn, click Shrtcut > Imprt Shrtcut Wizard. 4. Click Add. 5. Select a shrtcut file (LNK frmat). The remaining fields are autmatically ppulated and yu can edit them as required. 6. Select whether the shrtcut remains n managed endpints after lgff. Shrtcuts created thugh Envirnment Manager are autmatically remved frm endpints at lgff unless yu select Apply Permanently. 7. Click Add t add mre shrtcuts. T remve shrtcuts, either select and click Remve r click Remve All. 8. Click OK. Each shrtcut listed creates an individual Create Shrtcut actin in the wrk area. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 194 f 226

195 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Create a Pinned Items Actin Pin r unpin applicatins t the Windws Start menu r taskbar n managed endpints. The actin cmpares the existing pinned items n endpints against the items that the actin is cnfigured t pin. 1. Select r create a nde r cnditin n the Pre-Desktp trigger. 2. On the Actins ribbn, select Shrtcut > Pinned Items Actin. 3. Enter the path, r navigate t, the executable fr the required applicatin. Shrtcuts with parameters cannt be pinned. Fr example, ntepad.exe can be pinned but ntepad.exe abc.txt cannt. Executables with switches cannt be pinned. Fr example, an applicatin with the /prefetch:# switch cannt be pinned. 4. Select whether t Pin r Unpin the applicatin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 195 f 226

196 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 5. Select whether the actin applies t the Start Menu r the Taskbar. 6. Click OK t save the actin. Shrtcut Management fr Raming Users As a user mves between managed endpints with different peratin systems and applicatins, sme cnfigured shrtcuts are nt valid fr all envirnments. When this happens, Envirnment Manager manages the fllwing temprarily invalid shrtcuts: Shrtcut r Link Standard shrtcuts in the Windws file system that pint t a target des nt exist Items pinned t the taskbar that pint t nnexistent paths Items pinned t the Start menu that pint t nnexistent paths Supprted Operating System All supprted perating systems All supprted perating systems Windws 7, Windws Server 2008 R2 Envirnment Manager either hides the temprarily invalid shrtcuts r - if pssible - reslves the links t pint t an equivalent path, such as when a user mves between 32-bit and 64-bit envirnments. If items pinned t the taskbar r Start menu are remved, the rder f the pinned items is retained. When a user returns t an envirnment where the shrtcuts are valid, the shrtcuts and pinned items - and the rder in which they are arranged - are restred. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 196 f 226

197 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Lgn/Lgff Message Cnfigure the text displayed when actins in the Lgn r Lgff triggers are running. Multiple messages can be cnfigured t display text specific t the related actins. In the example belw, the Lgn Message is displayed fr the duratin f the three child actins. Ndes culd be created fr related grups f actins with a Lgn/Lgff Message actin as the parent fr the actins within that nde. Fr example, yu culd put all Map Drive actins as children f a Lgn/Lgff Message t display the message Mapping Drives whilst the actins run. In anther nde, yu culd run all yur Sessin Variable actins whilst the message Setting Sessin Variables displays. Depending n the perating system and screen reslutin settings, lnger messages may be truncated n sme endpints. Fast Lgff Actin When triggered, users n managed endpints in Terminal Services envirnments can end sessins immediately whilst any remaining Envirnment Manager lgff actins run t cmpletin. Depending n the perating system, either the lgff screen r a blank screen is displayed n endpints whilst the lgff actins run. This actin can be added multiple times t the Lgff trigger with cnditins applied t target the actin as required. Fr example, yu culd set the actin nly t apply t specific endpints r user grups which wuld benefit frm Fast Lgff. Add the actin frm the Actins tab and enable by selecting the Enable Fast Lgff checkbx. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 197 f 226

198 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Self Heal Actins When triggered, the Self Heal actin restres envirnment items including files, prcesses, services and registry keys. Using Self Heal, cmputer and user settings can be restred t their riginal state in the event f sftware failure r when unauthrized changes have been made. The self healing mechanism restres settings in real-time. Fr example, if a Trjan virus is added t any f the Windws start up keys, Self Healing immediately remves the threat. Self Healing can be used t ensure critical applicatins, such as security sftware, are restarted r repaired immediately fllwing any failure resulting frm malicius r accidental actins and prvides security against the threat f malicius sftware attempting t infiltrate and alter registry settings r mdify cntent. Althugh the ptin t self heal the whle registry is available, it is resurce intensive and is likely t impact perfrmance. Therefre, when cnfiguring Self Healing Registry actins, it is recmmended that nly thse relevant sectins f the registry are cnfigured t be self healed. Targeting nly specific prtins f the registry reduces the resurce lad n the Envirnment Manager Agent during run-time. Self Heal is particularly useful fr healing imprtant prcesses, files, services and registry keys that are critical t the day-t-day running f the system. Care shuld be taken t ensure that critical items remain unaltered by the Self Heal functin. Cautin: Stability issues may arise if sftware patches r upgrades t areas f yur system which yu have chsen t self heal as Envirnment Manager autmatically self heals these changes and remves them. Currently nly 32-bit and 64-bit applicatins are fully supprted by the self healing prcess mechanism. It is nt recmmended t self heal DOS r 16-bit applicatins using this methd. Attempting t self heal a DOS r 16-bit applicatin prcess may present multiple instances f the same applicatin in a shrt perid f time. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 198 f 226

