Personalization Product Guide. Version 10.1 FR1

Transcription

1 Persnalizatin Prduct Guide Versin 10.1 FR1

2 Cpyright Ntice This dcument cntains the cnfidential infrmatin and/r prprietary prperty f Ivanti, Inc. and its affiliates (referred t cllectively as Ivanti ), and may nt be disclsed r cpied withut prir written cnsent f Ivanti. Ivanti retains the right t make changes t this dcument r related prduct specificatins and descriptins, at any time, withut ntice. Ivanti makes n warranty fr the use f this dcument and assumes n respnsibility fr any errrs that can appear in the dcument nr des it make a cmmitment t update the infrmatin cntained herein. Fr the mst current prduct infrmatin, please visit Cpyright , Ivanti. All rights reserved. Ivanti and its lgs are registered trademarks r trademarks f Ivanti, Inc. and its affiliates in the United States and/r ther cuntries. Other brands and names may be claimed as the prperty f thers. Page 2 f 147

3 Table f Cntents Persnalizatin Prduct Guide 1 Cpyright Ntice 2 Table f Cntents 3 Abut Envirnment Manager 5 What's New in Envirnment Manager? 5 Licensing 6 Architecture 9 Cnsle 11 Envirnment Manager Administrative Tls 18 Service Packs 19 Best Practices fr Cnfiguratin 20 Wildcards and Regular Expressins 25 Perfrmance Mnitr Cunters 26 Abut User Persnalizatin 30 Designing and Implementing Envirnment Manager Persnalizatin 31 User Persnalizatin Architecture 32 Cnfigure Persnalizatin Servers 38 Persnalizatin Servers Plicy 46 Cnfigure a Persnalizatin Servers List 46 Persnalizatin Grups 48 Add a Persnalizatin Grup 48 Create Grup Persnalizatin Membership Rules 48 Persnalizatin Grup Arrangement 50 Persnalizatin Grup Settings 51 Persnalizatin Grup Membership Rules 55 Applicatin Persnalizatin fr Persnalizatin Grups 59 Windws Persnalizatin and Persnalizatin Grups 66 Prfile Migratin 66 Excluded Users 73 Endpint Self-Service Tl 74 Applicatin Persnalizatin 78 Applicatin Prcessing Rules 78 Applicatin Grups 78 Applicatins 85 Inclusins and Exclusins 90 Applicatin Data Cllectin 100 Add New Applicatins 100 Add Inclusins 100 Windws Persnalizatin 101 Windws Settings Grups 101 Custm Windws Settings 106 Default Windws Settings Grups 107 Sites 111 Page 3 f 147

4 Add a Persnalizatin Site 111 Envirnment Manager Sites Hierarchy 111 Envirnment Manager Site Membership Rules 112 Envirnment Manager Site Cnditins 114 Servers and Virtual Hsts 115 Persnalizatin Tls 117 Synchrnize Site Databases 117 Imprt and Exprt Persnalizatin Cnfiguratins 117 Glbal Optins 122 Access Rights 122 Advanced Settings 124 Applicatin Exclusins 131 Data Cllectin Settings 131 Persnalizatin Analysis 134 Generate a Persnalizatin Analysis Reprt 134 Persnalizatin Analysis and Windws Settings 135 Size and Usage Reprts 135 Archive Reprts 140 Envirnment Manager Supprt Cnsle 143 Supprt Cnsle Functinality 143 Streamed Applicatins 144 Citrix XenApp 144 Symantec Virtualizatin 146 Supprt fr Citrix Offline Plug-in Page 4 f 147

5 Abut Envirnment Manager Envirnment Manager prvides n-demand persnalizatin f user desktps n-demand and helps prtect endpints with fine-grained cntextual plicy cntrl. Envirnment Manager Persnalizatin prvides: Fast lgn times A fully persnalized desktp experience, regardless f lcatin r device A secure desktp envirnment that adapts based n user cntext Use Envirnment Manager Plicy t: Enfrce plicy real-time thrughut the user sessin, nt just at lgin Help meet crprate and industry-based cmpliance mandates such as HIPAA, FINRA, and PCI Run multiple plicies in parallel fr the best pssible user experience. What's New in Envirnment Manager? Versin 10.1 FR1 Cnsle Rebrand and Renaming The Envirnment Manager Cnsle has been updated t reflect the new cmpany name f Ivanti - see here fr mre details. Yu may still see the AppSense Envirnment Manager name used in certain areas, such as the registry r services. This is t make the transitin as least disruptive as pssible fr existing. Icn Refresh Having made significant changes t the design f the DesktpNw cnsles in versin 10, we have listened t feedback and added a splash f clr back int the cnsles by refreshing and updating sme f the icns used in the Envirnment Manager cnsle. SQL Mirrring Supprt Supprt fr SQL Mirrring has been re-instated fr 10.1 FR1 release - it was nt available in 10.0/10.1. Our best practice fr this use case is t utilize SQL Always On. This allws adequate time t make the transitin t ur best practice. Fr mre infrmatin, see the DesktpNw help. Page 5 f 147

6 Licensing DesktpNw Licensing cnsle allws yu t manage DesktpNw prduct licenses. The Licensing cnsle allws yu t: Manage licenses fr single prducts, the DesktpNw Suite and Evaluatin licenses. Exprt license packages t MSI r LIC file frmat fr saving t the Management Center r ther cmputers which can be remtely accessed. Imprt and manage licenses frm LIC file frmat. Fr infrmatin abut license deplyment t endpints, see Management Center Help. Managing Licenses License details are included in the License Agreement which is issued when an rder fr ther sftware has been cmpleted. The License Agreement includes the fllwing infrmatin: Prduct, Feature, and Versin Details Issue Date Expiry Date Custmer Name Serial ID Tgether with the license agreement yu will receive either a TXT file r a LIC file. Use these in the Licensing Cnsle t add r imprt the license. Add a License 1. Open the Licensing cnsle. 2. Click Add. The Add License Key dialg displays. 3. Enter the License Key and click Add. If yu received a TXT file license, pen the file and cpy the license key, paste it in t the Add License Key dialg. If yu received a LIC file license, refer t "Imprt License Files" n page 8. Details f the license are displayed in the cnsle and the license key is added t the fllwing lcatin: %ALLUSERSPROFILE%\AppSense\Licenses Page 6 f 147

7 Activate a License Once added, sme licenses require activating. 1. Select a license r add ne t the licensing cnsle. 2. Click Activate. 3. Type r cpy and paste the activatin cde. 4. Press Enter t accept the cde. The license cnsle saves the license key t the MS Windws registry n the lcal machine. The License Status field updates t shw the status f the license and the license details display in the lwer part f the cnsle. T check that the license is active n yur endpint, search the registry fr the license cde. If the search finds the cde, then the license is active. Remve a License 1. Highlight the required license and click Remve. A cnfirmatin dialg displays. 2. Click Yes t cnfirm. The selected license is deleted and remved frm the cnsle and the MS Windws registry r %ALLUSERSPROFILE%\AppSense\Licenses lcatin, whichever is applicable t the license type. Exprt License Files Exprt licenses t an MSI r LIC file t create a backup and enable distributin t ther endpints using the Licensing cnsle r the Management Center. 1. Highlight the license yu want t exprt. 2. Click Exprt t display Windws Save As dialg. 3. Brwse t the required lcatin t save the license file. 4. Enter a name fr the file. 5. Select the file type: MSI r LIC. 6. Click Save. A file is created and saved in the selected lcatin. This file can be cpied t any netwrk lcatin and laded via the DesktpNw Suite Licensing cnsle r in the Management Center cnsle. Page 7 f 147

8 Imprt License Files Imprt a previusly exprted license t an endpint using the Licensing cnsle. 1. Open the Licensing cnsle. 2. Click Imprt t display the Windws Open dialg. 3. Navigate t the required LIC file. 4. Click Open. Details f the license are displayed in the cnsle and the license key is added t the fllwing lcatin: %ALLUSERSPROFILE%\AppSense\Licenses Trubleshting I received a license, what d I d? If yu have received a prduct license yu can lad the license by launching the DesktpNw Suite Licensing Cnsle n yur client cmputer and entering the license cde. I have entered a license, but it says it is nt activated, why? Sme licenses require activatin befre they can be used. Activatin cdes are prvided by Ivanti. Activate a license by entering the License and Activatin cdes int the cnsle. Page 8 f 147

9 Architecture The Envirnment Manager system cnsists f the Envirnment Manager Cnsle, Envirnment Manager Agent, Persnalizatin Server and Database. The cnsle is an administrative tl t create and manage cnfiguratins. The agent resides n the cntrlled cmputers and can receive cnfiguratins frm the Management Center r third party deplyment system t manage the machine and user envirnment. The cnsle als prvides a live cnnectin t the Persnalizatin Database. The Persnalizatin Server runs as a website, using IIS n either Windws Server 2003 r Client machines (Tier 1) cnnect thrugh HTTP(s) handlers, and the Cnsle uses WCF Services. The Persnalizatin Server acts as a brker between the Client and Database, prviding a secure channel t read and write the Persnalizatin data. It is designed t supprt thusands f users simultaneusly and multiple Persnalizatin Servers can be cnfigured in parallel t use a single Database. Envirnment Manager can perate either in Standalne r Enterprise mde. In Standalne mde, the cnsle saves its settings directly t the lcal system. In Enterprise mde, different cnfiguratins can be deplyed t the cntrlled cmputers depending n yur system requirements. This help describes the use f Envirnment Manager in Standalne mde. Fr details n centralized management mde please refer t the Management Center Help system. Page 9 f 147

10 Plicy Cnfiguratin and User Persnalizatin wrk tgether t prvide cmplementary cntrl f the entire user envirnment. Inevitably there are sme areas f verlap. The prfile settings are applied in the fllwing stages: Default Settings - Plicy Cnfiguratin Usually ccur thrugh the use f mandatry prfiles, althugh Plicy Cnfiguratin is free t set anything at this stage. Virtual Settings - User Persnalizatin User specific changes t their wn persnality settings that are being managed by User Persnalizatin. These are applied n tp f the defaults. Enfrced Settings - Plicy Cnfiguratin Any plicies that the administratr wants t set regardless f hw the user has changed their applicatin previusly, s these are applied last. The user may be free t change these whilst the applicatin is running, but they will be reapplied the next time the applicatin runs. Page 10 f 147

11 Cnsle The Envirnment Manager Cnsle launches frm the start menu: Start > All Prgrams > AppSense > Envirnment Manager > Envirnment Manager Cnsle. When accessed in this way the cnsle pens with an empty and untitled cnfiguratin. The cnsle als starts when a saved cnfiguratin is pened. There are three variants f the Envirnment Manager cnsle: Persnalizatin - Installs nly the persnalizatin element f Envirnment Manager Plicy - Installs nly the plicy element f Envirnment Manager Bth cnsles - Installs the cmbined cnsle; bth persnalizatin and plicy are installed. The chice f which cnsle t install is made during installatin. Elements Reslutin Recmmended screen reslutin fr the cnsle is 1024 x 768 pixels. Page 11 f 147

12 Installing the Cnsles The traditinal Envirnment Manager installatin, using Setup.exe, autmatically installs the cmbined cnsle. Sme administratrs may nt require access t bth. Fr example, they may nly be respnsible fr cnfiguring persnalizatin and have n need fr the plicy side f the cnsle. Installing the Persnalizatin r Plicy cnsles can nly be dne using the EnvirnmentManagerCnsle MSIs. Fr mre infrmatin abut installatin, see the DesktpNw help. Ribbns Ribbns include buttns fr perfrming actins, arranged in grups, accrding t the area f the cnsle t which the actins relate. Fr example, the Edit ribbn page includes all cmmn tasks, such as Cut, Cpy and Paste. Split ribbn buttns cntain multiple ptins and are indicated by an arrw just belw the buttn. Click the arrw t display and select the list f ptins, r simply click the buttn fr the default actin. Help The Help buttn n the Help ribbn launches the Help fr the prduct and displays the tpic relating t the current area f the cnsle in view. A smaller icn fr launching the Help displays at the far right f the cnsle, level with the ribbn page tabs. Navigatin Pane The Navigatinpane cnsists f the navigatin tree and navigatin buttns. The navigatin tree is the area fr managing ndes f the cnfiguratin. The navigatin buttns allw yu t view the different areas f the cnsle, i.e. the Plicy Cnfiguratin and User Persnalizatin. Wrk Area The Wrk Area prvides the main area fr managing the settings f the cnfiguratin and prduct. The cntents f the wrk area vary accrding t the selected ndes in the navigatin tree and the selected navigatin buttns. Smetimes the wrk area is split int tw panes. Fr example, ne pane can prvide a summary f the settings in the ther pane. Additinal Cnsle Features Shrtcut Menu right-click shrtcuts are available in the navigatin tree and sme areas f the cnsle. Drag and Drp this feature is available in sme ndes f the navigatin tree. Cut/Cpy/Paste these actins can be perfrmed using the buttns in the Edit ribbn, shrtcut menu ptins and als using keybard shrtcuts. Page 12 f 147

13 File Menu The File menu prvides ptins fr managing cnfiguratins including create new, pen existing, save, imprt and exprt cnfiguratins and print. Optin New Open Descriptin Creates a new default cnfiguratin which is lcked fr editing. Opens an existing cnfiguratin frm ne f the fllwing lcatins: Live cnfiguratin n this cmputer Cnfiguratin frm the Management Center Cnfiguratin file frm disk: AppSense Envirnment Manager Package Files frmat (AEMP). Cnfiguratin frm System Center Cnfiguratin Manager A live cnfiguratin is lcated n a cmputer which has Envirnment Manager Agent installed and running. Save Updates the current cnfiguratin with any changes made since the last change. Click the arrw by the icn t access the fllwing Management Center Specific ptins: Save and Cntinue Editing - Save the cnfiguratin and keep it lcked and pen fr editing. The cnfiguratin cannt be deplyed whilst lcked. Use t save yur changes whilst cntinuing t update the cnfiguratin. Save and Unlck - Save the cnfiguratin and unlck it ready fr deplyment. Unlck withut saving - Unlck the cnfiguratin withut saving changes. A live cnfiguratin is lcated n a cmputer which has Envirnment Manager Agent installed and running. Save As Saves the cnfiguratin with a new name t ne f the fllwing lcatins: Live cnfiguratin n this cmputer - Save the current cnfiguratin n the current cmputer and apply it as the wrking cnfiguratin. Cnfiguratin in the Management Center - Creates the current cnfiguratin in the package stre n the selected Management Center. Cnfiguratin in System Center Cnfiguratin Manager - Saves yur cnfiguratin t the specified System Center Cnfiguratin Manager server. Cnfiguratin file n disk - Saves the current cnfiguratin as a file n a lcal r netwrk drive in AEMP frmat. Page 13 f 147

14 Optin Imprt & Exprt Descriptin Imprt cnfiguratin frm MSI - Imprts a cnfiguratin frm an existing MSI package, fr example, legacy cnfiguratins which have been exprted and saved frm legacy cnsles. Exprt Cnfiguratin as MSI - Exprts the current cnfiguratin as a MSI package. Exit Clses the cnsle. Yu are prmpted t save any changes yu have made t the current cnfiguratin. Quick Access Tlbar The Quick Accesstlbar prvides quick functinality fr managing the cnfiguratin setup, such as Save, Save and Unlck, Und, Red, and navigatin t previusly and next displayed views. Buttn Descriptin New Opens a new, empty default cnfiguratin which is lcked fr editing. If yu already have a cnfiguratin pen, yu will be prmpted t save it befre yu pen a new ne. Open Cnfiguratin frm the Management Center Opens an existing cnfiguratin frm the Management Center. Save Saves changes t the cnfiguratin. The cnfiguratin will remain lcked if pened frm the Management Center. Save and Unlck Saves the cnfiguratin t the Management Center and unlcks it t allw deplyment. The current cnfiguratin clses and a new default cnfiguratin pens. Save As Saves the cnfiguratin with a new name t ne f the fllwing lcatins: Live cnfiguratin n this cmputer - Save the current cnfiguratin n the current cmputer and apply it as the wrking cnfiguratin. Cnfiguratin in the Management Center - Creates the current cnfiguratin in the package stre n the selected Management Center. Cnfiguratin in System Center Cnfiguratin Manager - Saves yur cnfiguratin t the specified System Center Cnfiguratin Manager server. Page 14 f 147

15 Buttn Descriptin Cnfiguratin file n disk - Saves the current cnfiguratin as a file n a lcal r netwrk drive in AEMP frmat. Back and Frward Cycle thrugh the views yu have visited in a sessin. Fr example, if yu select the Cmputer trigger and then the User trigger, the Back buttn takes yu t the Cmputer trigger and a subsequent click f the frward buttn, takes yu t the User trigger. These are navigatin tls nly and d nt affect the actin yu have perfrmed in the cnsle. Und Clears the actin histry. Up t 20 previus actins are listed. Select the pint at which yu want t clear the actins. The actin selected and all preceding actins are undne. Red Re-applies the cleared actin histry. Up t 20 cleared actins are listed. Select the pint at which yu want t red the actins. The actin selected and all preceding actins are redne. Expand All Expand all ndes, actins and cnditins in a selected area f the cnsle. Cntext sensitive t the selected item and wrks in the navigatin tree r the wrk area. Fr example, if used when the Cmputer trigger is highlighted, all triggers and ndes within the Cmputer trigger are fully expanded. T expand all triggers and ndes in a cnfiguratin, select the Envirnment Manager item at the tp f the pane and select Expand All. In the wrk area, if a cnditin is highlighted, all sub cnditins and actins are fully expanded. Cllapse All Cllapses all ndes, actins and cnditins - wrks as Expand All but in reverse. Managing the Quick Access Tlbar The Quick Access Tlbar can be cnfigured t add and remve functins and change its psitin within the cnsle: Right-click n a ribbn buttn r file menu ptin and select Add t Quick Access Tlbar t add it t the Quick Access Tlbar. Right-click n a tlbar item and select Remve Frm Quick Access Tlbar t remve it. Right click n a ribbn r the tlbar and select Shw Quick Access Tlbar Belw the Ribbn t display the tlbar belw the ribbn. Page 15 f 147

16 Find and Replace Envirnment Manager cnfiguratins can be searched using text strings and regular expressins. The whle f the navigatin tree can be searched r individual areas, such as a nde r a trigger, can be targeted. Searches include all ndes, child ndes, cnditins and actins in a cnfiguratin r within the selected area. Find and Replace culd be used, fr example, t change the name f a server thrughut the cnfiguratin, t amend the IP address f a particular endpint r just t find where in a cnfiguratin a particular registry key is referenced. Perfrm a Find and Replace 1. In the Edit ribbn, select Find and Replace. The Find and Replace dialg displays. If yu want t target the search, select the required area f the cnfiguratin prir t pening the dialg. In the example belw, the Cmputer\Prcess Started trigger was selected. This can be changed in the dialg as explained in step In the Find field, enter the text t search fr r the regular expressin yu want t use fr the search. 3. In the In field, define which elements f the cnfiguratin yu want t search - Actins, Cnditins, Ndes and/r Reusable Ndes. 4. Check that the Where field shws the path t the area f the cnfiguratin yu want t search. If the path is incrrect: Amend the path manually Delete the path t search the whle cnfiguratin Select a previusly searched path frm the drp-dwn 5. In the Replace with field, enter the replacement text. If yu are perfrming a search, this field can be left blank. 6. Cnfigure the find ptins by selecting any cmbinatin f the check bxes: Match Case - Search fr nly thse items which match the capitalizatin f the text in the Find text Match Whle Wrd - Search fr nly thse items which match the whle wrd in the Find field. Use Regular Expressins - Return any items which match the regular expressin entered in the Find field. 7. Click Find t display all items that match yur search criteria. Search Results The search results list any item which matches the query and shw where the item is fund in the cnfiguratin. Page 16 f 147

17 In the example belw, the user has searched fr "CurrentVersin". The search results include the registry key "Sftware\Micrsft\Windws\CurrentVersin\Explrer". This registry key is referenced in actins fund in tw different triggers in the cnfiguratin. The path t each f the actins is displayed beneath the match. Select a path t autmatically navigate t that area f the cnfiguratin. T mve t the next match, click Find Next. If yu want t replace text, select the required match and click Replace - t replace all matches click Replace All. Page 17 f 147

18 Yu can redefine a search at any time by updating the criteria and clicking Find t update the results. Fr example, yu restrict yur search t Cnditins r fcus the search n anther area f the cnfiguratin. T view r edit an actin r cnditin in the search results, select the item and click View/Edit. The item pens in the relevant dialg. Envirnment Manager Administrative Tls Envirnment Manager is packaged with standalne utilities that help administratrs create cnfiguratins and manage the Persnalizatin Database. The tls are run independently frm Envirnment Manager and all ur ther prducts. The Administrative Tls installer is included with the Envirnment Manager installatin media in bth 32 and 64-bit versins: EnvirnmentManagerTls32 EnvirnmentManagerTls64 Once installed t the default lcatin, the fllwing tls are available: Envirnment Manager Mnitr (EmMn) Persnalizatin Server Lg Viewer Envirnment Manager File Cnversin EMP File Utility EMP Migrate Utility EMP Migrate Cmmand Line Utility EMP Registry Utility File Based Registry Explrer Page 18 f 147

19 Service Packs Service Packs are self-cntained packages r patches that are used t update specific files within a DesktpNw applicatin withut reinstalling the full applicatin. Service packs can be applied mre ften and reduce the need fr system restarts n yur endpints. Service packs are delivered as a Windws Installer patch (MSP) file and are ften referred t as patch files. Install a Service Pack Service Packs can be installed r deplyed using the same technlgy and techniques used when installing MSIs. Bth Micrsft System Center and the Management Center 8 FR4 can deply MSPs. If neither f these prducts are available, service packs can be installed using the cmmand line interface. Fr example, the cmmand: msiexec.exe /p EnvirnmentManagerAgent64.msp installs any files that have been amended as part f the patch fr just Envirnment Manager 64 bit agent. The fllwing cmmand installs the base versin f the Envirnment Manager Agent (MSI) and the Envirnment Manager patch file (MSP) simultaneusly: msiexec.exe /i EnvirnmentManagerAgent64.msi PATCH=c:\fullpath\EnvirnmentManagerAgent64.msp A base versin must be installed befre the patch file can be applied. If the patch file cntains driver r hk files that are currently in use n the machine the patch is being applied t, yu are infrmed that a rebt is required. If yu chse t cntinue, the system is restarted when the patch has been applied. Fr infrmatin n installing and upgrading service packs using Management Center, see the DesktpNw help. Installatin Order and Dependencies It is recmmended that all cmpnents f a service pack are installed and that the PersnalizatinServerXX.MSP is installed first. All ther cmpnents have n required install rder. Rll back a Service Pack Yu can rll back r install service packs using either the Management Center (8 FR4 nwards) r the Windws Cntrl Panel. When yu uninstall a service pack, the prduct reverts t the previus latest build - whether a service pack r base versin. With the exceptin f the Persnalizatin Server cmpnent patch file (PersnalizatinServerXX.msp) All agent and cnsle service pack cmpnents can be uninstalled. Page 19 f 147

20 Rll Back a Service Pack Using the Management Center 1. In the Management Center cnsle, select Overview > Deplyment Grups tab > Deplyment Grups. 2. Highlight the Deplyment Grup and select Settings > Assigned Packages. The Assigned Packages wrk area displays a list f all the prducts and their assciated packages. 3. Highlight the required Envirnment Manager service pack and click Unassign frm the Actins menu. 4. Click Review and Submit. The Submit Changes dialg displays. 5. Check the details are crrect and click Submit. The patch is unassigned based n the deplyment grup Installatin Schedule. Rll Back a Service Pack Using the Windws Cntrl Panel Frm the Cntrl Panel select Prgrams and Features and uninstall the required patch. Best Practices fr Cnfiguratin This sectin utlines the key pints fr cnsideratin when setting up yur Envirnment Manager cnfiguratin. Mandatry vs Lcal Prfiles During design and implementatin stages, cnsideratin shuld be given t the type f prfile which needs t be used as the base t be laded fr the user befre Envirnment Manager Persnalizatin verlays the user s actual settings. Typically, Mandatry prfiles are used which are very light weight and cntribute t faster lgn times fr users. This prfile is ideal fr envirnments where all users are accessing devices which are permanently nline. If users als use laptps t wrk ffline, then yu need t lk at hw their accunt is managed when the laptp is ffline; d they: Use an Active Directry accunt? Use a Lcal Prfile and prvide Active Directry credentials when accessing cmpany resurces? In these instances, it may be easier t leave the user prfile path within Active Directry blank and allw users t lad a lcal prfile as a base. The cached cpy f the lcal prfile must be deleted using the Micrsft utility, DELPROF. Page 20 f 147

21 Anther slutin is t create the MAN file fr the Mandatry prfile, placed within the lcatin f %SYSTEMDRIVE%\Default User. This allws tw benefits: Yu d nt have t specify a path within the User prperties f Active Directry As it is a Mandatry prfile, the Windws perating system will flush this autmatically. This will require sme time t cpy t each managed device. Applicatins that use INI Files Sme applicatins that are used within an envirnment require the use f INI files r files f this type t keep certain settings fr the user. If the INI file is kept within the user s prfile this is typically nt a prblem fr Envirnment Manager Persnalizatin. When the INI file is nt kept within the user s prfile, but in anther lcatin, fr example, C:\Windws, then yu may nt want Envirnment Manager Persnalizatin t capture infrmatin frm this lcatin, due t the nature and the amunt f files in that lcatin. At this pint, yu can use Envirnment Manager Plicy actins t cpy dwn the file r flder t the lcatin during either a Lgn r a Prcess Start trigger fr the applicatin and then cpy the file r flder back up t the user s hme directry during a Lgff r Prcess Stp trigger. Persnalizatin Membership Perfrmance Each cnditin evaluates matches and queries at different speeds prviding different respnse times. These differences culd be due t sme cnditins evaluating against lcal data and therefre prviding rapid respnse times. Other cnditins may require cnnectin t the netwrk thereby increasing respnse times and relying n cnnectin speeds. The cnditins in the tables belw have been rated by perfrmance speed fr carrying ut matches and queries. By creating cnfiguratins with these respnse times in mind, perfrmance can be ptimized. Fr example, if a cnfiguratin cntains OR cnditins, place them in rder f respnse time with the quickest evaluating first. If the first cnditin matches, the cnfiguratin is nt held up by the slwer respnse time f the secnd cnditin. Directry Services Expressins Cnditin Match Query Site Membership Fast N/A Cmputer OU Membership Slw Slw User OU Membership Slw Slw Page 21 f 147

22 User Expressins Cnditin Match Query Is Administratr Fast N/A User Name Fast Fast User Grup Name Fast Medium Cmputer Expressins Cnditin Match Query Cmputer IP Address Fast Fast Cmputer Dmain Membership Fast Fast Cmputer NETBis Name Fast Fast Cmputer Grup Fast Medium Cmputer Name Slw Slw Enabling Reverse DNS Lkup n the server increases the perfrmance f the Cmputer Name cnditin. Printer Settings fr Persnalizatin If printer settings are required t be kept by the user, then the fllwing keys need t be added t Windws Settings within the Persnalizatin Server: HKEY_CURRENT_USER\Printers HKEY_CURRENT_USER\Sftware\Micrsft\Windws NT\CurrentVersin\Devices HKEY_CURRENT_USER\Sftware\Micrsft\Windws NT\CurrentVersin\Windws Masquerading Applicatins T enable managed applicatins t share user Persnalizatin settings, it is necessary t create an applicatin grup. Fr example, this culd be a Micrsft Office grup cntaining Wrd, Excel, Outlk and PwerPint. It may, hwever, be useful t use a Masquerading Applicatin t allw an applicatin access t anther applicatin s persnalizatin data withut having t create an applicatin grup. Fr example, running mlcfg32.cpl against Outlk s persnalizatin data t view its registry settings n the client. Page 22 f 147

23 T d this, create an entry in the Advanced Settings dialg: Name: MasqueradingApps Value: rundll32.exe;ffice12\mlcfg32.cpl;utlk.exe; : This value equates t: <RealExe>;<RealExe Cmmandline>;<TargetExe>;<TargetExeVersin>: Fr this example, mlcfg32.cpl is gruped with Outlk t share its persnalizatin data. <TargetExeVersin> matches the versin cnfigured in the database fr Outlk. If it is set t a wildcard (.*), any versin can be supplied here. These entries can be chained tgether t prvide multiple settings. Client Specific Masquerading The MasqueradingApps setting is glbal and as such, applies n all managed end-pint devices. Hwever, t achieve the same behavir, applicatins can be launched n individual client machines with a special cmmand-line argument: /APPSENSESPECIAL. The syntax n the client is: <RealExe> /appsensespecial:<targetexe>:<targetexeversin> Sme applicatins such as regedit.exe, d nt wrk crrectly with extra cmmand-line arguments. These applicatins shuld be launched using a cmmand shell which has been run with the APPSENSESPECIAL switch. Fr example, cmd.exe /appsensespecial:ntepad.exe: wuld launch with the cmmand shell sharing the persnalizatin settings f Ntepad. Regedit.exe can nw be launched frm within the cmmand shell and will have access t Ntepad s settings. In the abve scenari, ensure that regedit.exe is nt already defined as a managed applicatin r blacklisted. There shuld be n ther instances f cmd.exe r regedit.exe running. Create Persnalizatin Caches Based n Envirnment Variables The Advanced setting, MasqueradeAppByEnvVar allws the Persnalizatin cache used by Envirnment Manager t be changed based n the existence f an envirnment variable n the end pint. This allws greater flexibility where Persnalizatin is required fr the same versin f an applicatin, acrss multiple machines where ne instance f the applicatin is using different plug-ins. Fr example, if Micrsft Excel 2007 is run n three Windws 7 devices, by design it wuld share Persnalizatin settings between all three. If ne f thse devices was running different plug-ins t the thers, it culd be useful fr this versin f Excel t use separate Persnalizatin settings. Page 23 f 147

24 Cnfigure Persnalizatin Caches Based n Envirnment Variables The fllwing steps shw hw t cnfigure the user interface using the Excel scenari. 1. Create the fllwing entry in the Advanced Settings dialg: Name: MasqueradeAppByEnvVar Value: TargetExe>%ENV_VAR% Fr the Excel scenari, the value wuld be Excel.exe>%MASQ%. MASQ is an envirnment variable set n the client. 2. Create the fllwing managed applicatins: Name Executable OS RegEx Versin RegEx Excel Excel.exe.*.* Excel MASQ Excel.exe.masq.*.* The Excel.exe.masq executable entry prvides an alternative t excel.exe using a different cache t allw separate Persnalizatin t be used fr the same applicatin. Client Cnfiguratin Add the envirnment variable called MASQ with a value f masq. When Excel is run, its Persnalizatin settings g int a cache called Excel MASQ. If the MASQ variable is remved, Excel settings will g int a cache called Excel. Page 24 f 147

25 Wildcards and Regular Expressins This sectin cntains examples f wildcards and regular expressins and hw they can be used in Envirnment Manager. Envirnment Manager uses CAtIRegExp Class regular expressins. Fr further infrmatin n CAtIRegExp Class regular expressins, refer t Expressin ^[a-f]+ Matches "alice" matches because her name starts with a letter between a and f "jhn" des nt match because his name starts with a letter greater than f "Alice" des nt match because her name des nt start with a lwercase letter ^[a-fa-f]+ [a-za- Z]+\d\d\d$ "Alice" matches because with this expressin uppercase letters are allwed "UserWithThreeNumbers123" matches because the user name is made up f alpha numerics fllwed by 3 numbers "UserWithFurNumbers1234" des nt match because the user name has fur numbers in it The dmain name can als be specified in regular expressins. Fr example, appsense\\^[a-f]+ matches all user names which have a first letter a t h. Withut a dmain name in the regular expressin, the query matches any user names which have a first letter frm a t h in any dmain. Expressin (ntepad) (winwrd) (calc).exe Matches ntepad.exe matches because it is in the list wrdpad.exe des nt match because it is nt in the list ^!(ntepad.exe) ntepad.exe des nt match because ntepad is specifically excluded wrdpad.exe matches because it is nt ntepad ^!((ntepad.exe) (calc.exe) (winwrd.exe)) wrdpad.exe matches because it is nt in the list calc.exe des nt match because it is in the list Page 25 f 147

26 Perfrmance Mnitr Cunters Envirnment Manager Persnalizatin Server prvides perfrmance cunters that can be analyzed within Perfrmance Mnitr (PerfMn.exe). The available cunters are cntained within the Envirnment Manager Persnalizatin grup. Cnfiguratin Request Cunters An HTTP cnfiguratin request is made by a client fllwing a sessin request. A user cnfiguratin is returned t the client. The cnfiguratin cntains such things as Persnalizatin Grups with managed applicatins and glbal prperties. The fllwing cunters are available fr the cnfiguratin request: Cunter Cnfiguratin invalid requests Cnfiguratin max time Cnfiguratin min time Cnfiguratin prcess request time Cnfiguratin ttal average time Cnfiguratin ttal time Cnfiguratins per secnd Cnfiguratins ttal failed Cnfiguratin ttal succeeded Descriptin The ttal number f invalid HTTP cnfiguratin requests prcessed. The maximum time (ms) taken t prcess an HTTP cnfiguratin request. The minimum time (ms) taken t prcess an HTTP cnfiguratin request. The time (ms) taken t prcess the latest HTTP cnfiguratin request. The average time (ms) taken t prcess an HTTP cnfiguratin request. The ttal time (ms) taken t prcess all HTTP cnfiguratin requests. The number f HTTP cnfiguratin requests prcessed per secnd. The ttal number f failed HTTP cnfiguratin requests prcessed. The ttal number f successful HTTP cnfiguratin requests prcessed. Page 26 f 147

27 Sessin Request Cunters An HTTP sessin request is made by a client fllwing user lgn. The server determines the user site membership and returns a list f server URLs t use fr subsequent cnfiguratin and synchrnizatin requests. The fllwing cunters are available fr the sessin request: Cunter Sessin invalid requests Sessin max time Sessin min time Sessin prcess request time Sessin ttal average time Sessin ttal time Sessin per secnd Sessin ttal failed Sessin ttal succeeded Descriptin The ttal number f invalid HTTP sessin requests prcessed. The maximum time (ms) taken t prcess an HTTP sessin request. The minimum time (ms) taken t prcess an HTTP sessin request. The time (ms) taken t prcess the latest HTTP sessin request. The average time (ms) taken t prcess an HTTP sessin request. The ttal time (ms) taken t prcess all HTTP sessin requests. The number f HTTP sessin requests prcessed per secnd. The ttal number f failed HTTP sessin requests prcessed. The ttal number f successful HTTP sessin requests prcessed. Page 27 f 147

28 Synchrnizatin Request Cunters An HTTP synchrnizatin request is made by a client fllwing an applicatin start r stp and is used t synchrnize persnalizatin data t r frm the server. Windws settings and ther persnalizatin data may als be synchrnized using this request at lgn/lgff. The fllwing cunters are available fr the synchrnizatin request: Cunter Synchrnizatin invalid requests Synchrnizatin max time Synchrnizatin min time Synchrnizatin prcess request time Synchrnizatin ttal average time Synchrnizatin ttal time Synchrnizatin per secnd Synchrnizatin ttal failed Synchrnizatin ttal succeeded Descriptin The ttal number f invalid HTTP synchrnizatin requests prcessed. The maximum time (ms) taken t prcess an HTTP synchrnizatin request. The minimum time (ms) taken t prcess an HTTP synchrnizatin request. The time (ms) taken t prcess the latest HTTP synchrnizatin request. The average time (ms) taken t prcess an HTTP synchrnizatin request. The ttal time (ms) taken t prcess all HTTP synchrnizatin requests. The number f HTTP synchrnizatin requests prcessed per secnd. The ttal number f failed HTTP synchrnizatin requests prcessed. The ttal number f successful HTTP synchrnizatin requests prcessed. Page 28 f 147

29 TraceData Request Cunters A TraceData (HTTP passive) request is made by a client t send data t the server fr Applicatin Data Cllectin. The fllwing cunters are available fr the TraceData request: Cunter TraceData invalid requests TraceData max time TraceData min time TraceData prcess request time TraceData ttal average time TraceData ttal time TraceData per secnd TraceData ttal failed TraceData ttal succeeded Descriptin The ttal number f invalid HTTP passive requests prcessed. The maximum time (ms) taken t prcess an HTTP passive request. The minimum time (ms) taken t prcess an HTTP passive request. The time (ms) taken t prcess the latest HTTP passive request. The average time (ms) taken t prcess an HTTP passive request. The ttal time (ms) taken t prcess all HTTP passive requests. The number f HTTP passive requests prcessed per secnd. The ttal number f failed HTTP passive requests prcessed. The ttal number f successful HTTP passive requests prcessed. Page 29 f 147

30 Abut User Persnalizatin User Persnalizatin captures applicatin and desktp changes t a central database and reapplies them fr the user upn lgn r applicatin start, regardless f perating system r delivery mechanism. Changes made t an applicatin are synchrnized when the applicatin starts r stps. This enables changes t be shared between multiple sessins simultaneusly, withut the need t lg ff. Windws Settings, such as wallpaper, keybard and muse preferences are managed when the user lgs n and ff. User Persnalizatin enables applicatins t be discvered and settings managed with minimum cnfiguratin. When a lg n request is received frm a client endpint, the Persnalizatin Server uses rules cnfigured in the database t determine wh the user is in rder t prvide the crrect cnfiguratin based n that user s persnalizatin grup. The cnfiguratin retrieved by the client sessin frm the database at lgn determines which applicatins are managed and the data that is t be virtualized. If a user wh is nt matched by persnalizatin grup membership rules lgs n t the system, they are assigned t the default grup and managed accrding t this grup s settings. An Excluded Users persnalizatin grup can be created fr users wh d nt require persnalizatin. By creating a persnalizatin grup in which n applicatins r settings are managed, users matching the membership rules are remved frm all user persnalizatin management. If a knwn user lgs n withut any applicatins cnfigured, n applicatins are managed. User Persnalizatin des nt wrk with the Run as cmmand. Persnalizatin relies n a user s lgn credentials t determine which applicatins are managed. Therefre, if a user runs an applicatin as Administratr r ther user, that applicatin is nt persnalized. User Persnalizatin requires a live cnnectin t the SQL database which means that changes t the cnfiguratin in the Envirnment Manager cnsle, are immediately cmmitted t the database - unless wrking ffline. The changes are reflected n endpints when the lcal cnfiguratin is updated; at lgn, cnfiguratin pll (default time f 10 minutes) r when the EM User Virtualizatin Service is started. By default, User Persnalizatin data is archived n a daily basis enabling applicatin and Windws Settings t be rlled back t previus states, in the event f prfile incnsistencies. The Persnalizatin Analysis tl is als prvided which enables the administratr t mnitr which applicatins are being cntrlled by Envirnment Manager, including hw much data is being stred fr each user and applicatin. Page 30 f 147

31 Designing and Implementing Envirnment Manager Persnalizatin The fllwing pints are recmmendatins fr the design and implementatin f Envirnment Manager User Persnalizatin. Install the Persnalizatin Database and Persnalizatin Server n separate devices (physical r virtual). Where pssible, install the Persnalizatin Database with High Availability in mind. Typically fr this, clustering f the Micrsft SQL Server is recmmended. When required, Persnalizatin Servers will supprt Netwrk Lad Balancing being placed in frnt f the servers. Fr multiple Envirnment Manager sites r data centers, it is recmmended that Persnalizatin Servers and Databases are installed n these sites and lcal clients pinted t their lcal Persnalizatin Server and Databases. This reduces perfrmance issues acrss WAN links. Setting Up a Persnalizatin Cnfiguratin The fllwing steps utline hw t create a basic cnfiguratin t manage and migrate existing user data int the Persnalizatin database. Step 1 Add Persnalizatin Grups Create the Persnalizatin Grups required fr yur rganizatin and add membership rules t represent yur users. See Persnalizatin Grups. Step 2 Cnfigure Applicatin Data Cllectin Enable Applicatin Data Cllectin t passively gather registry and flder usage data fr the applicatins yur users have run. It is recmmended that Applicatin Data Cllectin is disabled when n lnger required. See Applicatin Data Cllectin. Step 3 Add Applicatin Grups and Windws Settings Grups Use the cllected data t create managed Applicatin Grups t manage the applicatins within yur rganizatin. Add Windws Settings Grups t manage the settings users apply t their endpints. See Applicatin Persnalizatin and Windws Persnalizatin. Page 31 f 147

32 Step 4 Enable Prfile Migratin Use Prfile Migratin t imprt data frm existing user prfiles. See Prfile Migratin. User Persnalizatin Architecture Envirnment Manager User Persnalizatin utilizes a three tier architecture. Intrductin Cllectively, the cmpnents f the standard architecture are knwn as a site. Sites prvide a lgical gruping f users; fr example, by area f business r gegraphical lcatin. Fr rganizatins with mre than ne site, the same architecture is used fr each site, linked via their SQL servers thrugh replicatin. It is nt a requirement that each branch site has a dedicated SQL server. Hwever, perfrmance is imprved as traffic is cntained within the Lcal Area Netwrk (LAN) and des nt have t travel acrss the Wide Area Netwrk (WAN). In the diagram belw, the system cnsists f tw sites; the default site and an ptinal branch site. The client endpints n a site cmmunicate with their Persnalizatin Server every time ne f the fllwing events ccurs: Page 32 f 147

33 Lgn - When a user lgs nt a managed endpint, the Envirnment Manager Package (AEMP) file is laded. If user persnalizatin is enabled, the user is cnnected t the Persnalizatin Server detailed in the cnfiguratin. User, endpint and sftware versin details are passed frm the endpint t the server which determines the site and persnalizatin grup that the user belngs t. A persnalizatin cnfiguratin is passed back t the client n the managed endpint by the Persnalizatin Server. This cnfiguratin file describes the persnalizatin settings fr the user and includes details f managed applicatins and certificates fr the user. Windws Settings are synchrnized and applied t the endpint t cmplete the user persnalizatin lgn. Applicatin Start - When a user launches an applicatin n the endpint, it is paused briefly t allw Envirnment Manager t perfrm the required virtualizatin actins. Details f the applicatin are analyzed and Envirnment Manager checks t see if User Persnalizatin is enabled and that the applicatin shuld be managed. Fr nn-managed applicatins, any plicy cnfiguratin actins are applied and the applicatin cntinues withut User Persnalizatin settings being managed. Fr thse applicatins which are managed, a cnfiguratin file specific t the applicatin is created which details the file and registry inclusins, exclusins and a subset f the Glbal Prperties as cnfigured in the User Persnalizatin database. Envirnment Manager Plicy Cnfiguratin is ntified f the start f the prcess and any relevant Plicy actins are replicated n the virtual cache. Whilst the applicatin is running and the user cntinues t change user persnalizatin settings within it, any changes are virtualized and written t the persnalizatin cache n the endpint, rather than int the physical registry r file system. Fr applicatin grups cnfigured in Envirnment Manager, the Persnalizatin database is nly synchrnized when the first applicatin in the grup is started. Synchrnizatin is nt perfrmed when the ther applicatins in the grup are launched. Applicatin Stp - When an applicatin is clsed, the Persnalizatin Server is ntified and a cpy f any mdified persnalizatin settings is stred in the SQL database. If the prcess is the last within a grup t exit, r the last instance f a managed prcess f similar applicatins, synchrnizatin f the cache ccurs back t the server. If an applicatin is clsed when ther applicatins in the same applicatin grup are still pen, synchrnizatin t the database is nt perfrmed. Only when the last applicatin in the grup is clsed is the database synchrnized. Fr mre infrmatin see Applicatin Grups. Page 33 f 147

34 Lgff - When a user lgs ff any managed applicatins still running are stpped by Windws and the lgff cmpletes as nrmal befre the Envirnment Manager lgff screen displays. The applicatin, desktp and certificate settings are synchrnized with the database and the lcal virtual cache is cleared. Once this is cmplete the Envirnment Manager lgff screen is remved frm display and the Windws lgff is cmpleted as nrmal. If Lcal Cache is enabled, the lcal virtual cache is nt cleared t enable the user t maintain their settings nce discnnected frm the crprate netwrk. Cnfiguratin Pll - Changes can be made t user persnalizatin cnfiguratins by administratrs whilst users are lgged n. A cnfiguratin pll is perfrmed at a predefined interval which picks up any cnfiguratin changes and applies them t the managed endpints. The plling interval is set in the cnsle using the Advanced Settings. The virtual cache n the endpint is the rt flder fr all User Persnalizatin data where virtualized files and registry settings are stred prir t synchrnizatin with the Persnalizatin database. The data fr each setting and managed applicatin is stred here and kept up t date by synchrnizatin with the Persnalizatin database. The virtual cache is a hidden flder lcated at C:\AppSenseVirtual n every managed endpint. Each f the abve events creates a synchrnize request where the client ensures that the lcal virtual cache is up t date with the SQL database. Every time an applicatin starts r stps, the sftware ensures that the SQL database and lcal virtual cache are synchrnized. Page 34 f 147

35 Tier 1 - Client Endpint The client endpint hsts the user s lgn sessin. Within the sessin is the Envirnment Manager sftware cntaining the User Persnalizatin mdules which mnitr changes that the user makes t managed applicatins and cmmunicates these back t the Persnalizatin Server. The client endpints can be any cmbinatin f hardware and sftware that is capable f running a windws sessin: Standalne desktps, laptps and tablet PCs Terminal Servers Micrsft Hyper-V Tier 2 - Persnalizatin Server The Persnalizatin Server is implemented as an Internet Infrmatin Services (IIS) Website and acts as the brker between the endpints and the Persnalizatin database. It enables access t the database frm multiple clients t be cntrlled frm ne place. The Persnalizatin Server can verify the identity f the clients befre prcessing requests s clients d nt need t be added as users t the database. Status Request T test whether a Persnalizatin Server is installed, running and t test the database cnnectin, enter the fllwing URL in yur internet brwser, replacing <SERVER> with the name f the required server. The status.aspx file fr a server shws whether the server cnnectin was successful and further details abut the cnnectin, database and server. Page 35 f 147

36 Lad Balancing Status Request If using a lad balancer mnitr t check the server status page (status.aspx) where the server is set t Windws Authenticatin, the mnitr must prvide Windws credentials in the HTTP headers r the server will respnd with an "unauthrized" reply. As an alternative, use ne f the fllwing methds, apprpriate t yur setup shuld be used. T check the health f lad balanced servers use the fllwing methds, apprpriate t yur setup. IIS7 - Windws Server 2008 and R2 Use the fllwing URLs in an internet brwser, replacing <SERVER> with the name f the required server: - Checks the cnnectin with the database. Returns "OK" if the database can be cntacted and "FAIL" if it cannt. - Checks whether the persnalizatin server address is reachable returning "OK" if successful. N respnse indicates an errr. Page 36 f 147