199 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Create a Self Heal Service Actin 1. In the Plicy Cnfiguratin navigatin tree, create a new nde r select an existing nde frm within the Cmputer trigger. The Self Heal Service actin is nly available fr Cmputer triggers. 2. In the Actins ribbn, select Self Heal > Self Heal Service t display the Self Heal Services dialg. 3. Click Add > Brwse Services t pen a Service Brwser listing the services n the lcal machine. The service list fr ther machines in the Active Directry can be selected if required. Services can be entered manually by selecting Add > Add Entry and cmpleting the fields with the service details. 4. Select the required service and click OK. Multiple applicatins can be selected using the Ctrl r Shift keys. The services are added t the Self Heal Service dialg bx. 5. Set the Status fr the service: 6. Click OK. Always running Never starts Each service creates an individual actin in the nde wrk area based n the status selected. Each actin can be edited by duble-clicking t pen the Self Heal Service dialg bx. Create a Self Heal Registry Actin 1. In the Plicy Cnfiguratin navigatin tree, create a new nde r select an existing nde. 2. In the Actins ribbn, select Self Heal > Self Heal Registry t display the Self Heal Registry dialg. 3. Select the ellipsis in the Main Key field t pen a registry brwser and select a registry key. The brwser defaults t the registry f the lcal machine. This can be changed t the registry f remte machines using the Cnnect buttn. 4. Click OK. 5. The Main Key, Sub Key and Value Name (if applicable) fields are autmatically ppulated. The fields can be cmpleted and edited manually if required. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 199 f 226

200 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 6. Select the behavir required fr the actin: Use default value - Select t maintain the default value fr the registry keys n managed endpints satisfying any assciated cnditins when triggered. This disables the Value Name field s it cannt be edited. Ensure the registry item remains unchanged OR Ensure the registry item never exists - The actin will nt allw changes t the registry item r nt allw it t be created. 7. Click OK t create the actin fr the registry key selected using the defined criteria. Create a Self Heal File Actin 1. In the Plicy Cnfiguratin navigatin tree, create a new nde r select an existing nde. 2. In the Actins ribbn, select Self Heal > Self Heal File t display the Self Heal Registry dialg. 3. Select the ellipsis (...) in the Filename field t pen a Windws brwser and select the required file. The file path and name can be entered manually if required. 4. Select the behavir required fr the actin: Make sure the file is always present - The actin ensures that the file exists when triggered n managed endpints which satisfy any assciated cnditins. Select the sub ptin Ensure the file is never changed t stp the file frm being mdified. Make sure the file is nt present - The actin will nt allw the file t be created. 5. Click OK t create the actin fr the file using the defined criteria. Create a Self Heal Prcess Actin 1. In the Plicy Cnfiguratin navigatin tree, create a new nde r select an existing nde. 2. In the Actins tab, select Self Heal > Self Heal Prcess t display the Self Heal Prcess dialg. 3. Select a prcess by navigating t the apprpriate executable using the ellipsis in either the Prcess Name r Prcess Directry fields. 4. In the Parameters field, enter any parameters, separated by spaces, which the service needs t run. Fr example, Auditing can take the name f a file in which it lgs data. This can be entered as fllws: -lg C:\Temp\MyLgFilename.txt. 5. Select the Run the prcess as SYSTEM user if required. This ptin is nly available fr actins in User triggers. 6. Click OK t save the actin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 200 f 226

201 Envirnment Manager 10.1 FR1 Plicy Prduct Guide DataNw Actin DataNw User Settings The DataNw User Settings actin allw user-level DataNw settings t be set and Sessin Variables t DataNw paths t be created. At lgn, if the user is lgged int the DataNw client, Envirnment Manager sets the $(DataNwHme) Sessin Variable t the user s DataNw directry appended with \Hme. If the map pint name fr the hme drive is nt Hme, an alternative map pint name can be specified within the DataNw User Settings actin. Further Sessin Variables can be set t DataNw paths, such as the Dcuments and Favrites directries. Envirnment Manager Actins and cnditins can be created easily using these Sessin Variables. Enable DataNw User Single Sign On 1. In the Plicy Cnfiguratin navigatin tree, create a new nde r select an existing nde frm within the Pre-Sessin r Pre-Desktp Lgn sub-triggers. 2. In the Actins ribbn, select DataNw > DataNw User Settings. The DataNw User Settings dialg displays. 3. Select Enable User Single Sign On t enable single sign n fr the user. Single Sign On must als be enabled fr the machine. Set Sessin Variables t DataNw Paths 1. In the Plicy Cnfiguratin navigatin tree, create a new nde r select an existing nde frm within the Pre-Sessin r Pre-Desktp Lgn sub-triggers. 2. In the Actins ribbn, select DataNw > DataNw User Settings. The DataNw User Settings dialg displays. 3. If the map pint name fr the hme drive is nt Hme, select Specify alternative map pint name used by $(DataNwHme) Sessin Variable and enter the map pint name. 4. T set further Sessin Variables t DataNw paths, click Add. The Select a DataNw Sessin Variable dialg displays. 5. Select ne r mre Sessin Variables t add t the actin. Multiple Sessin Variables can be selected using the Ctrl r Shift keys. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 201 f 226