37 IIS6 - Windws Server 2003 Fr IIS6, the SetMnitrAnnymusIIS6.vbs script must be used t set up dbmnitr.aspx and pingmnitr.aspx fr annymus access. Fr further details, cntact Supprt. Tier 3 - SQL Server Hlds infrmatin related t persnalizatin sites and servers, users and grups, applicatins, endpint cnfiguratin data and user persnalizatin data. Persnalizatin Server data is rganized and stred in tables n the SQL server in the fllwing lgical grupings: Persnalizatin Data - Cntains data relating t the user, including grup membership details and cntrls the data fr managed applicatins. Applicatin data is updated here each time a managed applicatin is pened r clsed. Site Membership - Huses the Site Membership infrmatin which cmmunicates details f which Persnalizatin Server the user shuld be cnnected t. Once cnnected, cnfiguratin infrmatin is retrieved including details f includes and excludes fr registry items and flders. User Grup Assignment - Defines the grup t which a user belngs which in turn cntrls which applicatins are managed fr the user in additin t their Windws Settings. Authrized Users - Cntains tables which cntrl wh is authrized t cnnect t the Persnalizatin Server and what they are able t d when cnnected. Archiving - Stres the archive data frm the Daily and Demand archiving SQL Agent jbs in tw tables relating t Applicatin Prfile and Applicatin Data archives. Auditing - Used t setup and cnfigure the auditing events that are raised internally and cntrl what and t where, events are raised. Frm this, the required alerts and reprts are generated by the Management Center. See the Management Center help fr further infrmatin. Managed Applicatin Settings - Cntains details f all registry and flder include and exclude paths fr each applicatin and applicatin grup. General Settings - Cntains system and user defined glbal prperties fr key and value pairing including cnsle versin, timeuts and archiving infrmatin. Installatin infrmatin including an upgrade histry and is maintained by the AppSense System Cnfiguratin Utility, is als stred here. SQL Server AlwaysOn and Mirrring SQL Server AlwaysOn is the preferred SQL Server technlgy t supprt High Availability/Disaster Recvery scenaris and DesktpNw 10.x servers have been ptimized t supprt this technlgy. SQL mirrring is available fr DesktpNw 10.1 FR1+ custmers wh are currently in the prcess f transitining t Always On technlgy. Fr mre infrmatin, see the DesktpNw help. Page 37 f 147

38 Cnfigure Persnalizatin Servers T cnfigure a persnalizatin server, yu must first establish a cnnectin. Once cnnected yu can create a cnfiguratin t cntrl persnalizatin fr yu enterprise. A list f servers can then be created t manage which servers yur managed users cnnect t. Fr details abut cnfiguring Persnalizatin Servers, see the DesktpNw help. Cnnectin In rder t cnfigure persnalizatin fr yur users, yu must first establish a cnnectin t a Persnalizatin Server. The Cnnect buttn allws yu t list ne r mre Persnalizatin Servers and cnnect t the required ne. T cnfigure Persnalizatin, lcalhst is autmatically added t the Select Persnalizatin Server dialg if the fllwing cnditins are true: A Persnalizatin Server is installed and cnfigured n the same machine as the cnsle. A Persnalizatin Server has nt previusly been cnfigured in the Select Persnalizatin Server dialg Cnnect t a Persnalizatin Server 1. Select the User Persnalizatin navigatin buttn. 2. Frm the Server ribbn, click Cnnect. The Select Persnalizatin Server dialg displays. Page 38 f 147

39 3. Click the new server buttn. The Add Server dialg displays. 4. Enter a Friendly Name fr the server. This can be any text but shuld be smething which will enable yu t identify the server. If n text is entered, the server name is used. 5. Select the required prtcl - http r https. 6. Enter the server name r brwse fr the required server by specifying lcatins and searching fr server names. 7. Enter the prt number. The prt range fr Persnalizatin servers is 7771 t 7790 and the default prt is Once the server details have been added, the URL fr the server is displayed. 8. Click Add. The server is listed in the Select Persnalizatin Server dialg. 9. Repeat steps 2 t 6 t add mre servers. Servers in the list can have their details edited r be deleted frm the list using the buttns at the tp f the dialg. 10. Select the server yu want t cnnect t and click Cnnect. When yu return t this dialg, any servers yu have listed are available fr selectin. Page 39 f 147

40 Persnalizatin Servers in the Cmbined Cnsle This feature is nly available in the cmbined cnsle. In the Persnalizatin cnsle, the server list is cnfigured using the Endpint Server List. When creating an AEMP cnfiguratin in the cmbined cnsle, a list f persnalizatin servers can be cnfigured. When the cnfiguratin is pushed ut t endpints it determines whether endpints are persnalized and if they are, t which server they will cnnect. It is recmmended that multiple persnalizatin servers are listed s alternative servers can be autmatically selected fr failver purpses. The first time a user lgs n t a managed endpint, the Envirnment Manager agent cntacts the first Persnalizatin Server t request the actual list f servers the endpint shuld use (based n the sites cnfigured in the database). The client then cntacts the crrect server t pull dwn the User Persnalizatin cnfiguratin, cntaining the list f the applicatins which shuld be persnalized fr the user. If all attempts t cnnect t a Persnalizatin Server fail, then the cnfiguratin is nt dwnladed and Persnalizatin des nt take place. If n servers are cnfigured, endpints managed by this cnfiguratin are nt persnalized. T cater fr such a scenari it is recmmended that the Timeut Cmmunicating with Persnalizatin Server auditing event is enabled. Cnfigure a Persnalizatin Server List 1. Select the Plicy Cnfiguratin navigatin buttn. 2. Frm the Manage tab select Persnalizatin Servers. The Cnfigure Persnalizatin Servers dialg displays. 3. Click the add server buttn. The Add Server dialg displays. 4. Enter the server name r click the ellipsis t search fr the required server by specifying lcatins and searching fr server names. D nt select r enter Lcalhst as the server name. If Lcalhst is entered as the server name it is added t the cnfiguratin.aemp file as the lcatin f the Persnalizatin Server. The client tries cnnecting t which is incrrect and User Persnalizatin is disabled. 5. Enter a Friendly Name fr the server. This can be any text but shuld be smething which will enable yu t identify the server. If n text is entered, the server name is used. 6. Select the required prtcl - http r https. Page 40 f 147

41 7. Enter the server name r brwse fr the required server by specifying lcatins and searching fr server names. 8. Enter a prt number. The prt range fr Persnalizatin servers is 7771 t 7790 and the default prt is Once the server details have been added, the URL fr the server is displayed. 9. Click OK. The server is listed in the Select Persnalizatin Server dialg. 10. Repeat steps 3 t 9 t add mre servers. Servers in the list can have their details edited r be deleted frm the list using the buttns at the tp f the dialg. 11. If yu have added mre than ne server, use the arrw buttns t rerder the list. When the cnfiguratin is deplyed, endpints attempt t cnnect t each server in turn. If a cnnectin cannt be made with any server in the list, Persnalizatin des nt ccur. 12. Click OK t save the server list. When the cnfiguratin is deplyed t endpints, this list is used t determine which servers managed users cnnect t. Persnalizatin Servers in the Persnalizatin Cnsle This feature is nly available in the Persnalizatin cnsle. In the cmbined cnsle, the server list is cnfigured in the Plicy side f the cnsle using the Persnalizatin Servers ptin frm the Manage ribbn. The Endpint Server List allws yu t create an AEMP cnfiguratin file cntaining the Persnalizatin Servers t which endpints can cnnect. It is recmmended that, where pssible, multiple servers are added t the Select Persnalizatin Server dialg s alternative servers can be cnnected t fr failver purpses. Envirnment Manager supprts SQL 2012 Always-On functinality. Page 41 f 147

42 When a user lgs n t a managed endpint, an attempt is made t cnnect t the first server n the list. If a cnnectin cannt be made t that server, cnnectin with the next server in the list is attempted and s n until a cnnectin is established. If all attempts t cnnect t a server fail, persnalizatin des nt take place. An AEMP cnfiguratin created frm the Endpint Server List in the Persnalizatin cnsle can be pened and edited in the cmbined cnsle. Likewise, an AEMP cnfiguratin with cnfigured servers, created in the cmbined cnsle, can be pened and edited in the Endpint Server List in the Persnalizatin cnsle. Yu cannt upgrade plicy cnfiguratins in the Persnalizatin nly cnsle. plicy cnfiguratins can nly be upgraded in the cmbined Plicy nly cnsles. Cnfigure and Save a Persnalizatin Server List 1. Open the Envirnment Manager Persnalizatin cnsle. 2. Frm the Server ribbn, click Endpint ServerList. The Persnalizatin cnfiguratin dialg displays. 3. Click the new server buttn. The Add Server dialg displays. 4. Enter the server name r click the ellipsis t search fr the required server by specifying lcatins and searching fr server names. D nt select r enter Lcalhst as the server name. If Lcalhst is entered as the server name it is added t the cnfiguratin file as the lcatin f the Persnalizatin Server. The client tries cnnecting t which is incrrect and User Persnalizatin is disabled. 5. Enter a Friendly Name fr the server. This can be any text but shuld be smething which will enable yu t identify the server. If n text is entered, the server name is used. 6. Select the required prtcl - http r https. 7. Enter the server name r brwse fr the required server by specifying lcatins and searching fr server names. 8. Enter the prt number. The prt range fr Persnalizatin servers is 7771 t 7790 and the default prt is Once the server details have been added, the URL fr the server is displayed. 9. Click OK. The server is listed in the Select Persnalizatin Server dialg. Page 42 f 147

43 10. Repeat steps 2 t 6 t add mre servers. Servers can have their details edited r can be deleted frm the list using the buttns at the tp f the dialg. 11. If yu have added mre than ne server, use the arrw buttns t rerder the list. When the cnfiguratin is deplyed, endpints attempt t cnnect t each server in turn. If a cnnectin cannt be made with any server in the list, Persnalizatin des nt ccur. 12. Click OK t save the server list. When the cnfiguratin is deplyed t endpints, this list is used t determine which servers managed users cnnect t. 13. Click File and select the required save ptin. Persnalizatin Server Selectin Using Grup Plicy Envirnment Manager 8.3 client sftware allws the persnalizatin server t be selected using grup plicy. As detailed in the sectins abve, a list f persnalizatin servers is nrmally specified in the cnfiguratin. Hwever, this can be verridden by the grup plicy list. Using grup plicy templates, a list f servers can be created that will be used by endpints as a failver list. There is als an ptin t bypass the site prcessing n the server and use the specified server directly. This prvides new cnfiguratin ptins and ffers better perfrmance fr large numbers f users. Grup plicy selectin f persnalizatin servers wrks even if n cnfiguratin file is deplyed t the client. The fllwing grup plicy administrative template files are supplied with the Envirnment Manager Persnalizatin and cmbined cnsles: AppSensePersnalizatinServers.admx AppSensePersnalizatinServers.adml AppSensePersnalizatinServers.adm Upgrades fr Endpints with Persnalizatin Applied by Grup Plicy If an endpint with an 8.2 cnfiguratin file withut persnalizatin servers, is upgraded t sftware versin 8.3 r later, the cnfiguratin file shuld be upgraded by lading it int the cnsle and saving it ut again. Errrs are nt generated if the cnfiguratin file is nt updated but plicy actins will nt be applied t managed prcesses. Page 43 f 147

44 Cnfigure a Persnalizatin Server List with Grup Plicy 1. Navigate t the Grup Plicy flder: C:\Prgram Files\AppSense\Envirnment Manager\Cnsle\Templates\Grup Plicy This is the default installatin file path. If yu have installed t an alternative lcatin, find the Grup Plicy flder in yu install lcatin. 2. Cmplete the setup actin fr yur perating system: Cpy the AppSensePersnalizatinServers.admx file t: C:\Windws\PlicyDefinitins (where C:\Windws is the system rt). Cpy the AppSensePersnalizatinServers.adml file t: C:\Windws\PlicyDefinitins\en-US (where C:\Windws is the system rt). 3. Open Grup Plicy Editr. Plicy templates are available fr user and cmputer plicies. User plicies can be tailred t individual users and cmputer plicies apply t the endpint. 4. Select Administrative Templates > AppSense > Envirnment Manager fr either the user r cmputer plicy. 5. Select the required ptin: Specify list f persnalizatin servers - Specify a list f persnalizatin servers fr endpints t cnnect t and use as a failver list. The AEMP cnfiguratin server list is verridden by the list created. Select Enabled and enter the required server name(s). Each server must be preceded by and where mre than ne server is required, separated by a cmma. Fr example, Bypass server site prcessing - Nrmally, initial cntact is made with the server listed in the AEMP file. Once cntact is made, the database rules are evaluated t determine which server the client shuld cnnect t. Enabling this ptin means clients ignre the database site rules and cnnect directly t the server determined by Grup Plicy. Select Enabled t bypass server site prcessing. 6. Click OK t save yur settings and update persnalizatin server selectin t use grup plicy. Evaluatin Order When deciding which server t cnnect t, the fllwing evaluatin rder is used: 1. User Plicy 2. Cmputer Plicy 3. AEMP File Page 44 f 147

45 Each surce is evaluated in rder until a server list is fund; if a server is nt fund, evaluatin mves t the next surce. If n servers are fund, the user is nt persnalized. If a server is listed in User Plicy, fr example, but is unavailable, prcessing ends and the user is nt persnalized. Page 45 f 147

46 Persnalizatin Servers Plicy Enabling User Persnalizatin is a plicy decisin and the setting is cnfigured within the Plicy Cnfiguratin side f the cnsle. It is the deplyed cnfiguratin which determines whether managed endpints are subject t User Persnalizatin and t which server endpints cnnect. It is recmmended that multiple servers and/r virtual hsts are added t the Select Persnalizatin Server dialg s alternative servers can be easily selected fr failver purpses. Deply the plicy cnfiguratin that cntains a list f Persnalizatin Servers t the endpints sending the cnfiguratin.aemp t managed cmputers. The first time a user lgs n t a managed endpint, the Envirnment Manager agent cntacts the first persnalizatin server t request the actual list f servers the endpint shuld use (based n the sites cnfigured in the database). The client then cntacts the crrect server t pull dwn the User Persnalizatin cnfiguratin, cntaining the list f the applicatins which shuld be persnalized fr the user. If all attempts t cnnect t a Persnalizatin Server fail, then the User Persnalizatin cnfiguratin is nt dwnladed and User Persnalizatin des nt take place. Fr details abut cnfiguring Persnalizatin Servers, see the DesktpNw help. T cater fr such a scenari it is recmmended that the Timeut Cmmunicating with Persnalizatin Server auditing event is enabled. Cnfigure a Persnalizatin Servers List 1. Select the Plicy Cnfiguratin navigatin buttn. 2. Frm the Manage tab select Persnalizatin Servers. The Cnfigure Persnalizatin Servers dialg displays. 3. Click the add server buttn. The Add Server dialg displays. 4. Enter the server name r click the ellipsis t search fr the required server by specifying lcatins and searching fr server names. D nt select r enter Lcalhst as the server name. If Lcalhst is entered as the server name it is added t the cnfiguratin.aemp file as the lcatin f the Persnalizatin Server. The client tries cnnecting t which is incrrect and User Persnalizatin is disabled. 5. Enter a Friendly Name fr the server. This can be any text but shuld be smething which will enable yu t identify the server. If n text is entered, the server name is used. 6. Select the required prtcl - http r https. Page 46 f 147

47 7. Enter the server name r brwse fr the required server by specifying lcatins and searching fr server names. 8. Enter a prt number. The prt range fr Persnalizatin servers is 7771 t 7790 and the default prt is Once the server details have been added, the URL fr the server is displayed. 9. Click OK. The server is listed in the Select Persnalizatin Server dialg. 10. Repeat steps 3 t 9 t add mre servers. Servers in the list can have their details edited r be deleted frm the list using the buttns at the tp f the dialg. 11. If yu have added mre than ne server, use the arrw buttns t rerder the list. When the cnfiguratin is deplyed, endpints attempt t cnnect t each server in turn. If a cnnectin cannt be made with any server in the list, Persnalizatin des nt ccur. 12. Click OK t save the server list. When the cnfiguratin is deplyed t endpints, this list is used t determine which servers managed users cnnect t. Page 47 f 147

48 Persnalizatin Grups Persnalizatin grups enable Envirnment Manager User Persnalizatin t be cnfigured fr multiple users based n cmmn requirements. Membership Rules, based n Envirnment Manager cnditins, define which users are managed by the grup. applicatins, applicatin grups and Windws Settings grups can then be added t determine what is persnalized fr users in the grup. Settings fr applicatin discvery, syncing and caching can als be applied t further cntrl hw persnalizatin is managed fr the grup. Add a Persnalizatin Grup 1. In the User Persnalizatin navigatin pane select Persnalizatin Grups. The wrk area displays the name and descriptin f all existing persnalizatin grups which can be accessed by duble-clicking. 2. Click Add Persnalizatin Grup frm the Persnalizatin ribbn. A new persnalizatin grup is created at the bttm f the list f persnalizatin grups, immediately abve the Default Users grup. 3. Add a name fr the new grup and press Enter. T rename a persnalizatin grup, highlight and click Rename Grup frm the Persnalizatin ribbn. If changes are made t persnalizatin grup assignment, the affected users shuld lg ff and back n t pick up the changes. Create Grup Persnalizatin Membership Rules 1. In the User Persnalizatin navigatin pane select Persnalizatin Grups. 2. Select a persnalizatin grup. 3. Right-click in the Membership Rules wrk area and select Add Cnditin Grup frm the shrtcut menu. Page 48 f 147

49 4. Highlight a cnditin type; User, Cmputer r Directry Membership and select a cnditin. The available cnditins are listed in Persnalizatin Grup Cnditins. The dialg bx fr the selected cnditin displays. The fllwing cnditins are available fr persnalizatin grup membership rules: Type User Cnditin User Name User Grup Is Administratr Cmputer Cmputer Name Cmputer Dmain Cmputer NETBIOS Name Cmputer Grup Cmputer IP Address Directry Membership User OU Membership Cmputer OU Membership Site Membership 5. Cnfigure the cnditin and click OK. The new cnditin grup displays under Membership Rules. The title f the cnditin entered int the Descriptin field in the General tab, is the display name fr the cnditin in the Persnalizatin grup. If a descriptin is nt entered, the cnditin details frm the display name. 6. T further define grup membership fr the Persnalizatin grup, add mre cnditins: AND Rule - Right-click n an existing cnditin, select Insert Cnditin and cnfigure the cnditin as required. OR Rule - Right-click in the wrk area and select Add Cnditin Grup and cnfigure the cnditin as required. 7. Cnditin grups can be edited and deleted by selecting Edit Cnditin r Delete Cnditin frm the shrtcut menu. Page 49 f 147

50 Persnalizatin Grup Arrangement Persnalizatin grups can be created based n rles within an rganizatin. Fr example, Administratrs wuld be managed by a different grup t that f a Sales r Marketing department. They have different respnsibilities and requirements and therefre require different access rules and settings. The Persnalizatin Server assigns users t the first persnalizatin grup in the Persnalizatin Grups nde with matching membership rules. It is therefre imprtant that persnalizatin grups are listed in rder f pririty with the mst relevant grup at the tp. This ensures users are assigned t the crrect grup. Users may match the membership rules f multiple grups at different times and might even be managed by different grups depending n their circumstances at lgn. Fr example, a user wrking at a different site culd have different requirements and can be assigned t a different grup fr each site. The Default Users persnalizatin grup is autmatically included in all Envirnment Manager Persnalizatin cnfiguratins and is always at the bttm f the list f grups. If a user, n an endpint with the Persnalizatin Agent installed, des nt match the membership rules f any ther grup, that user wuld be managed by the Default Users grup. Membership rules are therefre nt required and cannt be defined. Only applicatins and Windws Settings that are relevant t a typical user within yur rganizatin shuld be persnalized in the default grup. Order a List f Persnalizatin Grups 1. In the User Persnalizatin navigatin pane select Persnalizatin Grups. 2. Select a persnalizatin grup. 3. Frm the Edit ribbn, click Mve Up and Mve Dwn t change the rder f the persnalizatin grups. Default Users is always be the last persnalizatin grup and cannt be mved. Page 50 f 147

51 Persnalizatin Grup Settings Each persnalizatin grup includes settings t define behavir regarding Applicatin Persnalizatin, Windws Persnalizatin and Lcal Cache settings fr users in the persnalizatin grup. In the User Persnalizatin navigatin tree, select Persnalizatin Grups, chse a Persnalizatin Grup and select the Settings tab. Page 51 f 147

52 Applicatin Persnalizatin Settings Settings fr discvering applicatins and applicatin data. Aut-discver user applicatins This ptin enables mnitring f managed endpints t detect the applicatins which are being used within an rganizatin. The executable name, versin and perating system are captured fr every applicatins launched. The cllected data can be viewed thrugh Persnalizatin Analysis reprts where applicatins can be added t the list f managed applicatins available t Persnalizatin Grups. Enable Applicatin Data Cllectin This ptin enables registry and flder usage data t be passively cllected frm endpints as users run applicatins. Cautin: Enabling this ptin causes a significant increase in system utilizatin n managed endpints. It is recmmended that Applicatin Data Cllectin is disabled when n lnger required. This data can be used when adding new applicatins t the Persnalizatin cnfiguratin. Windws Persnalizatin Sync Optins Select when yu want Windws Persnalizatin settings t be saved t the database: On Lg Off On Sessin Lck On Sessin Discnnect Any cmbinatin f the abve settings can be applied. Scriptable Sync Windws Persnalizatin settings can be synchrnized n demand using a PwerShell cmdlet, installed with the Envirnment Manager Agent. Befre using the cmmand, imprt the EmCmdlet.dll - pen Windws PwerShell and enter the fllwing: imprt-mdule 'C:\Prgram Files\AppSense\Envirnment Manager\Agent\EmCmdlet.dll' If yu have changed the default install lcatin, amend the file path accrdingly. Page 52 f 147

53 Enter Test-EmUserOperatins t verify that the cmdlet is able t cmmunicate with the server. The respnse shuld be True. T synchrnize Windws Persnalizatin settings, enter: Sync-DesktpSettings The Windws Settings fr that endpint are synchrnized with the database. The default timeut fr the cmdlet is 30 secnds. Hwever, this can be changed using the -Timeut argument. Fr example, Sync-DesktpSettings -Timeut 60 Other standard PwerShell arguments can be used in cnjunctin with the cmdlet. Fr example, - verbse. Lcal Cache The Lcal Cache settings manage persnalizatin behavir fr users when they are nt cnnected t the crprate netwrk. When Lcal Cache is enabled, a cpy f a user s virtual cache, cntaining their persnalizatin settings, is retained n the managed endpint when they lg ff. When the user subsequently lgs n whilst discnnected frm the netwrk, their persnalizatin settings are available. The next time the user lgs n t the crprate netwrk, any changes t managed applicatins made ffline are synchrnized with the database. Fr the virtual cache t exist fr an applicatin ffline, that applicatin must have been pened and clsed n the specific endpint, prir t ging ffline. If a virtual cache des nt exist fr an applicatin n the endpint, persnalizatin settings are nt applied and the applicatin pens with its default settings. Nt having cache at applicatin start means any changes made are nt synchrnized t the database and are lst. It is nly necessary t enable lcal caching fr physical devices which may have intermittent cnnectivity t the crprate netwrk, fr example, laptps which are taken hme. This ensures that Persnalizatin settings are still available n the endpint when there is n cnnectin t the Persnalizatin Server. It is generally nt required fr virtual machines. There are three Lcal Cache settings: Disabled - The virtual cache is deleted when users lg ff frm the crprate netwrk. Any changes a user makes t managed applicatins whilst ffline are lst when they next cnnect t the netwrk. Always enabled - Each time a user lgs ff, a cpy f their virtual cache is saved n their endpint. Whilst wrking ffline, their persnalizatin data is updated lcally as changes t managed applicatins are made and synchrnized t the database when nline. Enabled if the fllwing cnditins are true - A set f cnditins gvern the circumstances under which the virtual cache is saved at lgff. Tw further Lcal Cache ptins can be selected in additin t the settings abve: Page 53 f 147

54 Enable Pre-cache - All applicatin persnalizatin data is dwnladed t the lcal cache at lgn rather than when each applicatin is run. This ptin is nly available when Lcal Cache is enabled. The availability f the Pre-Cache ptin is dependent n lcal cache being enabled and any specified cnditins being met. If the cnditins are nt met, pre-caching n the client will nt take place. Save caches n failed lgff sync - If cmmunicatin between a managed endpint and the database is interrupted r lst, synchrnizatin f persnalizatin data frm the endpint t the database is retried at regular intervals until cmmunicatin is re-established. When the cnnectin is restred, persnalizatin data is synchrnized t the database. If cmmunicatin is nt restred and the user lgs ff, persnalizatin data fr that sessin r applicatin is lst. Hwever, if Lcal Cache is enabled the persnalizatin data is saved n the endpint and is synchrnized fllwing successful cnnectin with the database. Cnfigure Lcal Cache Cnditins 1. Select a persnalizatin grup In the User Persnalizatin navigatin tree. 2. Select the Settings tab. 3. In the Lcal Cache sectin f the wrk area, select, Enabled if the fllwing cnditins are true. The Cnditins ribbn is displayed. Fr a user t be subject t Lcal Cache rules they must first be a member f the selected persnalizatin grup; ffline rules are nly cnsidered nce grup membership has been established. 4. Select a cnditin frm the Cnditins ribbn. The dialg fr the selected cnditin displays. 5. Cnfigure the cnditin and click OK. The new cnditin displays under the Membership Rules tab. 6. T further define grup membership fr the persnalizatin grup, add mre cnditins. Mre cmplex cnditins can be cnfigured using AND and OR statements: AND Rule - Right-click n an existing cnditin, select Insert Cnditin and cnfigure the cnditin as required. OR Rule - Right-click in the wrk area and select Add Cnditin Grup and cnfigure the cnditin as required. Cnditin grups can be edited and deleted by selecting Edit Cnditin r Delete Cnditin frm the shrtcut menu. Page 54 f 147

55 Lcal Cache Cnditins The table belw lists the cnditins available fr the Enabled if the fllwing cnditins are true ptin is selected fr a Persnalizatin Grup. Type User Cnditin User Name User Grup Is Administratr Cmputer Is Laptp Cmputer Name Cmputer Dmain Cmputer NETBIOS Name Cmputer Grup Cmputer IP Address Operating System Is VDI Directry Membership User OU Membership Cmputer OU Membership Site Membership Sessin and Client Client Cnnectin Prtcl Persnalizatin Grup Membership Rules The Membership Rules fr a Persnalizatin grup are gverned by cnditins which must be satisfied fr a user t be managed by that persnalizatin grup. The cnditins are based n user attributes, cmputer specificatins and directry membership. Membership can be based n a single cnditin r a user may have t fulfill a number f cnditins t be managed by a Persnalizatin grup. Page 55 f 147

56 Rule Types Membership t a Persnalizatin grup can be based n tw rule types: AND - Multiple cnditins must be satisfied fr membership f the Persnalizatin grup. This is called a cnditin grup.a cnditin grup has been created cntaining tw cnditins: Users must fulfill bth cnditins t be managed by the Persnalizatin grup. OR - By satisfying the cnditins fr ne f a number f cnditins r cnditin grups, users are managed by the Persnalizatin grup. A secnd cnditin grup has been added. T be managed by this persnalizatin grup, a user must fulfill all the cnditins in the first cnditin grup r all the cnditins in the secnd cnditin grup. Membership Cnditins Persnalizatin Grup Membership cnditins are a subset f the cnditins used in the Envirnment Manager Plicy cnsle. Mst f the membership rules cnditins use the same fields t set the validatin. The image belw shws the User Grup cnditin dialg. Page 56 f 147

57 Mst cnditins use the same fields t create a cnditin. Select an ptin frm the Cnditin drpdwn. The fllwing ptins are available: Equal - A cmparisn is made against the cntents f the Match field t target the users r cmputers which fulfill thse criteria Nt Equal - Targets all users r cmputers which d nt fulfill the criteria in the Match field. Query - Targets all users r cmputers which match the criteria specified in the Query field. Using wildcards in the query allws a wide range f matches, fr example: *Windws - matches text ending in Windws. Windws* - matches text starting with Windws. *Windws* - matches text cntaining Windws. Page 57 f 147

58 Create Grup Persnalizatin Membership Rules 1. In the User Persnalizatin navigatin pane select Persnalizatin Grups. 2. Select a persnalizatin grup. 3. Right-click in the Membership Rules wrk area and select Add Cnditin Grup frm the shrtcut menu. 4. Highlight a cnditin type; User, Cmputer r Directry Membership and select a cnditin. The available cnditins are listed in Persnalizatin Grup Cnditins. The dialg bx fr the selected cnditin displays. The fllwing cnditins are available fr persnalizatin grup membership rules: Type User Cnditin User Name User Grup Is Administratr Cmputer Cmputer Name Cmputer Dmain Cmputer NETBIOS Name Cmputer Grup Cmputer IP Address Directry Membership User OU Membership Cmputer OU Membership Site Membership 5. Cnfigure the cnditin and click OK. The new cnditin grup displays under Membership Rules. The title f the cnditin entered int the Descriptin field in the General tab, is the display name fr the cnditin in the Persnalizatin grup. If a descriptin is nt entered, the cnditin details frm the display name. Page 58 f 147

59 6. T further define grup membership fr the Persnalizatin grup, add mre cnditins: AND Rule - Right-click n an existing cnditin, select Insert Cnditin and cnfigure the cnditin as required. OR Rule - Right-click in the wrk area and select Add Cnditin Grup and cnfigure the cnditin as required. Cnditin grups can be edited and deleted by selecting Edit Cnditin r Delete Cnditin frm the shrtcut menu. Applicatin Persnalizatin fr Persnalizatin Grups Applicatin Grups enable applicatins which interact tgether, using cmmn registry keys and flders, t be managed as a single grup fr persnalizatin. Applicatins must be in an Applicatin Grup befre they can be persnalized. When creating an applicatin, ptins are available t add it t a new r existing Applicatin Grup. This makes it easier t add new applicatins that share cmmn settings with existing applicatins. Applicatin Grups can be added t a Persnalizatin Grup using ne f the fllwing methds: Add Existing Applicatin Grups Add Existing Ungruped Applicatins Add a New Applicatin t a Persnalizatin Grup by Name Add a New Applicatin t a Persnalizatin Grup frm Applicatin Data Cllectin Add a New Applicatin Grup t a Persnalizatin Grup frm Template Add Existing Applicatin Grups Add existing Applicatin Grups t be persnalized fr users wh match the membership rules f the Persnalizatin Grup. 1. In the User Persnalizatin navigatin pane select Persnalizatin Grups. 2. Select a persnalizatin grup. 3. Select the Applicatin Persnalizatin tab. 4. Click Add Existing. The Select Applicatin Grups dialg displays. 5. Select ne r mre Applicatin Grups. Multiple Applicatin Grups can be selected using the Ctrl r Shift keys. 6. Click OK. The selected Applicatin Grup is added t the Persnalizatin Grup. Page 59 f 147

60 Add Existing Ungruped Applicatins Add existing ungruped applicatins, that are nt part f an Applicatin Grup, t be persnalized fr users wh match the membership rules f the Persnalizatin Grup. 1. In the User Persnalizatin navigatin pane select Persnalizatin Grups. 2. Select a persnalizatin grup. 3. Select the Applicatin Persnalizatin tab. 4. Click Add Existing. The Select Applicatin Grups dialg displays. 5. Select Select Ungruped Applicatins. The Select Ungruped Applicatins ptin displays nly when applicatins that are nt part f an Applicatin Grup are available t add. Ungruped applicatins that are nt part f an Applicatin Grup display at the bttm f the dialg. 6. Select ne r mre applicatins. Multiple applicatins can be selected using the Ctrl r Shift keys. 7. Click OK. The selected applicatin is added t the Persnalizatin Grup. Add a New Applicatin t a Persnalizatin Grup by Name 1. Add a new applicatin, either t a new r existing Applicatin Grup, t be persnalized fr users wh match the membership rules f the Persnalizatin Grup. 2. In the User Persnalizatin navigatin pane select Persnalizatin Grups. 3. Select a persnalizatin grup. 4. Select the Applicatin Persnalizatin tab. 5. Click New By Name. The Add an Applicatin dialg displays. 6. In the Executable field, enter an applicatin executable name r click the ellipsis (...) t select an applicatin frm the file system. 7. Optinally, in the Flder field, enter a flder path r click the ellipsis t select a flder frm the file system. The applicatin is managed nly if it is lcated in the specified flder. If the field is left blank, all applicatins matching the entered criteria are managed, regardless f lcatin. Page 60 f 147

61 8. In the Name field, enter a name t uniquely identify the applicatin within the Envirnment Manager cnsle. Applicatins must nt have the same name as existing applicatins r Applicatin Grups. 9. Optinally, tick Advanced Details and, in the Operating System and Applicatin Versin fields, enter regular expressins t target a specific perating system and/r applicatin versin. Alternatively, use the.* default regular expressin t include all perating systems and applicatin versins. The specified cmbinatin f executable name, perating system and applicatin versin must nt match existing applicatins. Applicatins must be added t a new r existing Applicatin Grup: 10. New Applicatin Grup - Specify the Applicatin Grup name in the Create New Applicatin Grup field. The Applicatin Grup name is autmatically ppulated frm the applicatin name, hwever it can be changed as required. Applicatin Grups must nt have the same name as existing applicatins r Applicatin Grups. 11. Existing Applicatin Grup - Select an existing Applicatin Grup in the Add t Existing Applicatin Grup field. 12. Click OK. The Applicatin Grup is added t the Persnalizatin Grup. Add a New Applicatin t a Persnalizatin Grup frm Applicatin Data Cllectin Applicatin Data Cllectin passively cllects data frm managed endpints as users run applicatins. Registry key and flder paths that are written t and read frm are recrded fr each applicatin. On applicatin clse, the data is stred in the Envirnment Manager Persnalizatin database. The cllected data can be used t create new applicatins and add t registry and flder inclusins t existing Applicatin Grups. Applicatin Data Cllectin can be used in the fllwing mdes: Add a New Applicatin t a Persnalizatin Grup frm Autmatic Cnfiguratin Add a New Applicatin t a Persnalizatin Grup frm Manual Cnfiguratin Add a New Applicatin t a Persnalizatin Grup frm Autmatic Cnfiguratin Envirnment Manager analyzes the cllected data and uses it t create an autmatic cnfiguratin. In the autmatic cnfiguratin, paths are gruped t cmmn parents and paths which are nt recmmended fr inclusin are filtered ut. Page 61 f 147

62 1. In the User Persnalizatin navigatin pane select Persnalizatin Grups. 2. Select a persnalizatin grup. 3. Select the Applicatin Persnalizatin tab. 4. Click New frm Data Cllectin. The Add Applicatin - Data Cllectin dialg displays. The dialg lists applicatins that have been cllected by Applicatin Data Cllectin. 5. Select ne f the fllwing radi buttns t target specific applicatin versins: Use Majr Applicatin Versin - Applicatins are gruped by their majr versin number. Fr example, 5.0 and 5.1 are gruped tgether, but 6.0 is separate. Use All Applicatin Versins - Applicatins are gruped, regardless f their versin number. Fr example, 5.0, 5.1 and 6.0 are gruped tgether. 6. Select an applicatin frm the list. 7. Click View autmatic cnfiguratin details. A read-nly cpy f the cnfiguratin displays. Frm the snapsht taken at each applicatin clse, the fllwing statistics are calculated and displayed alngside each registry key r flder path fr all users that have run the applicatin: Occurrences - The ttal number f times that the registry path r flder path has been accessed by the applicatin. Average Size - The average size f the data in the registry key r flder frm each applicatin clse. Fr example, a size f 100 bytes at the first applicatin clse and a size f 200 bytes at the secnd applicatin clse displays as an average size f 150 bytes. Peak Size - The largest recrded size f the data in the registry key r flder frm each applicatin clse. Fr example, a size f 100 bytes at the first applicatin clse and a size f 200 bytes at the secnd applicatin clse displays as a peak size f 200 bytes. The cumulative sizes f the Average Size and Peak Size displays at the bttm f the dialg. This infrmatin shws the ptential prfile size per user if the applicatin is persnalized. 8. Click Dne t clse the autmatic cnfiguratin view. The autmatic cnfiguratin clses. 9. Click OK.The Enter Details dialg displays. 10. In the Name field, enter a name t uniquely identify the applicatin within the Envirnment Manager cnsle. Applicatins must nt have the same name as existing applicatins r Applicatin Grups. Page 62 f 147

63 11. Applicatins must be added t a new r existing Applicatin Grup: 12. Click OK. New Applicatin Grup - Specify the Applicatin Grup name in the Create New Applicatin Grup field. The Applicatin Grup name is autmatically ppulated frm the applicatin name, hwever it can be changed as required. Applicatin Grups must nt have the same name as existing applicatins r Applicatin Grups. Existing Applicatin Grup - Select an existing Applicatin Grup in the Add t Existing Applicatin Grup field. The Applicatin Grup is added t the Persnalizatin Grup. Add a New Applicatin t a Persnalizatin Grup frm Manual Cnfiguratin 1. Using manual cnfiguratin, registry and flder inclusins can be cnfigured frm the cllected data t create an applicatin cnfiguratin t suit yur requirements. 2. In the User Persnalizatin navigatin pane select Persnalizatin Grups. 3. Select a persnalizatin grup. 4. Select the Applicatin Persnalizatin tab. 5. Click New frm Data Cllectin. The Add Applicatin - Data Cllectin dialg displays. The dialg lists applicatins that have been cllected by Applicatin Data Cllectin. 6. Select ne f the fllwing radi buttns t target specific applicatin versins: Use Majr Applicatin Versin - Applicatins are gruped by their majr versin number. Fr example, 5.0 and 5.1 are tgether, but 6.0 is separate. Use All Applicatin Versins - Applicatins are gruped, regardless f their versin number. Fr example, 5.0, 5.1 and 6.0 are gruped tgether. 7. Tick N, I want t cnfigure this applicatin manually (advanced). Page 63 f 147

64 8. Click Cnfigure. The dialg lists all registry keys and flder paths which have been cllected by Applicatin Data Cllectin fr the selected applicatin. Frm the snapsht taken at each applicatin clse, the fllwing statistics are calculated and displayed alngside each registry key r flder path fr all users that have run the applicatin: Occurrences - The ttal number f times that the registry path r flder path has been accessed by the applicatin. Average Size - The average size f the data in the registry key r flder frm each applicatin clse. Fr example, a size f 100 bytes at the first applicatin clse and a size f 200 bytes at the secnd applicatin clse displays as an average size f 150 bytes. Peak Size - The largest recrded size f the data in the registry key r flder frm each applicatin clse. Fr example, a size f 100 bytes at the first applicatin clse and a size f 200 bytes at the secnd applicatin clse displays as a peak size f 200 bytes. If required, tick Hide paths which are rarely persnalized t filter ut paths which are nt recmmended fr inclusin. 9. Tick the registry and flder paths t be added as inclusins fr the Applicatin Grup. As paths are selected and deselected, the Applicatin Prfile Size updates with the cumulative sizes f the Average Size and Peak Size fr the selected paths. This infrmatin shws the ptential prfile size per user if the applicatin is persnalized. 10. Click OK. The Enter Details dialg displays. 11. In the Name field, enter a name t uniquely identify the applicatin within the Envirnment Manager cnsle. Applicatins must nt have the same name as existing applicatins r Applicatin Grups. Applicatins must be added t a new r existing Applicatin Grup: 12. Click OK. New Applicatin Grup - Specify the Applicatin Grup name in the Create New Applicatin Grup field. The Applicatin Grup name is autmatically ppulated frm the applicatin name, hwever it can be changed as required. Applicatin Grups must nt have the same name as existing applicatins r Applicatin Grups. Existing Applicatin Grup - Select an existing Applicatin Grup in the Add t Existing Applicatin Grup field. The Applicatin Grup is added t the Persnalizatin Grup. Page 64 f 147

65 Add a New Applicatin Grup t a Persnalizatin Grup frm Template Imprt ne r mre Applicatin Grups frm the built-in templates r frm a template file. If a template is available, it is recmmended that the template is used rather than adding the Applicatin Grup either manually r frm Applicatin Data Cllectin. Templates fr cmmnly used applicatins are available n cmmunity.ivanti.cm. 1. In the User Persnalizatin navigatin pane select Persnalizatin Grups. 2. Select a persnalizatin grup. 3. Select the Applicatin Persnalizatin tab. 4. Click Imprt Template. The Imprt Applicatin Grups dialg displays. 5. Select ne f the fllwing radi buttns: Imprt frm AppSense templates - Imprt frm the built-in Applicatin Grup templates. Templates are available fr cmmnly persnalized applicatins, such as Micrsft Internet Explrer and Micrsft Office. These templates cntain recmmended inclusins and exclusins fr persnalizatin. Imprt frm exprted cnfiguratin - Imprt frm an exprted Applicatin Grup template. When selected, a file brwser displays fr an Envirnment Manager Persnalizatin cnfiguratin t be selected. 6. Select the Applicatin Grups t imprt. T select all grups, select Applicatin Grups at the tp f the list. 7. Click OK. The selected Applicatin Grups are imprted int the cnfiguratin and added t the current Persnalizatin Grup. Persnalizatin Grup Applicatin Clashes Clashes ccur when an applicatin exists multiple times in a single persnalizatin grup. Envirnment Manager autmatically detects clashes between applicatins within a persnalizatin grup and will ntify yu f a clash when: An applicatin is added t a persnalizatin grup which already exists in an applicatin grup, assigned t the persnalizatin grup An applicatin grup is added t a persnalizatin grup which cntains an applicatin which already exists in the applicatins list fr that grup Clashing applicatins are managed based n the fllwing prcessing rder: Page 65 f 147

66 Applicatin grups Applicatins Glbal applicatin exclusins Clashing applicatins can cause unexpected behavir and shuld be reslved. Reslve applicatin clashes by remving the applicatin frm the applicatin grup, applicatins list r Applicatin Exclusins. Windws Persnalizatin and Persnalizatin Grups Fr each persnalizatin grup, a list f Windws Settings Grups can be cnfigured t tailr persnalizatin t the requirements f the users managed by that grup. Cnfigure Windws Persnalizatin fr a Persnalizatin Grup 1. In the User Persnalizatin navigatin pane select Persnalizatin Grups. 2. Select a persnalizatin grup. 3. Select the Windws Persnalizatin tab. 4. Click Add. The available Windws Settings Grups are listed. 5. Select a Windws Settings Grup and click OK. 6. Select multiple grups using the Ctrl r Shift keys. The Windws Settings Grups are added t the Persnalizatin Grup. Fr infrmatin n inclusin lgic when adding a Windws Settings Grup t a Persnalizatin Grup, see Windws Persnalizatin. Prfile Migratin Fr each Persnalizatin Grup, Prfile Migratin can be cnfigured t either imprt user prfile data int the database frm a lcal prfile r netwrk prfile r exprt user prfile data frm the database back int the lcal file system. Imprting Prfiles Imprt Restrictins During prfile Imprt, files may fail t synchrnize in the fllwing scenaris: The number f files within a specific prfile sync exceeds the IIS MaxHttpCllectinKeys setting - the default value is 1000 Page 66 f 147

67 The size f any single file exceeds the IIS maxallwedcntentlength setting - the default value is 30mb In bth scenaris, the prfile imprt fr Windws Settings r Applicatin Grups fails and is reprted as "failed t cpy data t target" fr the migratin state. Prfile Imprt cntinues t attempt t sync the remaining Prfile settings. If the issues abve are addressed, the imprt autmatically retries at the next lgn if the user has nt subsequently captured persnalizatin fr Windws Settings grups r that specific applicatin grup. If persnalizatin data has been captured subsequently by the user, after fixing the prfile surce, the captured data fr the failed applicatin grup r Windws Settings Grup must be deleted fr it t be imprted n next lgn. Files that cannt be read, such as thse lcked by anther applicatin, are nt be imprted. Cnfigure Prfile Migratin t Imprt Data frm a Lcal Prfile User prfile data is cpied at lgn frm the lgged n user s lcal prfile t the Envirnment Manager virtual cache. This data cnsists f included registry, flder and file paths fr managed Applicatin Grups and Windws Settings Grups. 1. In the User Persnalizatin navigatin pane select Persnalizatin Grups. 2. Select a persnalizatin grup. 3. Select the Prfile Migratin tab. 4. Click Edit. The User Prfile Migratin Settings dialg displays. 5. Select Imprt existing user settings t Persnalizatin. 6. Select Lcal frm the Surce drp-dwn. 7. Click OK. If settings frm a previus imprt peratin exist fr the Persnalizatin Grup, a dialg displays. The fllwing ptins are available: Resume the previus imprt - Existing settings are nt replaced, but registry, flder r file inclusins which d nt have data are imprted. Start a new imprt - Existing settings are verwritten with imprted user prfile data. Prfile Migratin Imprt is enabled fr users within the Persnalizatin Grup. At lgn, data frm included registry, flder and file paths fr managed Applicatin Grups and Windws Settings Grups within the user prfile is cpied int the database. Page 67 f 147

68 Cnfigure Prfile Migratin t Imprt Data frm a Netwrk Prfile User prfile data is cpied at lgn frm the prfile at the specified netwrk path t the Envirnment Manager virtual cache. This data cnsists f all included registry, flder and file paths fr managed Applicatin Grups and Windws Settings Grups. AppData can be imprted frm a separate netwrk path if required. Advanced Certificates, General Flder Optins and Icns Windws Settings, cannt be imprted frm a netwrk lcatin. 1. In the User Persnalizatin navigatin pane select Persnalizatin Grups. 2. Select a persnalizatin grup. 3. Select the Prfile Migratin tab. 4. Click Edit. The User Prfile Migratin Settings dialg displays. 5. Select Imprt existing user settings t Persnalizatin. 6. Select Netwrk frm the Surce drp-dwn. 7. Enter a UNC path in the Netwrk Path field. Envirnment Variables within the specified netwrk path are expanded. The prfile versin number is appended t the specified netwrk path where required. The fllwing table shws the prfile paths fr each perating system if \\server\share\prfiles\%username% is specified: Operating system Windws 7 Windws Server 2008 R2 Windws 8 Windws Server 2012 Windws 8.1 Windws Server 2012 R2 Prfile versin V2 V3 V4 Example prfile path \\server\share\prfiles\%username%.v2 \\server\share\prfiles\%username%.v3 \\server\share\prfiles\%username%.v4 Windws 10 V5 \\server\share\prfiles\%username%.v5 8. If AppData is stred in a separate lcatin, tick Enable AppData t be imprted frm a netwrk lcatin and specify a UNC path in the AppData Path field. Page 68 f 147

69 9. Click OK. If settings frm a previus imprt peratin exist fr the Persnalizatin Grup, a dialg displays. The fllwing ptins are available: Resume the previus imprt - Existing settings will nt be replaced, but registry, flder r file inclusins which d nt have data will be imprted. Start a new imprt - Existing settings will be verwritten with imprted user prfile data. Prfile Migratin Imprt is enabled fr users within the Persnalizatin Grup. At lgn, data frm included registry, flder and file paths fr managed Applicatin Grups and Windws Settings Grups within the user prfile is cpied int the database. Imprt Activity fr Cnfiguratin Updates After cnfiguring Prfile Migratin in Imprt mde, a prmpt displays if either: Applicatin Grups r Windws Settings Grups are added t the Persnalizatin Grup Included registry, flder r file paths are added t a managed Applicatin Grup r Windws Settings Grup. Select frm ne f the ptins belw. Optin Cmmit the change and restart the Imprt fr the affected grups Cmmit the change but nly fr new users Descriptin The Applicatin Grup r Windws Settings Grup is added t the Persnalizatin Grup r the included registry, flder r file path is added t the managed Applicatin Grup r Windws Settings Grup. The imprt is restarted fr all users within the Persnalizatin Grup, regardless f whether data has already been imprted fr the user. The Applicatin Grup r Windws Settings Grup is added t the Persnalizatin Grup r the included registry, flder r file path is added t the managed Applicatin Grup r Windws Settings Grup. The imprt is started fr users in the Persnalizatin Grup wh d nt have existing data. Exprting Prfiles Exprt existing data frm the Envirnment Manager Persnalizatin database int user prfiles. Cnfigure Prfile Migratin t Exprt Prfiles User prfile data is cpied at lgn frm the database t the lgged n user s lcal prfile. Page 69 f 147