202 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 6. Click OK t add the Sessin Variables. The selected Sessin Variables are added t the DataNw User Settings dialg. 7. If necessary, mdify the Value field t amend the path fr each Sessin Variable. 8. Click OK t create the actin. DataNw Custm Settings The DataNw Custm Settings actin allws DataNw behavir t be mdified fr all users. Envirnment Manager sets the specified endpint-level settings at cmputer startup and subsequently starts the DataNw service. The settings belw are available. Cautin: Setting values utside f the expected range may intrduce unexpected behavir in DataNw. Value Descriptin Unit Range Default DataNw Authenticatin > Enable Single Sign On Enable Single Sign On fr the machine. Single Sign On must be enabled fr the endpint and user. N/A Enabled r Disabled Disabled 3.0 and 3.5 Lgging > Circular Lgging Enable circular lgging. Lg files are written t %LOCALAPPDATA%\DataNwLgs. N/A Enabled r Disabled Disabled 3.0 and 3.5 Netwrking > Aut Thrttle Minimum Set the minimum limit fr DataNw thrttling. KBps Any psitive value and 3.5 Netwrking > Aut Thrttle Percentage Set the percentage f the estimated uplad pipe that DataNw uses. % 0 t and 3.5 Netwrking > Aut Thrttle Retest Interval Set hw frequently DataNw retests its available uplad thrttle. The thrttle is briefly remved during the test. ms Any psitive value 36,000, and 3.5 Netwrk > Advanced > HTTP Cnnectin Request Timeut Set the timeut value fr HTTP cnnectin requests. ms Any psitive value 60, and 3.5 Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 202 f 226

203 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Value Descriptin Unit Range Default DataNw Netwrk > Advanced > HTTP Name Reslutin Timeut Set the timeut fr HTTP name reslutin. ms Any psitive value and 3.5 Netwrk > Advanced > HTTP Receive Respnse Timeut Set the timeut fr receiving HTTP respnse t requests. ms Any psitive value 60, and 3.5 Netwrk > Advanced > HTTP Send Request Timeut Set the timeut fr HTTP send requests. ms Any psitive value 60, and 3.5 Sync > Disable Default File Exclusins Disable the default file exclusins. N/A Enabled r Disabled Enabled 3.0 and 3.5 Sync > Disable Default Flder Exclusins Disable the default flder exclusins. N/A Enabled r Disabled Enabled 3.0 and 3.5 Sync > Advanced > Cache Expiry Time Set the default cache expiry time fr a flder listing. ms Any psitive value 2, and 3.5 Sync > Advanced > Failed Uplad Retry Time Max Set the maximum time t wait befre retrying failed uplads. ms Any psitive value 20, and 3.5 Sync > Advanced > Failed Uplad Retry Time Min Set the minimum time after an uplad fails befre it is retried. The retry will nt ccur if the netwrk is unavailable. ms Any psitive value 5, and 3.5 Sync > Advanced > Set the map pint timeut befre it appears ffline. s Any psitive and 3.5 Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 203 f 226

204 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Value Descriptin Unit Range Default DataNw Offline Mapppint Timeut value Sync > Advanced > Recycle Server Side Deletins Set whether DataNw reflects server side changes by sending lcal files t the Recycle Bin. N/A Enabled r Disabled Disabled 3.0 and 3.5 Develper > Lgn Tken Wait Perid Set the time at lgn that DataNw waits fr the sessin tken. s Any psitive value and 3.5 Develper > Sessin Startup Wait Time Set the time that the service waits while trying t initialize a user after lgn. s Any psitive value and 3.5 Create a DataNw Custm Settings Actin 1. In the Plicy Cnfiguratin navigatin tree, create a new nde r select an existing nde frm within the Cmputer Startup trigger. The DataNw Custm Settings actin is nly available n the Cmputer Startup trigger. 2. In the Actins ribbn, select DataNw > DataNw Custm Settings. The DataNw Custm Settings dialg displays. 3. Click Add. The Select a DataNw Custm Setting dialg displays. 4. Select ne r mre custm settings t add and click OK. Multiple settings can be selected using the Ctrl r Shift keys. The selected settings are added t the DataNw Custm Settings dialg. 5. T set the value, deselect Use Default and enter a new value. Updated settings are displayed in bld. 6. Click OK t create the actin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 204 f 226

205 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Set Desktp Wallpaper 1. Set the backgrund t be displayed n user endpints. 2. In the Plicy Cnfiguratin navigatin tree, select r create a nde r cnditin. 3. In the Actins ribbn, select Set Desktp Wallpaper. 4. Enter a flder path and filename r click the ellipsis t select the required image. The fllwing file types are cmpatible with this actin: Bitmap (*.bmp *.dib *.rle) Jpeg (*.jpg *.jpeg *.jpe *.jfif) 5. Select hw the wallpaper is displayed: Center Fill Fit Span Stretch Tile 6. Select Cpy t t save the image n endpints and enter r navigate t the required lcatin. 7. Click OK t save the actin. Fr lcal Windws 7 users wh have the Windws theme set and have nt previusly lgged nt a client, the wallpaper set by this actin is verwritten by the Windws theme. This nly affects the initial lgn - fr all subsequent lgns, the wallpaper defined in this actin is applied. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 205 f 226

206 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Outlk Actins The Create Prfile and Create 365 Prfile actins use functinality and cnfiguratin tasks similar t thse invlved in cnfiguring Outlk Exchange Accunts using the Office Custmizatin Tl (OCT). Fr further infrmatin abut the OCT, see: Cnfigure a Create Prfile Actin This actin creates an Outlk mail prfile fr managed users and is primarily used fr n-premises Exchange accunts. T add this actin, select r create a nde r cnditin n a User trigger and select Outlk > Create Prfile frm the Actins ribbn. There are three main tabs t cnfigure: Prfile, Cached Mde and Outlk Anywhere. Prfile Cmplete the fllwing fields: Prfile Name - The display name fr the prfile n endpints, visible thrugh the Mail Prperties Cntrl Panel r thrugh Outlk when selecting a prfile frm startup. A prfile is nt created if ne f the same name exists n the endpint. Mailbx Name - The name f the Mailbx Accunt fr the given user. This is typically the username f the lgged n user and s is initially ppulated with the %USERNAME% envirnment variable as a placehlder. Exchange Server - The name f the cmputer running the Exchange server. Cnfigure any additinal mail bxes t which users require access. Click Add and enter the Display Name and Mailbx Distinguished Name fr the required mailbx. The Mailbx Distinguished Name lks up the LegacyExchangeDN attribute frm the users AD accunt. Repeat t add further mailbxes. Cached Mde Select Use Cached Exchange Mde and cnfigure the fllwing prperties: Dwnlad shared flders - Synchrnize shared mail and nn-mail flders. Dwnlad public flder favrites - Synchrnize public flder favrites. Path and filename f the Outlk data file - The lcatin f the ffline data file (OST) n endpints. This is ptinal and if left blank is saved t the default lcatin fr the perating system in the prfile. Directry path t stre Offline Address Bk files - The lcatin f the ffline address bk. This is ptinal and if left blank is saved t the default lcatin fr the perating system in the prfile. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 206 f 226

207 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Mail t keep ffline - The amunt f data that is saved ffline. Any mail lder than the selected perid is nt synchrnized. Outlk Anywhere Cnfigure the fllwing prperties: Cnfigure Outlk Anywhere - Enable users t cnnect with Outlk Anywhere. Use this URL t cnnect t my prxy server fr Exchange - The URL f the required Exchange server. Cnnect using SSL nly - Users can nly cnnect using Secured Sckets Layer (SSL). Mutually authenticate the sessin when cnnecting with SSL - The server and client must authenticate each ther befre a cnnectin can be made using SSL. Principal name fr the prxy server - The name f the prxy server t which clients cnnect. The principal name fr the prxy server must be prefixed with msstd:. Fr example, msstd:mail.cmpany.lcal. On fast netwrks, cnnect using HTTP first then cnnect using TCP/IP - On fast netwrks clients attempt t cnnect using HTTP. If this is unsuccessful, they attempt t cnnect using TCP/IP. On slw netwrks, cnnect using HTTP first then cnnect using TCP/IP - On slw netwrks clients attempt t cnnect using HTTP. If this is unsuccessful, they attempt t cnnect using TCP/IP. Use this authenticatin when cnnecting t the prxy server fr Exchange - Select the authenticatin type: Passwrd Authenticatin (NTLM) BasicPasswrd Authenticatin Cnfigure a Create 365 Prfile Actin This actin creates a mail prfile specifically fr cnnectin t Outlk 365 accunts. T add this actin, select r create a nde r cnditin n a User trigger and select Outlk > Create 365 Prfile frm the Actins ribbn. There are tw main tabs t cnfigure: Prfile and Cached Mde. Prfile Cmplete the fllwing fields: Prfile Name - The display name fr the prfile n endpints, visible thrugh the Mail Prperties Cntrl Panel r thrugh Outlk when selecting a prfile frm startup. A prfile is nt created if ne f the same name exists n the endpint. User - The address fr the given user. This field is blank by default which uses the autdiscver service t lk up dmain users' mail cnnectin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 207 f 226