70 1. In the User Persnalizatin navigatin pane select Persnalizatin Grups. 2. Select a persnalizatin grup. 3. Select the Prfile Migratin tab. 4. Click Edit. The User Prfile Migratin Settings dialg displays. 5. Select Exprt user settings back t their User Prfile. 6. Click OK. Prfile Migratin Exprt is enabled fr users within the Persnalizatin Grup. At lgn, data frm the database is cpied int the user prfile. Changing Mdes The table belw shws the behavir when changing Prfile Migratin mdes. Operating system Prfile versin Example prfile path Disabled Imprt If settings frm a previus imprt peratin exist fr the Persnalizatin Grup, a dialg displays. The fllwing ptins are available: Resume the previus imprt - Existing settings will nt be replaced, but registry, flder r file inclusins which d nt have data will be imprted. Start a new imprt - Existing settings will be verwritten with imprted user prfile data. At lgn, settings frm the lgged n user s prfile are cpied int the database. Disabled Exprt At lgn, settings frm the database are cpied int the lgged n user s prfile. Imprt Disabled The imprt peratin is stpped. It can be resumed, hwever users wh have nt been migrated will have their user prfile settings verwritten. Imprt Exprt The imprt peratin is stpped and cannt be resumed. At lgn, settings frm the database are cpied int the lgged n user s prfile. Exprt Disabled The exprt peratin is stpped and cannt be resumed. Exprt Imprt The exprt peratin is stpped and cannt be resumed. At lgn, settings frm the lgged n user s prfile are cpied int the database. Page 70 f 147

71 Prfile Migratin PwerShell Interface Prfile Migratin can be scripted t imprt r exprt applicatin r Applicatin Grup data between the database and the Windws prfile n the client. It is recmmended that Prfile Migratin is cnfigured thrugh the Envirnment Manager Persnalizatin cnsle. The cmdlet shuld be used nly where granular cntrl is required t migrate individual applicatins r Applicatin Grups, such as mving data frm ungruped applicatins t Applicatin Grups. The cmdlet can assist with the careful migratin f prfile data, such as where multiple versins f Micrsft Office are used cncurrently within the envirnment. T migrate data frm ungruped applicatins t Applicatin Grups, exprt the applicatin t the lcal prfile and then imprt it int an Applicatin Grup. The PwerShell cmdlet has the fllwing behavir: It is supprted nly when Prfile Migratin is nt enabled n the Persnalizatin Server. Migratin ccurs as many times as the cmdlet is executed. The state is nt recrded and it is the respnsibility f the administratr t ensure it is used nly as required. T ensure data integrity, the migratin ccurs nly if there is n instance f an applicatin running fr the specified applicatin r Applicatin Grup. Errrs are presented thrugh the raising f an exceptin after executin. Help Further help is available by entering the fllwing cmmand: get-help <cmdlet name> Lad the Prfile Migratin PwerShell Mdule The mdule is installed in the Envirnment Manager Agent directry. Use the fllwing cmmand t lad the PwerShell mdule: Imprt-Mdule "C:\Prgram Files\AppSense\Envirnment Manager\Agent\EmCmdlet.dll" If yu have changed the default install lcatin, amend the file path accrdingly. Alternatively, use the fllwing cmmand t lad the PwerShell mdule frm the current installatin directry: Imprt-Mdule ((Get-ItemPrperty 'HKLM:\SOFTWARE\AppSense\Envirnment Manager').ClientPath + 'EmCmdlet.dll' Imprt Prfiles Using the Prfile Migratin PwerShell Interface The Imprt-EMPManagedAppData cmdlet perfrms a migratin f prfile data frm the Windws Prfile int a Managed Applicatin prfile. The Managed Applicatin s cnfigured registry, flder and file inclusins and exclusins are used as the lcatins t imprt data frm. Page 71 f 147

72 The Windws prfile can be either the lcal prfile r a raming prfile stred n a netwrk lcatin. The fllwing parameters are available: Parameter -App (Mandatry) -PrfilePath (Optinal) -PrfileAppDataPath (Optinal if PrfilePath is supplied) -Merge (Optinal switch) -Verbse (Optinal switch) Descriptin The name f the managed applicatin r managed Applicatin Grup against which t perfrm the imprt. This is the Display Name as seen in the Persnalizatin Cnsle. The path t the Windws Prfile t use as the surce f the data as an alternative t imprting frm the lcal prfile. This path must be a Windws Prfile Versin agnstic path and s shuld nt include any versin suffix such. Fr example, a prfile path f \\server\share\user1.v2 shuld be entered as \\server\share\user1. Only prfile versins that match the current perating system r earlier are supprted. Fr example, it is nt pssible t imprt frm a Windws 10 prfile when running n a Windws 7 machine. An apprpriate prfile is selected at the cnfigured lcatin by lking fr a versin that matches the current perating system. If a matching prfile is nt fund, then an earlier prfile versin is used. The use f Envirnment Variables specific t the current user sessin is supprted. When imprting frm a netwrk prfile, this parameter can be used t specify the path t Raming AppData flder when it is nt part f the user s prfile lcatin. The use f Envirnment Variables specific t the current user sessin is supprted. If specified, the actin merges the persnalized data with the data frm the Windws Prfile. The persnalized data takes precedence and is nt replaced. If nt specified, the actin clears the existing prfile data befre the imprt takes place. Prvides verbse utput f the PwerShell cmmand fr diagnstic purpses. Examples The fllwing shws an example f imprting data frm the lcal Windws Prfile fr the Managed Applicatin Ntepad: Imprt-Mdule ((Get-ItemPrperty 'HKLM:\SOFTWARE\AppSense\Envirnment Manager').ClientPath + 'EmCmdlet.dll') Imprt-EMPManagedAppData -App Ntepad The fllwing shws an example that culd be used inside an Envirnment Manager Plicy Custm Cnditin where the exit cde f the script is used t determine if the cnditin result: try Page 72 f 147

73 { Imprt-Mdule ((Get-ItemPrperty 'HKLM:\SOFTWARE\AppSense\Envirnment Manager').ClientPath + 'EmCmdlet.dll') Imprt-EMPManagedAppData -App Ntepad } catch { # Exit with an errr [System.Envirnment]::Exit(1) } Exprt Prfiles Using the Prfile Migratin PwerShell Interface The Exprt-EMPManagedAppData cmdlet perfrms a migratin f prfile data frm a managed applicatin r Applicatin Grup back t the Windws Prfile. The fllwing parameters are available Parameter -App (Mandatry) -Verbse Descriptin The name f the managed applicatin r managed Applicatin Grup against which t perfrm the exprt. This is the Display Name as seen in the Persnalizatin Cnsle. Prvides verbse utput f the PwerShell cmmand fr diagnstic purpses. (Optinal switch) Excluded Users If persnalizatin is enabled, all users are assigned t a Persnalizatin Grup. Users with an Envirnment Manager agent installed and cnfiguratin deplyed wh d nt fulfill the membership rules fr any ther grup, are managed by the Default Users grup. Hwever, persnalizatin may nt be required fr all users. Fr example, yu may nt wish t save the persnalizatin settings fr system administratrs wh rutinely lg nt multiple users machines. It is unlikely they wuld require their wn desktp settings t ram with them nt each machine they lg nt. In rder t exclude a specific user r cmputer frm persnalizatin create a Persnalizatin Grup with each ptin n the Settings tab disabled and with n managed applicatins, Applicatin Grups r Windws Settings Grups cnfigured. This effectively remves grup members frm user persnalizatin. By creating an apprpriate membership rules, the users and cmputers which d nt require persnalizatin, can be excluded. Page 73 f 147

74 Endpint Self-Service Tl The Endpint Self-Service tl prvides mnitring and management f certain Envirnment Manager settings and data. It is available t users and managed endpints fr Persnalizatin Grups which have it enabled. The Endpint Self-Service tl is available frm the Envirnment Manager Infrmatin icn in the Windws System Tray. Right-click n the icn t access the functinality. The Endpint Self-Service Tl requires.net4 t run. If this is unavailable, lcal audit event 9680 is created. The ptins available frm the Endpint Self-Service tl vary depending n whether the user is a standard r administrative user. T accmmdate these user types, the Endpint Self-Service Tl has tw peratinal mdes: Basic - Fr standard users. Advanced - Fr users that are assigned an administrative rle in the Persnalizatin Database. Enable the Endpint Self-Service Tl This prcess explains hw t enable the Endpint Self-Service tl fr Persnalizatin Grups. 1. In the User Persnalizatin navigatin pane select Persnalizatin Grups. 2. Select a persnalizatin grup. 3. Select the Endpint Self-Service tab. 4. Select ne f the fllwing ptins: Disabled - The Endpint Self-Service tl is nt available fr users in the selected Persnalizatin Grup. Enabled fr all users in grup - The Endpint Self-Service tl is available fr members f the selected Persnalizatin Grup. Enabled if the fllwing cnditins are true - The Endpint Self-Service tl is nly available fr members f the selected Persnalizatin Grup, if certain cnditins are met. Any users r cmputers that have been specified in the Membership Rules fr a Persnalizatin Grup have access t the tl when they lg n. Endpint Self-Service Functinality fr Standard Users Any endpints where the Endpint Self-Service Tl is enabled fr a Persnalizatin Grup can perfrm the fllwing basic tasks: Rllback r delete Persnalizatin data archives Shw plicy actin prgress Page 74 f 147

75 Archiving The Archive Management dialg displays when a user selects the Archiving ptin frm the Envirnment Manager Infrmatin System Tray icn. The dialg displays a list f all assciated Applicatins, Applicatin Grups and Windws Settings Grup archives fr that user. Rllback Select an Applicatin r Windws Settings Grup archive and click Rllback. All Persnalizatin settings are returned t the state they were when the previus archive was created. Users are prmpted t cnfirm that the rllback actin is t be perfrmed and are infrmed when the rllback is cmplete. Delete Select an Applicatin r Windws Settings Grup archive and click Delete. Any user settings cntained within the selected archive are deleted. Plicy Actin Prgress The Shw Plicy Actin Prgress ptin displays the percentage prgress f any triggered cpy flder actins. Endpint Self-Service Functinality fr Administrative Users Users that have the Envirnment Manager User rle f Master Administratr r Administratr can access the tl lcally n a managed endpint r remtely. Fr infrmatin n User Rles and hw they are assigned, see User Rles. Administrative users have access t bth the basic and the advanced functinality f the Endpint Self-Service tl. Administratrs have access t Sessin Infrmatin, can use archive functinality, update settings and alerts and refresh the lcal cache. Sessin Infrmatin Select the Sessin Infrmatin ptin frm the Envirnment Manager Infrmatin Windws System Tray icn frm where yu can view details f the managed endpint and user. The dialg has fur infrmatin categries: General Infrmatin - Displays the User name, Persnalizatin Server, the Persnalizatin Grup assciated with the currently lgged n user and the build versin f the current Envirnment Manager agent. The status f the license and whether Offline cache mde is enabled is als displayed. Applicatin Persnalizatin - Displays details f any Applicatin Grups and assciated Applicatins that are assigned t the managed endpint. Page 75 f 147

76 Windws Persnalizatin - Displays details f the Windws Settings Grups that are persnalized n the managed endpint and the date that Windws Persnalizatin settings were last archived. Glbal Includes and Excludes - Displays the registry, flder and file includes and excludes that are applied n the managed endpint. Archiving Select the Archiving ptin frm the Envirnment Manager Infrmatin Windws System Tray icn t access the Archive Manager dialg. Use this dialg t perfrm the fllwing tasks: Create Archive - Click Create t archive any current Applicatin, Custm r Windws Settings Grups. T prevent the archive frm being autmatically deleted, select the Prtected check bx befre yu click OK. Only ne archive can be prtected, if anther is already set t be prtected the mst recent ne is autmatically set and any previus prtectin remved. Edit Archives - Select an archive and click Edit t amend the descriptin f an Applicatin Grup archive. T prevent the archive frm being autmatically deleted, select the Prtected check bx befre yu click OK. Rllback Archive - Select an Applicatin r Windws Settings Grup archive and click Rllback. All Persnalizatin settings are returned t the state they were when the selected archive was created. Yu will be prmpted t cnfirm that the rllback actin is t be perfrmed and will be infrmed when the rllback is cmplete. Delete Archives - Select an Applicatin, Custm r Windws Settings Grup archive and click Delete. Any settings cntained within the selected archive are deleted. T delete a prtected archive, prtectin must first be remved. Settings and Alerts Use the Settings ptin frm the Envirnment Manager Infrmatin Windws System Tray icn t select which actin balln ntificatins are displayed n managed endpints. The Settings dialg can als be used t select a brder clr t surrund the windw frame f any managed applicatin when in use. Alerts Alert ntificatins are displayed as standard balln type ntificatins when actins are triggered. Select the required ntificatin types: Server link state - Displays the status f the cnnectin t the Persnalizatin Server and the Persnalizatin Server URL. Sync t server - Displays when the Applicatin Settings r Applicatin Grups Settings, n the managed endpint have synchrnized with thse n the Persnalizatin Server. Page 76 f 147

77 Sync frm server - Displays the Applicatins r Applicatin Grups Settings n the Persnalizatin Server have updated thse n the endpint. Sync failure - Displays when an attempted synchrnizatin fails. Managed Prcess start/stp - Displays when a managed prcess starts and stps. Virtualizatin service starts/stp - Displays when the virtualizatin service is started r the service has stpped. If the service has stpped, the icn in the Windws System Tray displays a yellw warning icn. Any Applicatins r Applicatin Grup Settings previusly handled are n lnger being managed. Virtualizatin service nt running - This alert ntificatin displays if the virtualizatin service has nt been started r is nt running. If the service has stpped, the icn in the Windws System Tray displays a yellw warning icn. Any Applicatins r Applicatin Grup Settings previusly handled are n lnger being managed. New cnfiguratin applied - This infrmatin ntificatin displays when a new cnfiguratin is applied t the managed endpint. Pre-cache cmplete - This infrmatin ntificatin displays when pre-caching is cmplete fr all Applicatins and Applicatins Grups assigned t the managed endpint. Pre-Caching is the prcess by which yu dwnlad existing Applicatin data frm the Persnalizatin Server t the lcal cache. Flder cpy/mirrr/sync cmplete - This infrmatin ntificatin displays when flder cpy actins are cmplete. Windws Frame T clearly identify a managed applicatin n the endpint, a clred brder can be placed arund the applicatin windw. Select Shw managed applicatin frame and chse the clr frm the Brder Clr drp-dwn list. When a managed applicatin is in use the applicatin has a clred brder. Refresh Lcal Cache Use the Refresh Lcal Cache ptin t help speed up netwrk access t data files by taking a cpy f the data stred n the Persnalizatin Server and refreshing the cached data n the managed endpint. This will ensure the lcal Persnalizatin cache is in sync with the Persnalizatin Database Using the Endpint Self-Service Tl Remtely Users assigned the Master Administratr r Administratr rle can use this tl remtely fr trubleshting purpses. When remtely lgged nt a machine, authrized users can run the EndpintSelfService.exe frm the Envirnment Manger installed lcatin, input their credentials and access all the administratr functinality frm the Envirnment Manager Infrmatin dialg. Page 77 f 147

78 Applicatin Persnalizatin The Applicatin Persnalizatin area f the cnsle is used t cnfigure a list f applicatins and Applicatin Grups which can be included fr persnalizatin. Applicatin Prcessing Rules When an applicatin is pened n a managed endpint, prcessing rules determine if it is managed and hw it is managed. Applicatins can be marked as fllws: Managed - The applicatin r prcess is managed, either individually r as part f an Applicatin Grup. Discvered - The applicatin is nt managed r excluded but the Persnalizatin Grup settings has Aut-discver user applicatins applied. Excluded - The applicatin has been added t the Applicatin Exclusins list r is the child prcess f an excluded applicatin. It will nt be discvered r managed when run n a managed endpint. Passive - The applicatin is nt managed but usage data is cllected fr analysis by the Applicatin Data Cllectin. Unless virtualizatin is disabled fr the prcess, a Persnalizatin Virtualizatin Cmpnent (PVC) cnfiguratin is created t redirect registry reads and writes and file and flder access t the virtual cache s that the prcess is virtualized. Applicatin Grups Applicatin Grups enable applicatins which interact tgether, using cmmn registry keys and flders, t be managed as a single grup fr persnalizatin. Applicatins must be in an Applicatin Grup befre they can be persnalized. When creating an applicatin, ptins are available t add it t a new r existing Applicatin Grup. This makes it easier t add new applicatins that share cmmn settings with existing applicatins. Inclusins and exclusins must be set at Applicatin Grup level. This ensures cnsistency acrss all applicatins within a grup. Applicatins in an Applicatin Grup share the same virtual cache. Persnalizatin settings are nly synchrnized with the Persnalizatin Server when: The initial applicatin in the grup is pened The last, pen applicatin in the grup is clsed Fr example, if all Micrsft Office applicatins are managed within ne grup and Outlk, Wrd and Excel are pened in that sequence, synchrnizatin ccurs nly when Outlk is pened. If Wrd, Outlk and Excel are clsed in that sequence, synchrnizatin ccurs nly when Excel is clsed. Page 78 f 147

79 Add an Applicatin Grup 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatin Grup. 2. In the Persnalizatin ribbn, click Add Applicatin Grup. The Add Applicatin dialg displays. 3. Enter a name fr the Applicatin Grup. Applicatin Grups must nt have the same name as existing applicatins r Applicatin Grups. 4. Click OK. 5. The Applicatin Grup is created in the navigatin pane. Add Existing Applicatins t an Applicatin Grup 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatin Grup. 2. Select an applicatin grup. 3. Frm the Persnalizatin ribbn, click Add Applicatin > Select Applicatin. The Select Applicatins dialg displays. 4. Select the required applicatins. Multiple applicatins can be selected using the Ctrl r Shift keys. 5. Click OK. The selected applicatins are added t the Applicatin Grup. Add a New Applicatin t an Applicatin Grup frm Applicatin Data Cllectin (Autmatic) 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatin Grups. 2. Select an applicatin grup. 3. Frm the Persnalizatin ribbn, click Add Applicatin > Select Applicatin. The Select Applicatins dialg displays. 4. Click New > Frm Applicatin Data Cllectin. The Add Applicatin - Data Cllectin dialg displays. The dialg lists applicatins that have been cllected by Applicatin Data Cllectin. Page 79 f 147

80 5. Select ne f the fllwing radi buttns t target specific applicatin versins: Use Majr Applicatin Versin - Applicatins are gruped by their majr versin number. Fr example, 5.0 and 5.1 are gruped tgether, but 6.0 is separate. Use All Applicatin Versins - Applicatins are gruped, regardless f their versin number. Fr example, 5.0, 5.1 and 6.0 are gruped tgether. 6. Select an applicatin frm the list. 7. Click View autmatic cnfiguratin details. A read-nly cpy f the cnfiguratin displays. 8. Frm the snapsht taken at each applicatin clse, the fllwing statistics are calculated and displayed alngside each registry key r flder path fr all users that have run the applicatin: Occurrences - The ttal number f times that the registry path r flder path has been accessed by the applicatin. Average Size - The average size f the data in the registry key r flder frm each applicatin clse. Fr example, a size f 100 bytes at the first applicatin clse and a size f 200 bytes at the secnd applicatin clse displays as an average size f 150 bytes. Peak Size - The largest recrded size f the data in the registry key r flder frm each applicatin clse. Fr example, a size f 100 bytes at the first applicatin clse and a size f 200 bytes at the secnd applicatin clse displays as a peak size f 200 bytes. The cumulative sizes f the Average Size and Peak Size displays at the bttm f the dialg. This infrmatin shws the ptential prfile size per user if the applicatin is persnalized. 9. Click Dne t clse the autmatic cnfiguratin view. The autmatic cnfiguratin clses. 10. Click OK. The Enter Details dialg displays. 11. In the Name field, enter a name t uniquely identify the applicatin within the Envirnment Manager cnsle. Applicatins must nt have the same name as existing applicatins r Applicatin Grups. 12. Click OK. 13. Select the new applicatin in the list and click OK. The applicatin is created and added t the Applicatin Grup. Add a New Applicatin t an Applicatin Grup frm Applicatin Data Cllectin (Manual) 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatin Grup. Page 80 f 147

81 2. Select an applicatin grup. 3. Frm the Persnalizatin ribbn, click Add Applicatin > Select Applicatin frm the Persnalizatin ribbn. The Select Applicatins dialg displays. 4. Click New > Frm Applicatin Data Cllectin. The Add Applicatin - Data Cllectin dialg displays. The dialg lists applicatins that have been cllected by Applicatin Data Cllectin. 5. Select ne f the fllwing radi buttns t target specific applicatin versins: 6. Use Majr Applicatin Versin - Applicatins are gruped by their majr versin number. Fr example, 5.0 and 5.1 are gruped tgether, but 6.0 is separate. 7. Use All Applicatin Versins - Applicatins are gruped, regardless f their versin number. Fr example, 5.0, 5.1 and 6.0 are gruped tgether. 8. Tick N, I want t cnfigure this applicatin manually (advanced). 9. Click Cnfigure. The dialg lists all registry keys and flder paths which have been cllected by Applicatin Data Cllectin fr the selected applicatin. 10. Frm the snapsht taken at each applicatin clse, the fllwing statistics are calculated and displayed alngside each registry key r flder path fr all users that have run the applicatin: Occurrences - The ttal number f times that the registry path r flder path has been accessed by the applicatin. Average Size - The average size f the data in the registry key r flder frm each applicatin clse. Fr example, a size f 100 bytes at the first applicatin clse and a size f 200 bytes at the secnd applicatin clse displays as an average size f 150 bytes. Peak Size - The largest recrded size f the data in the registry key r flder frm each applicatin clse. Fr example, a size f 100 bytes at the first applicatin clse and a size f 200 bytes at the secnd applicatin clse displays as a peak size f 200 bytes. 11. If required, tick Hide paths which are rarely persnalized t filter ut paths which are nt recmmended fr inclusin. 12. Tick the registry and flder paths t be added as inclusins fr the Applicatin Grup. 13. As paths are selected and deselected, the Applicatin Prfile Size updates with the cumulative sizes f the Average Size and Peak Size fr the selected paths. This infrmatin shws the ptential prfile size per user if the applicatin is persnalized. 14. Click OK. The Enter Details dialg displays. Page 81 f 147

82 15. In the Name field, enter a name t uniquely identify the applicatin within the Envirnment Manager cnsle. Applicatins must nt have the same name as existing applicatins r Applicatin Grups. 16. Click OK. The applicatin is created and is listed in the Select Applicatins dialg. 17. Select the new applicatin in the list and click OK. The applicatin is added t the Applicatin Grup. Add a New Applicatin by Name t an Applicatin Grup 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatin Grups. 2. Select an applicatin grup. 3. Frm the Persnalizatin ribbn, click Add Applicatin > Select Applicatin frm the Persnalizatin ribbn. The Select Applicatins displays. 4. Click New > By Name. 5. In the Applicatin field, enter an applicatin executable name r click the ellipsis (...) t select an applicatin frm the file system. 6. Optinally, in the Flder field, enter a flder path r click the ellipsis t select a flder frm the file system. The applicatin is managed nly if it is lcated in the specified flder. If the field is left blank, all applicatins matching the entered criteria are managed, regardless f lcatin. 7. In the Name field, enter a name t uniquely identify the applicatin within the Envirnment Manager cnsle. Applicatins must nt have the same name as existing applicatins r Applicatin Grups. 8. Optinally, in the Operating System and Applicatin Versin fields, specify regular expressins t target a specific perating system r applicatin versin. Alternatively, use the.* default regular expressin t include all perating systems and applicatin versins. The specified cmbinatin f executable name, perating system and applicatin versin must nt match existing applicatins. 9. Click OK. The applicatin is created and is listed in the Select Applicatins dialg. 10. Select the new applicatin in the list and click OK. The applicatin is added t the Applicatin Grup. Page 82 f 147

83 Path Based Cnfiguratin f Applicatin Grups When cnfiguring an applicatin grup, a file path t a flder can be specified s that any applicatin run frm that lcatin is managed. This means that applicatins d nt need t be individually added t a grup if thse applicatins are in the managed flder. Fr example, rather than adding each individual Micrsft Office applicatin t a grup, yu can define the path t the Micrsft Office flder. When Wrd, Excel and Outlk are pened frm this lcatin, they are managed by the Micrsft Office applicatin grup. Cnfigure an Applicatin Grup Using Managed Flders 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatin Grups. 2. Select an applicatin grup. 3. Frm the Persnalizatin ribbn, click Add Managed Flder. The Add Managed Flder dialg displays. 4. Enter a valid path r brwse t the required flder. Paths must adhere t the fllwing rules: Lcal and mapped drives are supprted UNC paths are nt supprted Fr the applicatins t be persnalized, the path must exist n the managed endpint CSIDL paths are supprted and are expanded t suit the target perating system All paths act as wildcards; an asterisk (*) is nt required Standard applicatin grup rules apply regarding synchrnizatin with the Persnalizatin Server. 5. Enter an Operating System. Alternatively, t include all perating systems, use the default regular expressin (.*) 6. Select the Manage all subflders checkbx as required. If unchecked, nly applicatins in the tp level flder will be managed. 7. Click OK t add the flder t the Managed Flders fr the persnalizatin grup. Applicatin Grup Templates Applicatin Grup templates cntain cnfiguratin details abut the Applicatin Grups and applicatins within the grup. Page 83 f 147

84 Exprt an Applicatin Grup 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatin Grup. 2. Right-click an applicatin grup and select Exprt Applicatin Grup Template. The Save As dialg displays. 3. Select a lcatin t save the template and click OK. An XML file cntaining the cnfiguratin details abut the Applicatin Grup and applicatins within the grup is created in the specified lcatin. Exprt multiple Applicatin Grups 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatin Grup. 2. Right-click an applicatin grup and select Exprt Applicatin Grup Template frm the cntext menu. The Exprt Applicatin Grups dialg displays. 3. Select ne r mre Applicatin Grups t exprt. 4. Click OK. The Save As dialg displays. 5. Select a lcatin t save the template and click OK. An XML file cntaining the cnfiguratin details abut the selected Applicatin Grups and applicatins within the grups is created in the specified lcatin. Imprt Applicatin Grups 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatin Grup. 2. Right-click an applicatin grup and select Imprt Applicatin Grup Template frm the cntext menu. 3. The Imprt Applicatin Grups dialg displays. Page 84 f 147

85 4. Select ne f the fllwing radi buttns: Imprt frm AppSense templates - In built Applicatin Grup templates are available fr cmmnly persnalized applicatins, such as Micrsft Internet Explrer and Micrsft Office. These templates cntain recmmended inclusins and exclusins fr persnalizatin. Imprt frm exprted cnfiguratin - Applicatin Grups can be imprted where an inbuilt Applicatin Grup template des nt exist. When selected, a file brwser displays fr an Envirnment Manager Persnalizatin cnfiguratin t be selected. 5. Select the Applicatins Grups t imprt. T select all Applicatin Grups, select Applicatin Grups at the tp f the list. 6. Click OK. The selected Applicatin Grups are imprted int the cnfiguratin. Applicatins The applicatins list allws a library f applicatins t be cnfigured which can be quickly added t Applicatin Grup and Persnalizatin Grups fr persnalizatin. Applicatins can be specified by versin and perating system allwing different instances f the same applicatin t be persnalized independently, even when the executable has the same name. Add a New Applicatin frm Applicatin Data Cllectin (Autmatic) 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatins. 2. In the Persnalizatin ribbn, click Add Applicatin > Frm Applicatin Data Cllectin. The Add Applicatin - Data Cllectin dialg displays. The dialg lists applicatins that have been cllected by Applicatin Data Cllectin. 3. Select ne f the fllwing radi buttns t target specific applicatin versins: Use Majr Applicatin Versin - Applicatins are gruped by their majr versin number. Fr example, 5.0 and 5.1 are gruped tgether, but 6.0 is separate. Use All Applicatin Versins - Applicatins are gruped, regardless f their versin number. Fr example, 5.0, 5.1 and 6.0 are gruped tgether. 4. Select an applicatin frm the list. Page 85 f 147

86 5. Click View autmatic cnfiguratin details. A read-nly cpy f the cnfiguratin displays. Frm the snapsht taken at each applicatin clse, the fllwing statistics are calculated and displayed alngside each registry key r flder path fr all users that have run the applicatin: Occurrences - The ttal number f times that the registry path r flder path has been accessed by the applicatin. Average Size - The average size f the data in the registry key r flder frm each applicatin clse. Fr example, a size f 100 bytes at the first applicatin clse and a size f 200 bytes at the secnd applicatin clse displays as an average size f 150 bytes. Peak Size - The largest recrded size f the data in the registry key r flder frm each applicatin clse. Fr example, a size f 100 bytes at the first applicatin clse and a size f 200 bytes at the secnd applicatin clse displays as a peak size f 200 bytes. The cumulative sizes f the Average Size and Peak Size displays at the bttm f the dialg. This infrmatin shws the ptential prfile size per user if the applicatin is persnalized. 6. Click Dne t clse the autmatic cnfiguratin view. The autmatic cnfiguratin clses. 7. Click OK. The Enter Details dialg displays. 8. In the Name field, enter a name t uniquely identify the applicatin within the Envirnment Manager cnsle. Applicatins must nt have the same name as existing applicatins r Applicatin Grups. Applicatins must be added t a new r existing Applicatin Grup: 9. Click OK. New Applicatin Grup - Specify the Applicatin Grup name in the Create New Applicatin Grup field. Applicatin Grups must nt have the same name as existing applicatins r Applicatin Grups. Existing Applicatin Grup - Select an existing Applicatin Grup in the Add t Existing Applicatin Grup field. The applicatin is created and is visible within the Applicatins wrk area. The registry and flder paths frm the Applicatin Data Cllectin autmatic cnfiguratin are added as inclusins fr the applicatin. The glbal registry, flder and file path inclusins are added as exclusins fr the applicatin t ensure that unexpected data is nt captured fr the applicatin. Page 86 f 147

87 Add a New Applicatin frm Applicatin Data Cllectin (Manual) 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatins. 2. In the Persnalizatin ribbn, click Add Applicatin > Frm Applicatin Data Cllectin. The Add Applicatin - Data Cllectin dialg displays. The dialg lists applicatins that have been cllected by Applicatin Data Cllectin. 3. Select ne f the fllwing radi buttns t target specific applicatin versins: Use Majr Applicatin Versin - Applicatins are gruped by their majr versin number. Fr example, 5.0 and 5.1 are tgether, but 6.0 is separate. Use All Applicatin Versins - Applicatins are gruped, regardless f their versin number. Fr example, 5.0, 5.1 and 6.0 are gruped tgether. 4. Tick N, I want t cnfigure this applicatin manually (advanced). 5. Click Cnfigure. The dialg lists all registry keys and flder paths which have been cllected by Applicatin Data Cllectin fr the selected applicatin. Frm the snapsht taken at each applicatin clse, the fllwing statistics are calculated and displayed alngside each registry key r flder path fr all users that have run the applicatin: Occurrences - The ttal number f times that the registry path r flder path has been accessed by the applicatin. Average Size - The average size f the data in the registry key r flder frm each applicatin clse. Fr example, a size f 100 bytes at the first applicatin clse and a size f 200 bytes at the secnd applicatin clse displays as an average size f 150 bytes. Peak Size - The largest recrded size f the data in the registry key r flder frm each applicatin clse. Fr example, a size f 100 bytes at the first applicatin clse and a size f 200 bytes at the secnd applicatin clse displays as a peak size f 200 bytes. 6. If required, tick Hide paths which are rarely persnalized t filter ut paths which are nt recmmended fr inclusin. 7. Tick the registry and flder paths t be added as inclusins fr the Applicatin Grup. As paths are selected and deselected, the Applicatin Prfile Size updates with the cumulative sizes f the Average Size and Peak Size fr the selected paths. This infrmatin shws the ptential prfile size per user if the applicatin is persnalized. 8. Click OK. The Enter Details dialg displays. Page 87 f 147

88 9. In the Name field, enter a name t uniquely identify the applicatin within the Envirnment Manager cnsle. Applicatins must nt have the same name as existing applicatins r Applicatin Grups. Applicatins must be added t a new r existing Applicatin Grup: New Applicatin Grup - Specify the Applicatin Grup name in the Create New Applicatin Grup field. Applicatin Grups must nt have the same name as existing applicatins r Applicatin Grups. Existing Applicatin Grup - Select an existing Applicatin Grup in the Add t Existing Applicatin Grup field. The applicatin is created and is visible within the Applicatins wrk area. 10. Click OK. The registry and flder paths frm the Applicatin Data Cllectin manual cnfiguratin are added as inclusins fr the applicatin. The glbal registry, flder and file path inclusins are added as exclusins fr the applicatin t ensure that unexpected data is nt captured fr the applicatin. Add a New Applicatin by Name 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatin Grup. 2. Select an applicatin grup. 3. Frm the Persnalizatin ribbn, click Add Applicatin > Select Applicatin. The Select Applicatins displays. 4. Click New > By Name. The Add an Applicatin dialg displays. 5. In the Applicatin field, enter an applicatin executable name r click the ellipsis (...) t select an applicatin frm the file system. 6. Optinally, in the Flder field, enter a flder path r click the ellipsis t select a flder frm the file system. The applicatin is managed nly if it is lcated in the specified flder. If the field is left blank, all applicatins matching the entered criteria are managed, regardless f lcatin. 7. In the Name field, enter a name t uniquely identify the applicatin within the Envirnment Manager cnsle. Applicatins must nt have the same name as existing applicatins r Applicatin Grups. 8. Optinally, in the Operating System and Applicatin Versin fields, specify regular expressins t target a specific perating system r applicatin versin. Alternatively, use the.* default regular expressin t include all perating systems and applicatin versins. Page 88 f 147

89 9. Click OK. The applicatin is created and is listed in the Select Applicatins dialg. 10. Select the new applicatin in the list and click OK. The applicatin is added t the Applicatin Grup. Edit Applicatin Prperties Once an applicatin has been added t the Applicatins list, its details can be amended as required. 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatin.; 2. The available applicatins are listed in the wrk area. 3. Select the applicatin yu want t edit. Details f the applicatin are displayed at the bttm f the wrk area. 4. Update the required prperties: Name - The name given t the applicatin which appears in the applicatin list. This can be changed as required but must nt duplicate an existing applicatin name. Flder - The flder path specified fr the applicatin. Only matching applicatins in this flder are managed. The path can be amended r deleted. Executable - The name f the executable file fr the applicatin. This can be entered directly r brwsed fr using the ellipsis. Unlike the applicatin name, the executable name can be a duplicate f an existing executable. This enables different versins and perating systems t be catered fr. Operating System - Make the applicatin specific t an perating system using regular expressins r by entering a specific OS. The default regular expressin (.*) matches all perating systems Applicatin Versin - Manage a specific versin f the applicatin by entering a specific versin number r by using a regular expressin. The default regular expressin (.*) matches all versin numbers. Page 89 f 147

90 The cmbinatin f Applicatin executable name, Operating System and Applicatin Versin must be unique. Adding a regular expressin such as 11.* matches anywhere in the versin string, fr example, in and T match nly the start f the string, prefix the regular expressin with a caret (^). Fr example, ^11.* matches but des nt match The Applicatin tab als includes creatin and mdificatin dates and details f the user wh perfrmed the actins. The regular expressins used in Envirnment Manager cnfrm t Micrsft CAtIRegExp Class framewrk. 5. Click away frm the fields, such as within the wrk area, t autmatically update the edited details in the Applicatin - User list. Delete an Applicatin frm the Applicatins List T delete an applicatin, select it frm the applicatins list, right-click and select Delete. Envirnment Manager checks where the applicatin is referenced in the cnfiguratin and displays any dependencies the applicatin has, such as belnging t an applicatin r persnalizatin grup. Use this infrmatin t amend yur persnalizatin cnfiguratin if required. Deleting an applicatin remves every instance f that applicatin; it will be remved frm all applicatin and Persnalizatin grups Inclusins and Exclusins Specific registry keys, registry values, flders and files can be included in r excluded frm Persnalizatin at the fllwing levels: Applicatin Grup - Inclusins and exclusins that apply t all applicatins in an Applicatin Grup. It is recmmended that inclusins and exclusins are added at Applicatin Grup level. Glbal - Inclusins and exclusins that apply t all managed applicatins, unless cntradicted at Applicatin Grup r applicatin level. Applicatin - Inclusins and exclusins that apply t individual applicatins. Applicatin level inclusins and exclusins can be viewed r edited nly when ungruped applicatins exist that are nt part f any Applicatin Grup. Applicatin Grup inclusins and exclusins take precedence ver thse set at glbal and applicatin levels. This ensures cnsistency acrss all applicatins within a grup. Page 90 f 147

91 Files with.tmp extensins are excluded by default. This can cause issues with sme managed applicatins if the virtual cache is n a different drive than the user's prfile. If yu want t use the virtual cache n a different drive, remve.tmp frm the glbal file exclusin list. Files and flders, registry keys and values can be excluded using Persnalizatin Analysis reprts. Inclusin and Exclusin Rules The fllwing rules apply t inclusins and exclusins: Everything is excluded by default - t persnalize smething, it must be explicitly included. Exclusins take pririty ver inclusins, except where the include path is deeper. Inclusins and exclusins apply t the path and all sub-flders, subject t the rules. A filename added t exclusins will exclude that file frm all lcatins. Fr inclusins, the full file path must be specified. Fr example, File.tmp is a valid exclusin but an invalid inclusin. Wildcards can be used anywhere in a registry path inclusin and exclusin. Hwever, fr files, wildcards can be nly be used fr the filename - the path cannt include wildcards. Using wildcards in includes and excludes can affect perfrmance by increasing prcessing times. Inclusin and Exclusin Examples The tw tables belw shw examples f inclusins and exclusins and the behavir displayed in certain situatins fr files, flders and registry keys. Registry Include Path Exclude Path Behavir Exclude everything Nthing is persnalized as t persnalize smething, it must be explicitly included. HKCU\Sftware\Key HKCU\Sftware\Key Exclude HKCU\Sftware\Key The registry exclusin is applied as exclusins take pririty ver inclusins. HKCU\Sftware\Key HKCU\Sftware Exclude HKCU\SftwareInclude HKCU\Sftware\Key Althugh the inclusin is within the exclusin path, the registry inclusin is applied as its path is deeper. Page 91 f 147

92 Include Path Exclude Path Behavir HKCU\Sftware HKCU\Sftware\Key Include HKCU\SftwareExclude HKCU\Sftware\Key Althugh the exclusin is within the inclusin path, the registry exclusin is applied as its path is deeper. HKCU\Sftware\Key\Value HKCU\Sftware\Key\Value Exclude HKCU\Sftware\Key\Value The registry exclusin is applied as exclusins take pririty ver inclusins. HKCU\Sftware\Key\Value HKCU\Sftware\Key Include HKCU\Sftware\Key\ValueExclude HKCU\Sftware\Key Althugh the inclusin is within the exclusin path, the registry inclusin is applied as its path is deeper. HKCU\Sftware\Key HKCU\Sftware\Key\Value Include HKCU\Sftware\KeyExclude HKCU\Sftware\Key\Value Althugh the exclusin is within the inclusin path, the registry exclusin is applied as its path is deeper. File and Flder Include Path Exclude Path Behavir Exclude everything Nthing is persnalized as t persnalize smething, it must be explicitly included. C:\Flder C:\Flder Exclude C:\Flder The flder exclusin is applied as exclusins take pririty ver inclusins. C:\Flder\AppSense C:\Flder Exclude C:\FlderInclude C:\Flder\AppSense Althugh the inclusin is within the exclusin path, the flder inclusin is applied as its path is deeper. C:\Flder C:\Flder\AppSense Include C:\FlderExclude C:\Flder\AppSense Althugh the Page 92 f 147

93 Include Path Exclude Path Behavir exclusin is within the inclusin path, the flder exclusin is applied as its path is deeper. C:\File.tmp C:\File.tmp Exclude C:\File.tmp The file exclusin is applied as exclusins take pririty ver inclusins. C:\Flder\File.tmp File.tmp Exclude C:\File.tmp The file exclusin is applied as full paths are nt required fr exclusins and they take pririty ver inclusins C:\Flder\File.tmp C:\Flder Include C:\Flder\File.tmp The file inclusin is applied as the path is deeper. As everything is excluded by default, it is nt recmmended that whle flders are excluded as this requires unnecessary prcessing which has a negative effect n perfrmance. C:\Flder C:\Flder\File.tmp Exclude C:\Flder\File.tmp The file exclusin is applied as the path is deeper. Applicatin Grup Inclusins and Exclusins Inclusins and exclusins fr registry, flder and file paths can be added that apply t all applicatins within an Applicatin Grup. It is recmmended that inclusins and exclusins are added at Applicatin Grup level. Add Applicatin Grup Inclusins using Applicatin Data Cllectin Applicatin Data Cllectin passively cllects data frm managed endpints as users run applicatins. Registry key and flder paths that are written t and read frm are recrded fr each applicatin. On applicatin clse, the data is stred in the Envirnment Manager Persnalizatin database. 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatin Grup. 2. Select an applicatin grup. Page 93 f 147

94 3. Frm the Persnalizatin ribbn, click Add Applicatin > Select Applicatin. The Select Applicatins dialg displays. 4. Click New > Frm Applicatin Data Cllectin. The Add Applicatin - Data Cllectin dialg displays. The dialg lists applicatins that have been cllected by Applicatin Data Cllectin. 5. Select the applicatin frm which t add the flder r registry inclusins. 6. Tick N, I want t cnfigure this applicatin manually (advanced). 7. Click Cnfigure. The dialg lists all registry keys and flder paths which have been cllected by Applicatin Data Cllectin fr the selected applicatin. Existing inclusins are selected. 8. Tick the registry and flder paths t be added as inclusins fr the Applicatin Grup. Unless explicitly excluded, child paths are included with their parent path. When a parent path is selected, the child paths are autmatically deselected and disabled. 9. Click OK. The Enter Details dialg displays. The Applicatin name is read-nly. 10. Click OK. The selected registry and flder paths are added as inclusins t the Applicatin Grup. Add Applicatin Grup Registry Inclusins r Exclusins Manually 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatin Grups. 2. Select an applicatin grup. 3. Select the Registry tab. 4. In either the Include r Exclude area and select Add Registry Key. The Select Registry Key dialg displays. 5. In the Key field, select the ellipsis (...) t brwse fr the registry key r manually enter the path and key name int the field. Wildcards can be used anywhere in a registry path t represent ne r mre characters. Fr example, adding *.0 t the path fr Micrsft Outlk means all versins f Outlk can be included r excluded with ne entry. HKCU\Sftware\Micrsft\Office\*.0\Outlk The Brwse Registry dialg displays. Yu can select frm yur lcal cmputer, current user r click Cnnect t display the Active Directry Select Cmputer dialg t select anther cmputer t brwse. Page 94 f 147

95 6. Lcate the required Registry Key and click OK. The selected registry key is entered in the Select Registry Key dialg. 7. Click OK. The registry key is added as an inclusin r exclusin fr the Applicatin Grup. Add Applicatin Grup Flder Inclusins r Exclusins Manually 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatin Grup. 2. Select an applicatin grup. 3. Select the Flder tab. 4. In either the Include r Exclude area and select Add Flder. The Select Flder dialg displays. 5. In the Path field, select the ellipsis (...) t brwse fr the flder. The path can als be entered manually int the field. The Brwse fr Flder dialg displays. Yu can select an existing flder frm yur lcal cmputer r click the Make New Flder buttn t create a new flder fr inclusin r exclusin. 6. Lcate the required flder and click OK. 7. The selected flder path is entered in the Select Flder dialg. 8. Click OK. The flder path is added as an inclusin r exclusin fr the Applicatin Grup. Add Applicatin Grup File Inclusins r Exclusins Manually 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatin Grup. 2. Select an applicatin grup. 3. Select the File tab. 4. In either the Include r Exclude area and select Add File. The Select File dialg displays. 5. In the Path field, select the ellipsis (...) t brwse fr the file. The path can als be entered manually int the field. 6. Lcate the required file and click OK. Page 95 f 147

96 The selected file path is entered in the Select File dialg. 7. Click OK. The file path is added as an inclusin r exclusin fr the Applicatin Grup. Glbal Inclusins and Exclusins Inclusins and exclusins fr registry, flder and file paths can be added that apply t all managed applicatins, unless cntradicted at Applicatin Grup r applicatin level. It is recmmended that inclusins and exclusins are added at Applicatin Grup level. Add Glbal Registry Inclusins r Exclusins 1. Select the User Persnalizatin navigatin buttn. 2. Frm the Manage ribbn, click Glbal Applicatin Settings. 3. Select the Registry tab. 4. Right-click in either the Include r Exclude area and select Add Registry Key. The Select Registry Key dialg displays. 5. In the Key field, select the ellipsis (...) t brwse fr the registry key r manually enter the path and key name int the field. Wildcards can be used anywhere in a registry path t represent ne r mre characters. Fr example, adding *.0 t the path fr Micrsft Outlk means all versins f Outlk can be included r excluded with ne entry. HKCU\Sftware\Micrsft\Office\*.0\Outlk The Brwse Registry dialg displays. Yu can select frm yur lcal cmputer, current user r click Cnnect t display the Active Directry Select Cmputer dialg t select anther cmputer t brwse. 6. Lcate the required Registry Key and click OK. The selected registry key is entered in the Select Registry Key dialg. 7. Click OK. 8. The registry key is added as a glbal inclusin r exclusin. Add Glbal Flder Inclusins r Exclusins 1. Select the User Persnalizatin navigatin buttn. 2. Frm the Manage ribbn, click Glbal Applicatin Settings. Page 96 f 147

97 3. Select the Flder tab. 4. Right-click in either the Include r Exclude area and select Add Flder. The Select Flder dialg displays. 5. In the Path field, select the ellipsis (...) t brwse fr the flder. The path can als be entered manually int the field. The Brwse fr Flder dialg displays. Yu can select an existing flder frm yur lcal cmputer r click the Make New Flder buttn t create a new flder fr inclusin r exclusin. 6. Lcate the required flder and click OK. The selected flder path is entered in the Select Flder dialg. 7. Click OK. The flder path is added as a glbal inclusin r exclusin. Add Glbal File Inclusins r Exclusins 1. Select the User Persnalizatin navigatin buttn. 2. Frm the Manage ribbn, click Glbal Applicatin Settings. 3. Select the File tab. 4. Right-click in the Include r Exclude areas and select Add File. The Select File dialg displays. 5. In the Path field, select the ellipsis (...) t brwse fr the file. The path can als be entered manually int the field. 6. Lcate the required file and click OK. The selected file path is entered in the Select File dialg. 7. Click OK. The file path is added as a glbal inclusin r exclusin. Applicatin Inclusins and Exclusins Where ungruped applicatins exist that are nt part f any Applicatin Grup, inclusins and exclusins fr registry, flder and file paths can be added t an individual applicatin. It is recmmended that inclusins and exclusins are added at Applicatin Grup level. Page 97 f 147