208 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnfigure any additinal mail bxes t which users require access. Click Add and enter the Display Name and Mailbx Distinguished Name fr the required mailbx. The Mailbx Distinguished Name lks up the LegacyExchangeDN attribute frm the users AD accunt. Repeat t add further mailbxes. Cached Mde Select Use Cached Exchange Mde and cnfigure the fllwing prperties: Dwnlad shared flders - Synchrnize shared mail and nn-mail flders. Dwnlad public flder favrites - Synchrnize public flder favrites. Path and filename f the Outlk data file - The lcatin f the ffline data file (OST) n endpints. This is ptinal and if left blank is saved t the default lcatin fr the perating system in the prfile. Directry path t stre Offline Address Bk files - The lcatin f the ffline address bk. This is ptinal and if left blank is saved t the default lcatin fr the perating system in the prfile. Mail t keep ffline - The amunt f data that is saved ffline. Any mail lder than the selected perid is nt synchrnized. Cnfigure an Update Mailbxes Actin 1. This actin adds and deletes additinal mailbxes fr existing Outlk prfiles. 2. In the Plicy Cnfiguratin navigatin tree, select r create a nde r cnditin n a User trigger. 3. In the Actins ribbn, select Outlk > Update Mailbxes. 4. Enter the Prfile Name t be mdified. This is the display name fr the prfile n endpints, visible thrugh the Mail Prperties Cntrl Panel r thrugh Outlk when selecting a prfile frm startup. The cnfiguratin steps fr pening and remving mailbxes are the same. 5. Click Add. 6. Enter a Display Name and the Mailbx Distinguished Name fr the mailbx. The display name must be unique within the actin. If mre than ne mailbx has the same display name, nly the first will be added t the prfile. 7. Repeat steps 4 and 5 t cnfigure further mailbxes t add r remve. 8. Click OK t save the actin. When the actin is triggered, the selected prfile pens and the mailbxes specified are added r remved as cnfigured in the actin. If the entered prfile des nt exist the actin fails. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 208 f 226

209 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnfigure an Signature Actin Cnfigure an Outlk signature file fr managed users. 1. In the Plicy Cnfiguratin navigatin tree, select r create a nde r cnditin n a User trigger. 2. In the Actins ribbn, select Outlk > Signature. 3. Enter a Name t identify the signature. 4. Cnfigure the text fr the signature. Yu can cnfigure different signatures fr New Messages and Replies and Frwards r select Als use this signature fr replies and frwarding t use the same message fr all. 5. Click OK t save the actin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 209 f 226

210 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Tls and Wizards Plicy Templates Plicy Templates enable partial cnfiguratins, saved as XML files, t be exprted and imprted t ther cnfiguratins. Rather than exprt an entire cnfiguratin, Plicy Templates enable them t be brken dwn by trigger r individual nde and used as required. Exprting at trigger level saves all the ndes in that trigger and when imprted, each f thse ndes is added t the selected trigger. Any nde r the cntents f any trigger can be exprted and imprted. A reusable nde imprted int a trigger is als created in the Reusable Ndes Library. Similarly, any reusable cnditin imprted as part f a nde, is created in the Reusable Cnditins Library. Templates created at trigger level can be imprted t a nde and t reusable ndes. Sme cnditins and actins are nt cmpatible with all triggers but can still be imprted int thse triggers. In these cases, althugh added t the trigger, the cnditin r actin will nt functin. On imprt, a message bx displays shwing the path f the incmpatible actin r cnditin. Exprt a Plicy Template 1. In the Plicy Cnfiguratin navigatin tree, select the nde r trigger frm which yu want t create a template. 2. In the Tls & Wizards ribbn, select AppSense Plicy Template > Exprt Template. A brwser dialg displays. 3. Navigate t a lcatin t save the template. 4. Click Save. The template is saved in the selected lcatin and can be imprted int the Envirnment Manager cnsle. Imprt a Plicy Template 1. In the Plicy Cnfiguratin navigatin tree, select a nde r trigger t which yu want t add the partial cnfiguratin. 2. In the Tls & Wizards ribbn, select AppSense Plicy Template > Imprt Template. A brwser dialg displays. 3. Navigate t, and select the XML template file. 4. Click Open. The ndes in the template are added t the selected trigger r nde. Any reusable ndes and/r reusable cnditins created as part f the imprt are added t the apprpriate reusable Library. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 210 f 226

211 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnfiguratin Prfiler The Cnfiguratin Prfiler allws reprts t be created which interrgate the lcal laded cnfiguratin in the cnsle. General reprts can be prduced which deliver a cmprehensive recrd f the whle cnfiguratin, prviding full details f each actin and cnditin. Reprts can als be created which are refined based n cnditin values. Fr example, a reprt culd be run shwing all the areas f the cnfiguratin which relate t a particular user grup. Once created, reprts can be manipulated t change display attributes, such as page rientatin and watermarks. Reprts can als be utput fr PDF, image and frmats. Create a Cnfiguratin Prfiler Reprt 1. Select the Plicy Cnfiguratin navigatin buttn. 2. In the Tls & Wizards tab, select Cnfiguratin Prfiler t display the Cnfiguratin Prfiler dialg. 3. Select the required reprt type by selecting the apprpriate radi buttn: Cmplete Reprt (g t step 6) Reprt based n specific criteria 4. Frm the Reprt Criteria list, click the Enter value t match field fr the required criteria. 5. Enter a value fr the criterin t reprt n. Fr example, entering a value f "Users1" fr the Cmputer Grup criteria prduces a reprt cntaining nly thse elements with a reference t the Users1 cmputer grup. 6. Repeat steps 3 and 4 t add further criteria. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 211 f 226

212 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 7. Using the Create indented reprt checkbx, chse a reprt display. If selected, the layut f the reprt is based upn the Plicy Cnfiguratin navigatin tree. Each nde, cnditin and actin is at the same hierarchical level as in the navigatin tree. If nt selected, the reprt is flat with all items at the same level. The psitin in the hierarchy is shwn by a preceding blue number; level 1 being tp f the hierarchy. 8. Click OK t run the reprt. 9. The reprt is generated and displayed in a dcument viewer within Envirnment Manager. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 212 f 226

213 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 10. Within the dcument viewer, the fllwing ptins are available: Search - Find specific text within the reprt Save - Saves the reprt in a PRNX file Print - Send the reprt t a printer Page Setup - Define the margins and rientatin f the reprt Clr - Change the clr f the reprt backgrund Watermark - Define and add a watermark t the reprt Exprt Dcument - Save the reprt as a PDF dcument r as an image file Send via - Save the reprts as a PDF r image file and attach t an Grup SID Refresh The Grup SID Refresh ptin allws yu t replace grup and user dmain names in a cnfiguratin and refresh Security Identifier (SID) values in membership cnditins. This is useful when wrking acrss multiple envirnments where the SIDs are f different values. Fr example, if yu have been wrking in a test envirnment and want t mve t a live envirnment, the SID values in each envirnment will be different. Using the Grup SID Refresh functin, the SIDs in the cnfiguratin can be quickly updated t match thse in the live envirnment. In additin t refreshing the SIDs, user and grup dmain names can be replaced in the cnfiguratin s they are crrect fr the live envirnment. Refresh SIDs 1. Select the Plicy Cnfiguratin navigatin buttn. 2. In the Tls & Wizards tab, select Grup SID Refresh. 3. In the Find what field, enter a dmain name r grup query string. 4. Select the Update SID nly checkbx as required: 5. Click OK. If selected, the SIDs in relevant cnditins are updated in the cnfiguratin If nt selected the Replace with field is enabled. In additin t the SIDs being refreshed, dmain names are changed t the value specified. Find ptins can be set fr matching case and whle wrds. The SIDs fr any matching dmain are updated in the cnfiguratin Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 213 f 226

214 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Example - Update SID Only Example - Replace Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 214 f 226

215 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Lckdwn Management Lckdwn is a mechanism t restrict r disable access t applicatin and perating system functinality, keybard shrtcuts and Micrsft Office applicatin menus, tlbars and ribbns. By applying cnditins t triggers, user actins and applicatin usage can be cntrlled. Fr example: Prevent users deleting brwsing histry using Internet Explrer Settings Stp users frm changing netwrk settings Lckdwn shrtcut keys, such as Print Screen Lckdwn actins can nly be applied t ndes within User triggers and are nt available fr Cmputer triggers. Using a cmbinatin f settings an verall plicy f cmputer usage within an rganizatin can be defined t ensure cmputers are used apprpriately and systems are nt cmprmised. The functinality is accessed frm the Tls & Wizards ribbn r frm the wrk area shrtcut menu. Create a Lckdwn Using the General Wizard 1. Open the applicatin which yu want t lckdwn and navigate t the item yu want t blck. Fr example, t lckdwn the security ptins in Internet Explrer, pen the Internet Optins dialg. 2. In the Envirnment Manager cnsle, select the Plicy Cnfiguratin navigatin buttn. 3. In ne f the User triggers, create a new nde r select an existing nde t which yu want t add the lckdwn actin. 4. In the Tls & Wizards ribbn Lckdwn grup, select General Wizard. 5. In the General tab, enter a name and ptinal descriptin fr the lckdwn. 6. In the Lckdwn tab click and hld the Spy Tl buttn. The Envirnment Manager cnsle is minimized expsing the pen applicatin. 7. Drag the cursr nt the cntrl in the applicatin requiring lckdwn. A red brder indicates the cntrl selected and the available lckdwn ptins are displayed. 8. Release the muse buttn t select. Cntrl returns t the Envirnment Manager cnsle, enabling ptins fr the lckdwn t be defined. When the cnfiguratin is deplyed t users, the lckdwn is applied. There are different cntrl types fr lckdwn relating t varius applicatin and perating system functinality. Each cntrl type has different characteristics and settings. See General Wizard. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 215 f 226