98 Add Applicatin Registry Inclusins r Exclusins 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatins. 2. Select an applicatin in the wrk area. 3. Select the Registry tab. 4. Right-click in either the Include r Exclude area and select Add Registry Key. The Select Registry Key dialg displays. 5. In the Key field, select the ellipsis (...) t brwse fr the registry key r manually enter the path and key name int the field. Wildcards can be used anywhere in a registry path t represent ne r mre characters. Fr example, adding *.0 t the path fr Micrsft Outlk means all versins f Outlk can be included r excluded with ne entry. HKCU\Sftware\Micrsft\Office\*.0\Outlk The Brwse Registry dialg displays. Yu can select frm yur lcal cmputer, current user r click Cnnect t display the Active Directry Select Cmputer dialg t select anther cmputer t brwse. 6. Lcate the required Registry Key and click OK. The selected registry key is entered in the Select Registry Key dialg. 7. Click OK. The registry key is added as an inclusin r exclusin fr the applicatin. Add Applicatin Flder Inclusins r Exclusins 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatins. 2. Select an applicatin in the wrk area. 3. Select the Flder tab. 4. Right-click in either the Include r Exclude area and select Add Flder. The Select Flder dialg displays. Page 98 f 147

99 5. In the Path field, select the ellipsis (...) t brwse fr the flder. The path can als be entered manually int the field. The Brwse fr Flder dialg displays. Yu can select an existing flder frm yur lcal cmputer r click the Make New Flder buttn t create a new flder fr inclusin r exclusin. 6. Lcate the required flder and click OK. The selected flder path is entered in the Select Flder dialg. 7. Click OK. The flder path is added as an inclusin r exclusin fr the applicatin. Add Applicatin File Inclusins r Exclusins 1. In the User Persnalizatin navigatin tree, select Persnalizatin Settings > Applicatin Persnalizatin > Applicatins. 2. Select an applicatin in the wrk area. 3. Select the File tab. 4. Right-click in the Include r Exclude areas and select Add File. The Select File dialg displays. 5. In the Path field, select the ellipsis (...) t brwse fr the file. The path can als be entered manually int the field. 6. Lcate the required file and click OK. The selected file path is entered in the Select File dialg. 7. Click OK. The file path is added as an inclusin r exclusin fr the applicatin. Page 99 f 147

100 Applicatin Data Cllectin Applicatin Data Cllectin passively cllects data frm managed endpints as users run applicatins. The cllected data can be used t create new applicatins and add t registry and flder inclusins t existing Applicatin Grups. Registry key and flder paths that are written t and read frm are recrded fr each applicatin. On applicatin clse, the data is stred in the Envirnment Manager Persnalizatin database. The registry and flder paths frm the Applicatin Data Cllectin cnfiguratin are added as inclusins. The glbal registry, flder and file path inclusins are added as exclusins fr the Applicatin Grup t ensure that unexpected data is nt captured. Cautin: Enabling Applicatin Data Cllectin causes an increase in system utilizatin n managed endpints. It is recmmended that Applicatin Data Cllectin is disabled when n lnger required. Add New Applicatins New applicatins can be added t the belw lcatins using Applicatin Data Cllectin. Lcatin Persnalizatin Grups Applicatin Grups Applicatins Prcess Add a New Applicatin t a Persnalizatin Grup frm Applicatin Data Cllectin Add a New Applicatin t an Applicatin Grup frm Applicatin Data Cllectin (Autmatic)Add a New Applicatin t an Applicatin Grup frm Applicatin Data Cllectin (Manual) Add a New Applicatin frm Applicatin Data Cllectin (Autmatic)Add a New Applicatin frm Applicatin Data Cllectin (Manual) Add Inclusins Registry and flder inclusins can be added t existing Applicatin Grups using Applicatin Data Cllectin. See Add Applicatin Grup Inclusins using Applicatin Data Cllectin Page 100 f 147

101 Windws Persnalizatin Windws Settings, such as wallpaper selectin, muse ptins and accessibility features, can be persnalized fr managed users thrugh Envirnment Manager Windws Persnalizatin. This is achieved by persnalizing the apprpriate registry keys and values, files and flders. The settings a user applies t their desktp are saved t the persnalizatin database when a user lgs ff and restred when the user lgs nt any managed endpint. Windws Settings Grups Windws Settings can be gruped tgether in Windws Settings Grups and added t Persnalizatin Grups in rder t persnalize the apprpriate settings fr grups f users. This allws a higher level f granularity, enabling settings t be persnalized and rlled back in individual grups. Further cntrl can be achieved by adding cnditins that specify hw grups f Windws Settings are applied. Envirnment Manager cntains default Windws Settings Grups that persnalize the mst cmmn Windws Settings. When yu expand Windws Persnalizatin, the pre-cnfigured Windws Settings Grups are displayed with any grups yu have added yurself. All grups can be used as they are, edited t yur requirements r new grups, cntaining existing r Custm Windws Settings, can be created. Grups can als be clned t create a new grup based n the settings f an existing ne. Windws Settings Grups and Inclusin Lgic When yu assign a Windws Settings Grup cntaining registry r file inclusins t a Persnalizatin Grup, this autmatically excludes thse included lcatins frm applicatin virtualizatin fr that Persnalizatin Grup. When a cnditin has been cnfigured fr a Windws Settings Grup, the fllwing lgic applies n the endpint: If the cnditin evaluates as True, the Windws Settings Grup data is applied t the user's sessin and the inclusin paths are excluded glbally frm applicatin virtualizatin. If the cnditin evaluates as False, the Windws Settings Grup data is preserved in the database but is nt applied t the user's sessin. The inclusin paths in the Windws Settings Grup are still excluded frm the app bubble. When the user rams back t the machine with a passing cnditin, the data is applied. Page 101 f 147

102 Create a Windws Settings Grup 1. In the User Persnalizatin navigatin tree, select Windws Persnalizatin. 2. Frm the Persnalizatin ribbn, click Add Windws Settings Grup. 3. Enter a name and an ptinal descriptin and click OK. The Windws Settings Grup name must nt be a duplicate f an existing grup r a reserved name, fr example, W7 and W8. The Windws Settings Grup displays in the wrk area. 4. Click Add/Remve. The Add/Remve Items dialg displays. 5. Select the required settings frm the left pane and click the right arrw t add them t the Windws Settings Grup. Page 102 f 147

103 6. Multiple settings can be selected using the Ctrl r Shift keys. An embldened setting means that the setting is used in anther Windws Settings Grup. T see which grups it is used in, highlight the setting and select the In Grups tab at the bttm f the dialg. Page 103 f 147

104 T see which registry keys and values, files and flders are persnalized, highlight a Windws Setting n either side f the dialg and select the apprpriate tab. If the setting yu want t persnalize is nt available, click the Create Windws Setting link t cnfigure a Custm Windws Setting. 7. Once yu have added all the required settings, click OK t save the Windws Settings Grup. The settings yu have added fr the grup are displayed in the wrk area. Settings can be deleted frm the grup r yu can click the Add/Remve buttn t fully edit the grup. Page 104 f 147

105 Add Cnditins t a Windws Setting Grup 1. Create cnditins t determine when Windws Settings are applied, fr example, when a particular registry key r flder exists. 2. Select a Windws Settings Grup. 3. Click AddCnditin. 4. Enter a name fr the Windws Settings Grup Cnditin. If yu want t use the cnditin in anther Windws Settings Grup, yu must enter a name. If yu are adding cnditins fr this grup nly, a name is nt required. 5. Select the Make available fr reuse checkbx if yu want the cnditin t be available fr ther Windws Settings Grups. T apply an existing Windws Settings Grup Cnditin, select the Use existing cnditin radi buttn and chse the required cnditin frm the drp-dwn. The list includes cnditins yu have already cnfigured and built-in cnditins fr Windws 7 and Windws 8. Cnditins fr Windws 10 perating systems are nly available as custm cnditins. 6. Click the Cnditins drp-dwn and select a cnditin. 7. Yu can add multiple cnditins and utilize AND/OR statements t create a cnfiguratin f cnditins t apply t the Windws Settings Grup as required. Mve, remve and edit cnditins using the tlbar. 8. Click OK t save the Windws Settings Grup Cnditin. The cnditin is applied t the Windws Settings Grup and displayed in the wrk area. 9. Edit a Windws Settings Grup 10. Select a Windws Settings Grup t edit the settings managed by that grup and t manage its cnditins. The fllwing ptins are available: 11. Add/Remve - Open the Add/Remve Items dialg t cnfigure the Windws Settings fr the grup. 12. Delete - Delete the selected Windws Setting. 13. Delete All - Delete all Windws Settings fr the grup. 14. Edit Cnditin - Open the Windws Settings Grup Cnditin dialg t cnfigure cnditins fr the grup. If there are n current cnditins fr the grup, the click the Add Cnditin buttn. 15. Remve Cnditin - Remve the cnditin that applies t the Windws Settings. Clne a Windws Settings Grup Select a Windws Settings grup and click Persnalizatin > Clne Windws Settings Grup. A cpy is made f the selected grup and can be edited as required. Page 105 f 147

106 Custm Windws Settings Using the Custm Windws Settings Editr, yu can create yur wn Windws Settings by selecting registry keys, values, flders and individual files t persnalize r exclude frm persnalizatin. Once created, the setting can be added t Windws Settings Grups. Frm the Persnalizatin ribbn, select Custm Windws Settings Editr. The Custm Windws Settings dialg is displayed. Any existing custm settings are listed. The fllwing ptins are available: Add - Cnfigure a setting which can then be added t Windws Settings Grups and persnalized. Edit - Update the selected custm setting. Remve - Delete the selected setting frm the list. If yu attempt t remve a setting which is referenced in a Windws Setting Grup, yu will be asked t cnfirm the delete. Each grup in which the setting is referenced is listed. This helps t ensure that a setting is nt remved in errr. Clne - The clne functin makes a cpy f an existing Windws setting and allws the cnfigured registry keys and flders t be updated as required. Certificate, Credentials and Start Menu Windws Settings cannt be clned. Windws Settings are cnfigured using the fllwing prperties: Prperty Name Descriptin OS Descriptin The name that appears in the Windws Persnalizatin list. An ptinal descriptin used t tell users mre abut the setting and what it des. The perating system t which the setting applies. Separate tabs are created fr each selected perating system s specific flders and keys can be cnfigured fr each. This allws differences between perating systems can be taken int accunt when the setting is applied. If yu want t cnfigure ne setting, managing the same flders and keys acrss all perating systems, select All. If yu change a setting frm individual perating systems t All, select whether t inherit the settings applied t ne f the perating systems r cnfigure new settings. The All tab and individual perating system tabs cannt be displayed simultaneusly. Hwever, when yu clne sme Windws Settings, multiple OS tabs, including the All tab, may initially be shwn. Befre yu save the setting either keep the All tab and remve the individual perating systems tabs r remve the All tab. If yu d nt remve any f the tabs, the OS tabs are autmatically remved leaving nly the All tab. Page 106 f 147

107 Prperty Flder Descriptin The flder t persnalize r t exclude frm persnalizatin. Enter a flder path r select the ellipsis (...) and brwse t the flder. Flder paths must start with a CSIDL, a system variable, r a letter. Wildcards are nt supprted. If an item is required fr mre than ne perating system, highlight the required item select an perating system frm the drp-dwn and click Cpy T. If yu d nt want t persnalize an item and it is included in persnalizatin because a parent item it its flder r registry path is included, select the Exclude checkbx fr that item. File Name The file t persnalize r t exclude frm persnalizatin. Click the ellipsis in the File Name field t brwse t a file r enter the flder path and file name manually. Yu can use the fllwing wildcards in the file name: *,?, and [ ]. When using wildcards t include r exclude items, be aware that the mre specific flder r registry path takes pririty. If paths are f equal length, the exclusin takes pririty. Fr mre infrmatin see, Inclusins and Exclusins. Key Value The registry key t persnalize r t exclude frm persnalizatin. Click the ellipsis in the Key field t pen a registry brwser and select the key. Or enter the registry key path manually. Yu can use the fllwing wildcards: *,?, and [ ]. Enter the registry key value t persnalize r t exclude frm persnalizatin. Yu can use the fllwing wildcards: *,?, and [ ]. It is nt pssible t enter the backslash character \ in the registry key Value text. Default Windws Settings Grups The fllwing Windws Settings Grups are available by default. Click n a grup t view which Windws Settings are managed by that grup. Accessibility Accessibility Keybard Audi and Sunds Tablets Visual Settings Actin Center Actin Center Settings Page 107 f 147

108 Active Setup ActiveSetup Explrer Settings General Flder Optins Libraries Links Mapped Netwrk Drives Mapped Netwrk Printers Netwrk Lcatin Shrtcuts Search Flder Optins View Flder Optins IE10+ Ckies and Histry (W7, WS 2K8 R2) IE Passwrds IE Znes IE10+ Settings IE10+ Ckies and Histry (W8.x, WS 2012, WS 2012 R2) IE Passwrds IE Znes IE10+ Settings IE11 Ckies and Histry (W10, WS 2016) IE Passwrds IE Znes IE10+ Settings IE8-9 Ckies and Histry (W7, WS 2008 R2) IE Passwrds IE Znes IE8-9 Settings Input Devices Input Keybard Muse Mail Prfile and Signatures Mail Signatures Page 108 f 147

109 MAPI Prfile Regin and Language Input Language Language Bar Lcale MUI Security Certificates Credentials Start Menu (W10, WS 2016) Start Menu Taskbar (W10, WS 2016) Ntificatin Area Taskbar Tlbars Taskbar and Start Menu (W7, W8, WS 2008 R2, WS 2012, WS 2012 R2) Ntificatin Area Start Menu Start Menu - Recently Launched Applicatins Taskbar Tlbars Windws Appearance (W10, WS 2016) Icns Themes Windw Clr and Appearance Windws Appearance (W7, WS 2008 R2) Icns Themes Windw Clr and Appearance Windws Appearance (W8.x, WS 2012, WS 2012 R2) Icns Themes Page 109 f 147

110 Windw Clr and Appearance Windws Desktp Accunt Picture ClearType Icn Psitins and Views Screen Saver Visual Effects Wallpaper As a user mves between managed endpints with different peratin systems and applicatins, sme cnfigured shrtcuts are nt valid fr all envirnments. If users are managing flders using Windws Settings Grups, Envirnment Manager manages the fllwing temprarily invalid shrtcuts: Shrtcut r Link Standard shrtcuts in the Windws file system that pint t a target des nt exist Items pinned t the Taskbar that pint t nnexistent paths Items pinned t the Start menu that pint t nnexistent paths Supprted Operating System All supprted perating systems All supprted perating systems Windws 7, Windws Server 2008 R2 Page 110 f 147

111 Sites Larger rganizatins typically utilize multiple sites t manage the User Persnalizatin requirements f their users. Sites can be based n areas f the rganizatin such as different departments, gegraphical lcatin r any ther lgical divisin. An Envirnment Manager site is made up f the fllwing cmpnents: Client Endpints Persnalizatin Server(s) SQL Server Each site uses this standard three-tier architecture and can be linked via their SQL servers thrugh replicatin. Within the Envirnment Manager cnsle, sites are cnfigured in the Sites nde in the User Persnalizatin navigatin tree. All persnalizatin cnfiguratins include a Default Site which cntains the Persnalizatin Server and database n which the sftware was installed and cnfigured. This is typically set up as the main site fr an rganizatin, adding additinal branch sites as required. If n further sites are cnfigured, the Default Site is used. Once a site has been created in the cnsle, membership rules are used t define which endpints have their persnalizatin managed by that site. Persnalizatin Servers and virtual hsts can then be added t the site as required. When a user lgs n t an endpint, they cnnect t the Persnalizatin Server listed in the AEMP cnfiguratin file. Once cnnected, the Persnalizatin Server gathers details f the user, the endpint and sftware t determine which site and persnalizatin grup the user belngs. Add a Persnalizatin Site 1. In the User Persnalizatin tree, select Persnalizatin Settings > Sites. 2. Select Add Site n the Server ribbn. A New Site nde is created and highlighted ready t be renamed in the navigatin tree and the Site wrk area displays. Envirnment Manager Sites Hierarchy Envirnment Manager Sites are created in the User Persnalizatin navigatin tree. Users are assigned t the first site in the list where membership rules match. It is therefre imprtant that sites are listed in rder f pririty t ensure users are assigned t the mst relevant site. Page 111 f 147

112 An endpint can match the membership rules f mre than ne site but will be assigned t the first matching site nly. T change the rder, select a site and click Mve Up and Mve Dwn n the Edit ribbn. Default Site The Default Site is autmatically included in all Envirnment Manager Persnalizatin cnfiguratins. Any endpint which des nt match the membership rules fr anther site is assigned t the default site. Because f this, membership rules fr the grup cannt be defined. Servers and virtual hsts shuld be set up fr this site which will be the default fr a standard user within yur rganizatin. Envirnment Manager Site Membership Rules The membership rules fr a site are gverned by cnditins which must be satisfied fr an endpint t use that site. The cnditins are based n users, cmputer specificatins and directry membership. Membership can be based n a single cnditin r a user may have t fulfill a number f cnditins fr membership f a site. Similar t Persnalizatin Grups, membership f a site can be based n tw rule types: AND - Multiple cnditins must be satisfied fr membership f the site. This is called a cnditin grup. OR - Membership is determined by satisfying the cnditins fr ne f a number f cnditins. Page 112 f 147

113 Example 1 A cnditin grup has been created cntaining tw cnditins: Users must fulfill bth cnditins t be members f the site. Example 2 A secnd cnditin grup has been added: T be a member f this site, a user must fulfill all the cnditins in the first cnditin grup r the cnditin in the secnd cnditin grup. Page 113 f 147

114 Create Site Membership Rules 1. In the User Persnalizatin tree, select Persnalizatin Settings > Sites. 2. Select a site. 3. Click in the Membership Rules wrk area. The Memberships > Cnditins ribbn is added and selected. 4. In the Cnditins ribbn, select the required cnditin. User, Cmputer, and Directry Membership are available. See Envirnment Manager Site Cnditins fr details. The dialg bx fr the selected cnditin displays. 5. Cnfigure the cnditin and click OK. The new cnditin grup displays under Membership Rules. 6. T further define grup membership fr the site, add mre cnditins: AND Rule - Right-click n an existing cnditin, select Insert Cnditin and cnfigure the cnditin as required. OR Rule - Right-click in the wrk area and select Add Cnditin Grup and cnfigure the cnditin as required. Cnditin grups can be edited and deleted by selecting Edit Cnditin r Delete Cnditin frm the shrtcut menu. Envirnment Manager Site Cnditins Using membership rules fr sites enables yu cnfigure the cnditins which gvern wh cnnects t which site in yur rganizatin. Fr example, if yu set a User cnditin fr a site yu can ensure that when a user lgs n, they are cnnected t the same site regardless f where they are and what cmputer they are lgging nt. If site membership rules are nt cnfigured, all managed users are assigned t the Default Site. The table belw list the available cnditins fr sites. Type User Cmputer Directry Membership Cnditin User Name User Grup Is Administratr Cmputer Name Cmputer Dmain Cmputer NETBIOS Name Cmputer Grup Cmputer IP Address User OU Membership Cmputer OU Membership Site Membership Page 114 f 147

115 Servers and Virtual Hsts Sites can be made up f multiple Persnalizatin Servers and virtual hsts as defined by their individual requirements. The servers and virtual hsts which have been set up fr a site can be viewed by selecting the required site in the navigatin tree and the Servers & Virtual Hsts tab. Servers and virtual hst can be deleted by selecting and clicking the apprpriate buttn frm the Edit ribbn. Virtual Hsts shuld be added t a site t supprt netwrk lad balancing. View and Edit Server and Virtual Hst Prperties Select a server r virtual hst frm the navigatin tree t display details in the wrk area. The display is the same fr bth virtual hsts and servers. Frm the wrk area, the fllwing prperties can be edited fr virtual hsts and servers: Page 115 f 147

116 Name - A name what can easily identify the server r virtual hst. This displays in the list f Servers & Virtual Hsts when a site is selected in the navigatinal tree. Descriptin - A descriptin fr the server r virtual hst. URL - The lcatin f the server r virtual hst. A valid URL must start with HTTP r HTTPS. Prt - The cnnectin methd t the server r virtual hst. The prt range fr is 7771 t 7790 and the default prt is Add Persnalizatin Servers t a Site 1. In the User Persnalizatin tree, select Persnalizatin Settings > Sites. 2. Select a site. 3. Click Add Server frm the Persnalizatin ribbn. The Select Cmputers dialg bx displays. The Select Cmputers dialg bx enables criteria t be used t search fr servers by name r descriptin and in specified directries, if required. The Advanced search buttn expands the dialg enabling the search t be further defined. 4. Lcate the server and click OK. The server is added as a new nde under the site in the navigatin tree. Add Virtual Hsts t a Site 1. In the User Persnalizatin tree, select Persnalizatin Settings > Sites. 2. Select a site. 3. Click Add Virtual Hst frm the Server ribbn. The Add Virtual Hst dialg bx displays. 4. Enter the FQDN (Fully Qualified Dmain Name) fr the virtual hst. 5. Click OK. The virtual hst is added as a new nde under the site in the navigatin tree. Page 116 f 147

117 Persnalizatin Tls Synchrnize Site Databases Imprt and Exprt Persnalizatin Cnfiguratins In the Persnalizatin cnsle, yu can exprt a cnfiguratin as an XML template. Whle cnfiguratins, individual items, r grups f items frm a cnfiguratin can be exprted t an XML file. Yu can cpy the full and partial cnfiguratins frm ne persnalizatin database t anther. T create a new cnfiguratin r t update an existing ne, yu can imprt the exprted XML cnfiguratin int a persnalizatin database. Cautin: Imprting cnfiguratins makes changes t yur database which cannt be undne. It is recmmended that yu back up yur database prir t using the Imprt feature. Persnalizatin imprts and exprts are perfrmed fr the fllwing grupings, represented by ndes in the imprt and exprt dialgs: Applicatin Grups Applicatins Windws Settings Grups Custm Windws Settings Windws Settings Cnditins Persnalizatin Grups Sites Glbal Applicatin Exclusins Settings Yu can further define the imprt and exprt by selecting individual items frm any grup. Tw cmdlets within the EMPImprtExprt Pwershell mdule can als be used t imprt and exprt cnfiguratin data frm persnalizatin server databases. Imprt and Exprt Rules When imprting r exprting persnalizatin cnfiguratins the fllwing rules apply: Any cnfiguratin item that has a dependency with anther item is autmatically included in the imprt r exprt and cannt be deselected. Fr example, when yu select an Applicatin Grup, all the assciated User Applicatins are autmatically selected. The same is true f any Windws Settings Cnditins that are required fr the Windws Settings being imprted r Page 117 f 147

118 exprted. The Default Site and Default Users persnalizatin grup are the last elements in their respective ndes and always maintain this psitin n imprt. Imprted User Applicatins and Applicatin Grups are placed in alphabetical rder in the cnfiguratin. Fr example, if Applicatin Grups A, C and E already exist in a cnfiguratin and grups B and D are imprted, the rder fllwing imprt is A, B, C, D, E. Order numbers are nt exprted fr Persnalizatin Grups. This means that imprted Persnalizatin Grups are placed after any existing grups in the cnfiguratin but befre the Default User grup. Fr example, if grups A, C, E and Default User already exist in a cnfiguratin and grups B and D are imprted, the rder fllwing imprt is A, C, E, B, D, Default User. The same behavir applies fr Sites. Envirnment Manager XML cnfiguratin files that were nt generated by the Exprt feature - such as sme f the templates supplied by Ivanti Prfessinal Services, r XML files that have been edited utside f Envirnment Manager - can be imprted. Hwever, because these files have been created r edited utside f the Envirnment Manager cnsle, any errrs are nt validated and culd impact the cnfiguratin n the database. The fllwing settings can be merged n imprt: Glbal registry inclusins & exclusins Glbal file path inclusins & exclusins User Applicatins added t an existing Applicatin Grup Applicatin Grup registry inclusins and exclusins Applicatin Grup file path inclusins and exclusins Servers added t an existing site The fllwing settings cannt be merged n imprt and result in an verwrite: User Applicatins that already exist Persnalizatin grups that already exist Servers added t a site which already exist in that site Windws Persnalizatin Servers When merging sites, the Membership Rules, Servers & Virtual Hsts, and Prperties are always updated with the settings frm the imprted site. When imprting Windws Settings Grups, the fllwing apply: Windws Settings Grups are always merged (r can be skipped) Windws Settings Cnditins are always replaced (r can be skipped) Individual (custmized) Windws Settings are always replaced (r can be skipped) Page 118 f 147