216 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cnfigure an Edit r Cmb Bx Cntrl Lckdwn 1. Use the Spy Tl in the General Wizard t select an Edit r Cmb Bx cntrl. 2. Select edit cntrl filtered. 3. In the General tab f the Edit Cntrl dialg bx, give the lckdwn a Descriptin and add any ptinal Ntes. 4. Select the Lckdwn tab. 5. Select a message which will display when the lckdwn is breached. Existing messages can be added frm the drp-dwn list r new messages created by clicking the ellipsis (...). 6. Click Add t cnfigure blck text libraries. 7. Click OK t save. T set up Blck Text and Blcked Message libraries, see Message Libraries. Keybard Wizard The Keybard Wizard prevents keys r a cmbinatin f keys, being used n the keybards f managed cmputers. The keys can be lcked dwn acrss the whle cmputer r restricted t certain applicatins. 1. Select the Plicy Cnfiguratin navigatin buttn. 2. In ne f the User ndes, create a new nde r select an existing nde t which yu want t add the lckdwn. 3. In the Tls & Wizards ribbn Lckdwn grup, select Keybard Wizard. 4. The Keybard Lckdwn dialg displays. 5. Cnfigure the fllwing infrmatin: 6. Click OK. The key r cmbinatin f keys t be lcked dwn - with the cursr in the first field, press the key r cmbinatin f keys t be lcked dwn. Define whether left and right versins f the same key are treated independently - select the checkbx t identify the keys separately. Fr example, Left Ctrl and Right Ctrl. Select a radi buttn t cntrl whether the lckdwn shuld apply t All Applicatins r a Selected Applicatin. Use the ellipsis (...) t brwse t the applicatin r drag-anddrp the spy tl nt the required applicatin. The key r key cmbinatin is disabled as defined nce the cnfiguratin is saved and deplyed. Office Wizard The Office Wizard is used t lckdwn specific Micrsft Office functins. Tlbar, menu and ribbn items can be disabled in Micrsft Office applicatins. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 216 f 226

217 Envirnment Manager 10.1 FR1 Plicy Prduct Guide 1. Select the Plicy Cnfiguratin navigatin buttn. 2. In ne f the User ndes, create a new nde r select an existing nde t which yu want t add the lckdwn. 3. In the Tls & Wizards ribbn Lckdwn grup, select Office Wizard. 4. Click Next in the Welcme screen. All supprted, installed Micrsft Office applicatins are listed. 5. Select the applicatin yu want t lckdwn and click Next t pen the applicatin and display a list f all menu ptins. 6. Select the menu items yu want t disable. Use the search facility t find specific items. 7. Click Next t display a list f Tlbar r Ribbn items. 8. Select the Tlbar r Ribbn ptins which yu want t disable. A search facility is available t find specific ptins. 9. Once all Menu and Tlbar r Ribbn items fr lckdwn have been selected, click Next. The Summary screen displays details f the number f cntrls selected fr lckdwn. 10. Select the D nt apply lckdwn settings permanently checkbx as required. Lckdwn General Wizard The General Wizard allws yu t blck r remve Windws bjects in the perating system and applicatin interfaces. The wizard uses a drag-and-drp Spy tl t identify bjects fr lckdwn. The Envirnment Manager agent blcks r remves cntrls based n the basic attributes f standard windw cntrls Cntrl Prcess Name Cntrl Text Parent Text Cntrl ID Descriptin The executable fr the applicatin t which the lckdwn relates. The text displayed by a Windws cntrl, where relevant. Fr example, if yu are lcking dwn a buttn, the cntrl text will be whatever is written n that buttn. Fr example, the cntrl text fr a Save as buttn will be Save as. Fr checkbxes, the cntrl text is the assciated label. The text assciated with the parent windw f the Windws cntrl and appears in the header text f a dialg bx. If yu are lcking dwn the OK buttn in a Fnt dialg bx, the parent text will be Fnt. The ID assigned and used t identify a Windws cntrl. The ID is cmmn between applicatins. Fr example, the Cancel buttn in the Save as dialg in Micrsft Wrd has a Cntrl ID f 2, as des the same buttn in the Save as dialg bx f Applicatin Cntrl. The Cancel buttn in the Print dialg bx in Ntepad als has a Cntrl ID f 2. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 217 f 226

218 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Cntrl Class Name MSAA Type Windw Style Descriptin The specific type r class t which a Windws cntrl belngs, class such as Edit, Buttn r SysListView32. Applicatin r perating system element types used fr Micrsft Active Accessibility. Each element type has a name and numerical identifier. Fr example, Scrll Bar (3) and Radi Buttn (45). The Micrsft Windws Style reference number fr the bject. As with the Cntrl ID, this reference is cmmn t the same bjects in different applicatins. When a cntrl has been selected using the Spy tl, the cntrls are displayed in the General Wizard dialg bx. The Windw Cntrls captured depend n the cntrl r type f cntrl selected. There are different cntrl types fr lckdwn relating t varius applicatin and perating system functinality, fr example, Tree Cntrl and Windw Cntrl. Each cntrl type has different characteristics and settings. Sme applicatins, such as Adbe Reader, use custm cntrls which might nt be recgnized by the Spy tl. These cntrls cannt be lcked dwn by Envirnment Manager. Tree Cntrl Relates t hierarchical structures such as the flder structure in Windws Explrer Advanced Internet Optins. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 218 f 226

219 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Tw methds f lckdwn can be applied: Tree items remved - A dialg bx lists each nde in the tree. By selecting the apprpriate checkbx, ndes are remved frm the tree in the applicatin, when the cnfiguratin is deplyed. Remving sme list items can cause undefined behavir in applicatins. Ensure that any item remved des nt disable functinality which is vital t the running f the applicatin. Windw cntrl hidden - The entire windw cntrl cntaining the tree is remved frm view. Dialg Bx Relates t windws which pen separate t the applicatin such as the Insert Object dialg bx in WrdPad. When the dialg hidden lckdwn is applied, the dialg des nt display. The relating menu ptin appears but its use is redundant. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 219 f 226

220 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Edit Cntrl Relates t fields in which text can be entered such as the Search field in help systems. Whle fields can be lcked-dwn r individual wrds can be prhibited and/r replaced with apprpriate infrmatin messages displayed t users. Tw methds f lckdwn can be applied: Edit cntrl filtered - Blck r replace specified wrds and phrases and define warning bx cntent Windw cntrl hidden - The whle field is remved frm view List Cntrl Relates t any list f items such as Internet Explrer Security Settings r a list f files and flders in the main windw f Windws Explrer. List cntrl als relates t the Desktp enabling icns t be lcked dwn. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 220 f 226

221 Envirnment Manager 10.1 FR1 Plicy Prduct Guide List items remved - A dialg lists each item in the list. By selecting the apprpriate checkbx, ndes are remved frm the tree in the applicatin. Remving sme list items can cause undefined behavir in applicatins. Ensure that any item remved des nt disable functinality which is vital t the running f the applicatin. Windw cntrl hidden - The entire windw cntrl cntaining the list is remved frm view. Cmb Bx Cntrl Relates t list bxes which allw text t be entered t assist navigatin. Fr example the Fnt cmb bx in Ntepad. Enter text in the field and the list autmatically displays fnts matching the entered text. Edit cntrl filtered - Blck r replace specified wrds and phrases and define warning bx cntent. List items remved - A dialg lists each item in the cmb bx. By selecting the apprpriate checkbx, items are remved frm the bx in the applicatin. Remving sme list items can cause undefined behavir in applicatins. Ensure that any item remved des nt disable functinality which is vital t the running f the applicatin. Windw cntrl hidden - The entire cmb bx cntrl is remved frm view. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 221 f 226

222 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Menu Cntrl Relates t applicatin menus such as File, Edit and View. Drag the cursr nt a specific menu r highlight the menu bar t select all menus. A dialg bx lists each menu selected and their available ptins. Lckdwn an entire menu r select individual menu ptins. Menus and ptin are displayed but d nt functin. Tlbar Cntrl Relates t tlbars and tlbar ptins in applicatins such as any f the selected tlbars in Internet Explrer r the Back buttn. A dialg bx lists each ptin r icn in the tlbar. The whle tlbar can be lcked dwn r individual ptins disabled. Lcked dwn ptins are visible but d nt functin. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 222 f 226

223 Envirnment Manager 10.1 FR1 Plicy Prduct Guide Windw Cntrl Relates t Windws elements such as buttns, check bxes and radi buttns. Windw Cntrl can als be applied t static items such as text and icns. Applying the windw cntrl hidden lckdwn t an element f a windw, remves the ptin entirely. In the screen graphic abve, when the cnfiguratin is saved and deplyed, the Enable buttn will nt appear. MSAA Cntrl Relates t Micrsft Active Accessibility (MSAA) technlgy which is designed t help Assistive Technlgy prducts interact with standard and custm user interface elements f an applicatin. This cntrl lcks dwn varius applicatin elements such as hyper links and Windws maximize and minimize buttns. MSAA cntrl disabled items are disabled but still visible t the user. Cpyright 2017, Ivanti. All Rights Reserved. Terms f Use. Page 223 f 226