119 Exprt a Persnalizatin XML Template 1. In the Persnalizatin cnsle f Envirnment Manager, cnnect t the database that cntains the cnfiguratin yu want t exprt. 2. Frm the Tls ribbn, click Exprt. The Exprt Cnfiguratin dialg displays. The left-hand clumn f the dialg displays the ndes under which the cnfiguratin elements are gruped. Highlighting a nde displays all assciated elements fr that nde in the righthand pane. By default, all ndes and elements are selected. Clearing the User Applicatins checkbx excludes all managed applicatins frm the exprt. Hwever, if an applicatin is a member f a selected Applicatin Grup, it cannt be deselected unless the grup has first been deselected. 3. Select the checkbxes fr elements f the cnfiguratin that yu want t exprt. In the example belw, all Applicatin Grups, Persnalizatin Grups, User Applicatins have been selected fr exprt. 4. Click OK t pen a Save As Windws brwser dialg. 5. Navigate t where yu want t save the cnfiguratin file. Enter a file name, accept the default file type setting (Cnfiguratin Files *.xml), and click OK. Page 119 f 147

120 An XML file cntaining the selected elements is created. Fr whle cnfiguratins r large prtins theref, this may take a few secnds. When cmplete a cnfirmatin dialg displays. Imprt a Persnalizatin XML Template Cautin: Imprting User Persnalizatin cnfiguratins makes changes t yur database that cannt be undne. It is recmmended that yu back up yur database prir t using the Imprt feature 1. In the Persnalizatin cnsle f Envirnment Manager, cnnect t the database int which yu want t imprt cnfiguratin items. This culd be a new cnfiguratin r an existing ne that yu want t verwrite r add t. 2. Frm the Tls ribbn, click Imprt. A Windws brwser dialg displays. 3. Navigate t the cnfiguratin file that yu want t imprt. 4. Select the file and click Open. The Cnfiguratin Imprt dialg displays. This dialg cntains the cnfiguratin elements in the file fr imprt. Only thse ndes that were exprted are included. The left-hand clumn f the dialg bx displays the categries under which the cnfiguratin elements are gruped. Highlighting a categry displays all assciated elements fr that nde in the right-hand pane. By default, all ndes and elements are selected. 5. Use the checkbxes r buttns t select the elements that yu want t imprt int the cnfiguratin and click OK. Deselecting the User Applicatins checkbx excludes all managed applicatins frm the imprt. Hwever, if an applicatin is a member f a selected Applicatin Grup, it cannt be deselected unless the grup has first been deselected. 6. When an existing item is encuntered that has the same name as that in the file being imprted, a cnflict ccurs. Cnflicts are displayed in the Reslve Cnflicts dialg, which enables yu t select an actin t reslve each cnflict. If there are n cnflicts, g t step 8. Page 120 f 147

121 7. Frm the Reslve Cnflicts dialg select the actin required fr each element: Replace - The element in the current cnfiguratin is deleted and the ne frm the new cnfiguratin added. Skip - The new element is nt imprted and the existing ne remains unchanged. Merge - Cmbines the cntents f the tw elements t include the cntents f bth. Fr example, when imprting an applicatin grup that already exists in the database but cntains different applicatins, thse applicatins are added t the existing cnfiguratin t expand that applicatin t include all the applicatins frm bth applicatin grups. If yu are imprting default (ut-f-the-bx) Windws Settings Grups, yu can nly Merge r Skip a grup. If yu are imprting custmized Windws Settings Grups, yu can nly Replace r Skip. Cnditins always imprt in Replace mde, r yu can Skip them. Multiple cnflicts can als be reslved at categry level by selecting Replace All, Skip All r Merge All, where available. 8. Click OK. 9. A warning states that yu are making irreversible changes. Click OK t prceed. All selected elements are added t the persnalizatin cnfiguratin n the cnnected database. All elements are subject t nrmal behavir and can be edited as required. Page 121 f 147

122 Glbal Optins Access Rights Cntrl the authrized users fr administratin f the Persnalizatin Server and define wh can access and change Envirnment Manager cnsle settings. The user that cnfigures the Persnalizatin Server Cnfiguratin Prtal is autmatically added t the database as a Master Administratr. Initially this is the nly user that can cnnect t the database thrugh the cnsle. This user can then add users t the database. Any user can be added and deleted but at least ne Master Administratr must always be defined. Users wh are nt defined here cannt cnnect their cnsle t the Persnalizatin Server. This nly applies t the cnsle and nt managed users lgging nt endpints. User Rles Permissins Cnfigure Cnsle Access Rights User Rles Administratr The Administratr rle prvides access t the functinality in the Envirnment Manager Cnsle. Administratrs als have access t the Advanced Mde f the Endpint Self-Service Tl when the tl is enabled fr a Persnalizatin Grup. Administratrs cannt manage r assign ther user rles. Master Administratr The Master Administratr rle allws the user t manage rles assignment and prvides full access t the Envirnment Manager Cnsle and Brwser Interface functinality. Master Administratrs als have access t the Advanced Mde f the Endpint Self-Service Tl when the tl is enabled fr a Persnalizatin Grup. At least ne Master Administratr must always be defined. Supprt Cnsle The Supprt Cnsle prvides read-nly access t Envirnment Manager Persnalizatin cnfiguratins and allws users t view Persnalizatin Analysis reprts. Supprt Cnsle users can als use the assciated analysis functinality, such as rlling back applicatin settings. Using this rle, supprt teams can safely carry ut rutine maintenance fr end users in a restricted envirnment, withut full access t mdify the cnfiguratin. When a user with a Supprt Cnsle rle cnnects, functinality t mdify the persnalizatin cnfiguratin is autmatically disabled and the cnsle changes t a blue clr scheme. Page 122 f 147

123 Applicatin Team The Applicatin Team cnsle ffers limited access t Envirnment Manager Persnalizatin cnfiguratins and allws users t add, mdify and delete applicatins and Applicatin Grups and view Persnalizatin Analysis reprts. Applicatin Team users can als use Persnalizatin Analysis functinality, such as rlling back applicatin settings and cnverting discvered applicatins. When a user with the Applicatin Team rle cnnects, functinality t mdify sme f the persnalizatin cnfiguratin is autmatically disabled and the cnsle changes t a blue clr scheme. Permissins Envirnment Manager Cnsle Actin Admin Master Admin Create New Persnalizatin Grups Cnfigure Persnalizatin Grup Settings Cnfigure Persnalizatin Grup Membership Rules Cnfigure Persnalizatin Grup Applicatins Cnfigure Persnalizatin Grup Windws Persnalizatin Cnfigure Applicatin and Applicatin Grups Cnfigure Windws Persnalizatin Cnfigure Sites Cnfigure User Rles Cnfigure Advanced Settings Access Persnalizatin Analysis Read Access t Cnsle Supprt Cnsle Applicatin Team Page 123 f 147

124 Endpint Self-Service Tl Actin Admin Master Admin Run in Basic Mde Run in Advanced Mde Supprt Cnsle Applicatin Team Cnfigure Cnsle Access Rights 1. Select the User Persnalizatin navigatin buttn. 2. Click Access Rights frm the Manage ribbn. 3. The Access Rights dialg displays. 4. Click Add. The Select User r Grup dialg bx displays which searches the Active Directry fr users and grups which match entered criteria. The Advanced search buttn expands the dialg enabling the search t be further defined. 5. Select the required user r grup and click OK. The user r grup will be assigned the User rle by default. 6. Click the Rle clumn fr the user r grup t change the rle t ne f the fllwing: Master Administratr Administratr Supprt Cnsle Applicatin Team 7. The list can be updated as fllws: Click Remve t remve a user r grup frm the list Click the ellipsis in the name clumn f any grup r user t change the grup r user Click the rle clumn fr a user r grup t change the rle 8. When all users and grups are cnfigured as required, click Clse. Advanced Settings Advanced Settings enable an administratr t make changes t specific database and cmmunicatins settings. Changes made t any setting within here will affect the peratin f user persnalizatin fr all managed endpints. Advanced Settings shuld nly be added as advised by Supprt. With this ptin, new settings can be created whilst existing nes can be remved, edited r restred t their riginal install value. Page 124 f 147

125 Manage Advanced Settings 1. Select the User Persnalizatin navigatin buttn. 2. Frm the Manage ribbn, click Advanced Settings. The Advanced Settings dialg displays. Any settings displayed in bld are thse which have been edited r added t the default settings. 3. Change the Advanced Settings list as required: Change value - Click in the value fr the required setting enter a new ne. Add an Advanced Setting - Click Add, enter the Name, Value and ptinal Descriptin fr a new Advanced Setting and click Clse. Remve an Advanced Setting - Highlight an Advanced Setting and click Remve. Restre the Advanced Settings list - Click Restre t reset the list t its initial install state; all values are reset and any created entries are remved. Cautin: If VirtualizatinFiles r VirtualizatinRegistry are set t false, persnalizatin will nt functin crrectly. Adjusting the setting fr ffline_restrerate and ffline_samples can impact n persnalizatin perfrmance. D nt change these values unless advised by ur Supprt team. Advanced Settings List Envirnment Manager cntains the fllwing glbal settings: Grup Default Value Descriptin ArchiveLcalPrfilesOnly true Set whether t archive all prfiles r nly lcal prfiles. AutmaticArchiveInterva ldays AutmaticArchiveStartTi me 1 Set the number f days between when archives are created. 01:00 The time (hh:mm) at which daily archiving and purging takes place. The timezne settings frm the persnalizatin database will be utilized. If the time is nt in the crrect frmat, archiving will nt wrk and an errr message will appear in the Windws Applicatin lg n the Persnalizatin Server. If there are multiple Persnalizatin Servers errr messages will appear n all servers. Page 125 f 147

126 Grup Default Value Descriptin The time zne f this time is the time zne f the SQL Server machine - nt the Persnalizatin Server machines. This is t match the 8.0 behavir (when archiving was dne by SQL Server Agent). cmmslggingenabled false Enables r disables cmmunicatins lgging n the managed endpints. True r false. When set t true, all clients prduce lgs f cmmunicatins with the persnalizatin server. These lgs shw all persnalizatin activity t give cnfidence that persnalizatin is wrking crrectly. The lgs are by default written t the user s lcal applicatin data flder, fr example, C:\Users\username\AppData\Lcal\AppSense\E nvirnment Manager\CmmsLgs, but if diagnstic lgging is enabled the lgs are written instead t lgdirectry\user ssid\cmmslgs. Cmms lgging may be enabled fr an individual endpint by defining the registry DWORD value HKEY_LOCAL_ MACHINE\Sftware\Appsense\Envirnment Manager\CmmsLggingEnabled n the endpint and setting it t 1. T enable fr a single user define HKEY_CURRENT_ USER\Sftware\Appsense\Envirnment Manager\CmmsLggingEnabled instead. When diagnstic lgging is enabled n an endpint, all the infrmatin that appears in the cmms lgs will als appear in the diagnstic lgs t - the cmms lgs merely prvide a shrt summary f persnalizatin activity. cnfigpll 600 The interval (in secnds) in which the managed endpints pll the persnalizatin server fr cnfiguratin changes Page 126 f 147

127 Grup Default Value Descriptin Setting this value t 60 secnds r less leads t a large increase in memry frm the WinHTTP cde. daysfcmmslgtkeep 3 When cmmunicatins lgging is enabled (using the cmmslggingenabled ptin), this setting specifies the number f days lgs t retain. debug false Enables lgging f synchrnizer activity fr each applicatin n all endpints. These lgs are written t the prfile cache fr each applicatin in the lgs subdirectry directry. Fr example, C:\appsensevirtual\S \{58A6B7A8-C2F6-43E1-88AC-07531B5D53A8}\ntepad\lgs. desktpinclusins jpg;jpeg;bmp;ic;c ur;ani File types t be included fr persnalizatin f desktp settings fr a user. DNS_Reslve_Timeut 5 The timeut (in secnds) fr the managed endpint t reslve the persnalizatin server name when attempting synchrnizatin f data. HTTP_Cnnect_Timeut 5 The managed endpint t persnalizatin server recnnect timeut (in secnds). This setting is nly valid nce the managed endpint has received and laded the persnalizatin cnfiguratin fr the first time. HTTP_Receive_Timeut 30 The managed endpint t persnalizatin server receive timeut (in secnds). This setting is nly valid nce the managed endpint has received and laded the persnalizatin cnfiguratin fr the first time. HTTP_Send_Timeut 30 The managed endpint t persnalizatin server send timeut (in secnds). This setting is nly valid nce the managed endpint has received and laded the persnalizatin cnfiguratin fr the first time. InactivePrfileExpiryMn ths 0 The expiry time (in mnths) fr inactive prfiles, after which time they are deleted. Set t 0 t Page 127 f 147

128 Grup Default Value Descriptin disable this ptin. InactiveUserExpiryADChe ck true If set t true, users are nly deleted if they n lnger exist in active directry. This setting is nly applicable if the InactiveUserExpiryDays is nn-zer. InactiveUserExpiryDays 180 The expiry time fr inactive users. If a user des nt lg in within the specified time, their prfile is deleted. Set t 0 t disable this ptin. InactiveUserExpiryMnth s 0 The expiry time (in mnths) fr inactive users. If a user des nt lg in between the specified time, their prfile is deleted. Set t 0 t disable this ptin. jpgquality 50 The amunt f cmpressin t apply (as a percentage) used when cnverting a desktp wallpaper frm BMP t JPG fr persnalizatin database strage. 100 = best quality, n cmpressin. 0 = wrst quality, maximum cmpressin. LegacyFbrDeleteDelayDa ys 30 The number f days after which legacy FBR files are deleted frm a prfile where a hive file has been created by a later client. T disable this setting, apply a 0 value. This setting is nly applied if the UpgradeFbrHive prperty is enabled fllwing an upgrade. linkfailretryplltimescales 90 The cnfiguratin pll perid (in secnds) used by the managed endpint when cmmunicatin with the persnalizatin server is lst. ManagePersistentDat false Enable management f the persistent.dat file n the client. If set t false, persistent.dat is nt saved t the database. maxlinkfailbackffsecs 1800 Used with minlinkfailbackffsecs t create a randm ffline cnfig plling time fr clients. This ensures that when clients g ffline, they d nt pll the server simultaneusly, which culd result in spike in the server lad. Page 128 f 147

129 Grup Default Value Descriptin minlinkfailbackffsecs 300 Used with maxlinkfailbackffsecs t create a randm ffline cnfig plling time fr clients. This ensures that when clients g ffline, they d nt pll the server simultaneusly, which culd result in spike in the server lad. MnthsOfUsageDataTK eep 6 The number (in mnths) f usage data t keep fr user applicatins. Usage data lder than this value are deleted by the daily archiving jb. Netwrk_Path_Supprt False Enables r disables the persnalizatin f applicatin settings stred n netwrk paths and mapped drives. These must als have been cnfigured as inclusins within persnalizatin. When set t False netwrk drives are nt persnalized and applicatin settings are nt written t the virtual cache. Change the setting t True t persnalize any applicatin settings written t included netwrk flders. NumberOfArchivesTKe ep 5 Used by the daily archive jb, this defines the number f daily archives t retain. ffline_restrerate 100 The cmmunicatin rate (in kb/secnd) abve which the managed endpint cnsiders cmmunicatin with the persnalizatin server t be restred and hence nline. This value must be higher than the ffline_failrate value. Adjusting the Glbal Settings can impact n Persnalizatin perfrmance. This value is prvided fr supprt purpses and shuld nt be mdified by the end user. ffline_samples 4 The number f samples, in a mving average, used by the managed endpint t measure the link transfer rate and detect an ffline cnditin. Adjusting the Glbal Settings can impact n Persnalizatin perfrmance. Page 129 f 147

130 Grup Default Value Descriptin This value is prvided fr supprt purpses and shuld nt be mdified by the end user. PingWebServerTimeOfDa ylcal 01:05 Lcal time that backgrund services ping crrespnding servers. It shuld be set t a time after the persnalizatin server s daily recycle time. PrfileCleanupDelayDays 30 The delay befre endpints clean extraneus data frm prfiles after a change t inclusins r exclusins. Set t 0 fr n delay r -1 t disable the cleanup functin. pvcdebug 0 The Persnalizatin Virtualizatin Cmpnent (PVC) debug level fr all managed endpints. 0 is disabled. 10 is verbse. Setting this value will enable PVC debugging n all endpints and will have a detrimental effect n perfrmance as well as heavy use f disk space. It is recmmended instead t enable debugging n a per-endpint basis using registry settings. ReplicatinType nne Used in replicated SQL envirnments t identify master / slave / nne fr archiving purpses. This value is set by the archiving script and is nt recmmended t be changed by the user. syncpll 900 The interval (in secnds) between managed endpint retries f failed synchrnizatins when ffline resiliency is enabled. transprt http Transprt Type. Only required fr backwards cmpatibility with lder versins f the Envirnment Manager Agent. This value is prvided fr supprt purpses and shuld nt be mdified by the end user. versin 3.0 This value is n lnger used and will be remved in future versins f Envirnment Manager. virtualzatinfiles true Enable r disable User Persnalizatin f files fr all managed endpints. True r false. Page 130 f 147

131 Grup Default Value Descriptin This value is prvided fr supprt purpses and shuld nt be mdified by the end user. virtualizatinregistry true Enable r disable User Persnalizatin f registry settings fr all managed endpints. True r false. This value is prvided fr supprt purpses and shuld nt be mdified by the end user. Applicatin Exclusins Applicatins in the Applicatin Exclusins list are nt managed if they are started as child prcess f a managed applicatin. Hwever, exclusins can be verridden by adding an excluded applicatin t the managed applicatins list fr a persnalizatin grup. Child prcesses f a managed applicatin are persnalized by default. Sme child prcesses may nt be suitable fr persnalizatin. It culd be that a child prcess cntinues t run when the managed parent applicatin is clsed; preventing the parent applicatin frm synchrnizing with the database. By adding the child prcess t the Applicatin Exclusins, the parent applicatin will synchrnize crrectly when clsed. The Applicatins Exclusins list is pre-ppulated with applicatins recmmended fr exclusin frm persnalizatin. The list includes cmmn applicatins which are nt necessarily suitable fr persnalizatin, such as registry editing tls and system administratin utilities. The Applicatin Exclusin list can be updated by adding new applicatins and remving existing nes. Frm the Manage ribbn, select Applicatin Exclusins t display the currently excluded applicatins. Amend the list f applicatins using the Add and Remve buttns. Data Cllectin Settings Glbal settings fr Applicatin Data Cllectin are available t specify registry and flder inclusins and exclusins and t clear all cllected data. Applicatin Data Cllectin Inclusins and Exclusins Registry and flder inclusins and exclusins determine which registry keys and flders are passively mnitred by Applicatin Data Cllectin. Page 131 f 147

132 Add Registry Inclusin r Exclusin fr Applicatin Data Cllectin 1. Select the User Persnalizatin navigatin buttn. 2. Frm the Manage ribbn, click Data Cllectin Settings. The Applicatin Data Cllectin Settings dialg displays. 3. Select the Registry tab. 4. Right-click in either the Include r Exclude area and select Add Registry Key. The Add Registry Key dialg displays. 5. In the Key field, select the ellipsis (...) t brwse fr the registry key r manually enter the path and key name. Wildcards can be used anywhere in a registry path t represent ne r mre characters. Fr example, adding *.0 t the path fr Micrsft Outlk means all versins f Outlk can be included r excluded with ne entry: HKCU\Sftware\Micrsft\Office\*.0\Outlk The Brwse Registry dialg displays. Yu can select frm yur lcal cmputer, current user r click Cnnect t display the Active Directry Select Cmputer dialg t select anther cmputer t brwse. 6. Lcate the required Registry Key and click OK. The selected registry key is entered in the Add Registry Key dialg. 7. Click OK. The selected Registry Key is added t the Include r Exclude list in the wrk area. 8. Click Clse. Add Flder Inclusin r Exclusin fr Applicatin Data Cllectin 1. Select the User Persnalizatin navigatin buttn. 2. Frm the Manage ribbn, click Data Cllectin Settings. The Applicatin Data Cllectin Settings dialg displays. 3. Select the Flder tab. 4. Right-click in either the Include r Exclude area and select Add Flder. The Select Flder dialg displays. Page 132 f 147

133 5. In the Path field, select the ellipsis (...) t brwse fr the flder. The path can als be entered manually. The Brwse fr Flder dialg displays. Yu can select an existing flder frm yur lcal cmputer r click the Make New Flder buttn t create a new flder fr inclusin r exclusin. 6. Lcate the required flder and click OK. The selected flder path is entered in the Select Flder dialg. 7. Click OK. The flder path is added t the Include r Exclude list in the wrk area. 8. Click Clse. Remve Cllected Data frm Applicatin Data Cllectin Remve all data cllected fr Persnalizatin Grups which have, r have had, Applicatin Data Cllectin enabled. This remves all registry and flder data fr cllected applicatins. Cautin: Clearing cllected data is permanent. Data cannt be recvered. 1. Select the User Persnalizatin navigatin buttn. 2. Frm the Manage ribbn, click Data Cllectin Settings. The Applicatin Data Cllectin Settings dialg displays. 3. Click Clear all Data Cllectin. A cnfirmatry prmpt is displayed. 4. Click Yes. The cllected data is cleared. Page 133 f 147

134 Persnalizatin Analysis Persnalizatin Analysis allws yu t view data cllected n a Persnalizatin Server abut users, applicatins and Windws Persnalizatin. Reprts can be run fr Persnalizatin Grups t display current and histrical persnalizatin data. Once a reprt has been generated, the infrmatin can be used t directly manipulate data n the Persnalizatin Server. This functinality has a real-time effect n applicatin and user settings n the live database allwing administratrs t: Manually create and delete archives fr applicatin settings Restre applicatin settings frm a previus, archived state Delete a user s applicatin settings, reverting t the applicatin s default settings View and edit an applicatin s stred registry and file data Cnvert discvered applicatins t managed applicatins Mve applicatin settings between persnalizatin grups Multiple Persnalizatin Analysis reprt windws can be pened at the same time allwing data t be easily cmpared between different users, applicatins and Windws Settings. The Envirnment Manager Supprt Cnsle allws users t use Persnalizatin Analysis functinality withut full cnfiguratin access t the database. Generate a Persnalizatin Analysis Reprt 1. Select the User Persnalizatin navigatin buttn. 2. Select Persnalizatin Grups and select a persnalizatin grup t analyze. 3. Click Persnalizatin Analysis frm the Tls & Wizards ribbn. The Persnalizatin Analysis reprt windw displays fr the selected persnalizatin grup. 4. Use the tabs t select the required reprt type: Size Applicatin Usage Discvered Applicatin Usage Archive Reprts 5. Select the required criteria fr the reprt. Each reprt has different criteria which can be set t manipulate the results: Size and Usage reprts can be generated fr applicatins r users. Archive reprts can nly be generated a specified user. Usage reprts can prduce results fr a specified time perid. The default perid is the week prir t and including the current date. Page 134 f 147

135 6. Click Display. A reprt based n the criteria entered is generated and displayed. Using the Srt by drp-dwn, Size reprts can be rdered by Size r User and Usage reprts by Accesses r User. 7. Click Print t generate a printable cpy f the reprt. Page Settings and ther print ptins can be used as required prir t printing. Persnalizatin Analysis and Windws Settings Within Persnalizatin Analysis, Windws Settings are listed as an applicatin in Size, Applicatin Usage and Archive reprts. Data fr each Windws Settings Grup can be accessed by clicking the Windws Settings bar. This allws the registry and file list t be edited and settings deleted fr each grup. Size and Usage Reprts In this sectin: "Size and Usage Reprts" abve "Size and Usage Reprt Criteria" n the next page "Mve a User s Persnalizatin Settings t Anther Grup" n the next page "Delete Applicatin Settings fr a User" n page 137 Page 135 f 147