Citrix Profile Management 2407

Last Modified: Aug 20, 2024 @ 8:58 am

1,143 Comments

Navigation

This article applies to all versions of Profile Management: 2407, 2402 LTSR CU1, 2203 LTSR CU5, 1912 LTSR CU9, etc.

💡 = Recently Updated

Change Log

Planning

Profile Management Versions

Profile Management is included with the installation of Virtual Delivery Agent. To upgrade Profile Management, simply upgrade your VDA software. Here are the currently supported versions of VDA:

Or you can download the individual Profile Management component and install/upgrade it separately from the VDA software. You can even install it on non-VDA machines (e.g., PCs accessed by licensed Citrix users).

For LTSR VDAs, for LTSR support compliance, only install the Profile Management version that is included with your VDA installer. Don’t upgrade to a newer Current Release version.

The latest release of Citrix Profile Management is version 2407, which can be downloaded from Citrix Virtual Apps and Desktops 2407. To find it, click Components that are on the product ISO but also packaged separately.

Profile Management Configuration Options

Profile Management consists of a Service (installed on the VDAs), a file share, and configuration settings.

There are four methods of delivering configuration settings to the Citrix Profile Management service:

If a UPM setting is not configured in GPO, Citrix Policy, or WEM, then the default setting in the UPMPolicyDefaults.ini file takes effect. The .ini file is located in C:\Program Files\Citrix\User Profile Manager on every machine that has Profile Management service installed.

Microsoft Group Policy (ADMX file) is probably the most reliable method of delivering configuration settings to the Profile Management services. This method uses the familiar Group Policy registry framework. Just copy the Profile Management ADMX files to PolicyDefinitions and start configuring. The configuration instructions in this article use the GPO ADMX method.

The Citrix Policies configuration method requires Citrix Studio, or Citrix Group Policy Management Plug-in. On the Profile Management service side, only VDAs can read the Citrix Policies settings.

  • Citrix Policies has settings for Folder Redirection. If you use Citrix Policy to configure Folder Redirection, then the Folder Redirection settings only apply to VDAs that can read Citrix Policies. To apply to Folder Redirection to more than just VDAs, configure Folder Redirection using normal Microsoft Group Policy as detailed below.
  • If you’re going to use Microsoft Group Policy to configure Folder Redirection, then you might as well use Microsoft Group Policy to also configure Citrix Profile Management.

Citrix Workspace Environment Management can also deliver configuration settings to the Profile Management services. This option requires the WEM Agent to pull down the settings from the WEM Brokers and apply them to Profile Management. It can sometimes be challenging to troubleshoot why WEM is not applying the settings.

Try not to mix configuration options. If you use both WEM and GPO, which one wins?

Multiple Datacenters

For optimum performance, users connecting to Citrix in a particular datacenter should retrieve their roaming profiles from a file server in the same datacenter. If you have Citrix in multiple datacenters, then you will need file servers in each datacenter.

DFS active/active replication of roaming profiles is not supported. This limitation complicates multi-datacenter designs.

For active/active datacenters, split the users such that different users have different home datacenters. Whenever a particular user connects, that user always connects to the same datacenter, and in that datacenter is a file server containing the user’s roaming profile. StoreFront uses Active Directory group membership to determine a user’s home datacenter.

For users that connect to Citrix in multiple datacenters, there are a couple options:

  • The user’s roaming profile is located in only one datacenter – If the user connects to a remote datacenter, then the roaming profile must be transmitted across the WAN. To optimize performance, disable Active Write Back, and make sure Profile Streaming is enabled.
  • The user has separate profiles for each datacenter – There is no replication of profiles between datacenters. This scenario is best for deployments where different applications are hosted in different datacenters.

Disaster Recovery – For disaster recovery scenarios, the user’s roaming profile data (and home directories) must be recovered in a different datacenter. Here are some considerations:

  • Use DFS One-way replication. After the disaster, edit the DFS Namespace folder target to point to the file server in the DR datacenter. You must avoid multi-master DFS replication/namespace.
  • Use VMware SRM or similar to recover the entire file server in the DR datacenter.
  • A datacenter failover might result in multiple file servers accessed from a single VDA, especially if you have users split across datacenters. Use DFS Namespaces as detailed below.

DFS Namespace

DFS Namespace for central user store – The Citrix Profile Management user store path is a computer-level setting, meaning there can only be one path for every user that logs into a particular VDA. If you have different users with roaming profiles on different file servers, then you must use Active Directory user attributes and DFS namespaces to locate the user’s file server. Here is an overview of the configuration:

  • Create a domain-based DFS namespace with folder targets on different file servers. See Scenario 1 – Basic setup of geographically adjacent user stores and failover clusters at Citrix Docs for more information.
  • Do not enable two-way DFS Replication for the roaming profile shares. But you can do One-way DFS replication. See Scenario 2 – Multiple folder targets and replication at Citrix Docs for more information.
  • Edit each user in Active Directory with a location (l) attribute that matches the DFS folder name.
  • Set the Profile Management user store path to \\corp.local\CtxProfiles\#l#\#SAMAccountName#\!CTX_OSNAME!!CTX_PROFILEVER!. This pulls the user’s l attribute from Active Directory and appends that to the DFS share. The folder that matches the attribute value is linked to a file server. For example, if the user’s l attribute is set to Omaha, then the user’s profile will be located at \\corp.local\CtxProfiles\Omaha\user01\Win2016v6. The Omaha folder is linked to a file server in the Omaha datacenter.

Create User Store

This procedure could also be used to create a file share for redirected profile folders.

Create and Share the Folder

  1. Make sure file and printer sharing is enabled.
  2. On the file server that will host the file share, create a new folder and name it CtxProfiles or similar.

  3. Right-click the folder, expand Give Access to (Windows Server 2019) or expand Share with (Windows Server 2016) and select Specific people.

  4. Give Everyone (or some other group that contains all Citrix Users) Full Control (Read/Write). Click Share, and then click Done.
  5. Go to the Properties of the folder.
  6. On the Sharing tab, click Advanced Sharing.
  7. Click Caching.
  8. Select No files or programs. Click OK, and then click Close.

Folder NTFS Permissions

  1. Open the properties of the new shared folder.
  2. On the Security tab, click Edit.
  3. For the Everyone entry, remove Full Control and Modify. Make sure Write is enabled so users can create new folders.
  4. Add CREATOR OWNER and give it Full Control. This grants users Full Control of the folders they create. Click OK.
  5. Now click Advanced.
  6. Highlight the Everyone permission entry, and click Edit.
  7. Change the Applies to selection to This folder only. Click OK three times. This prevents the Everyone permission from flowing down to newly created profile folders.

Access Based Enumeration

With this setting enabled, users can only see folders to which they have access:

  1. In Server Manager, on the left, click File and Storage Services.
  2. If you don’t see Shares then you probably need to close Server Manager and reopen it. Or perform a refresh.
  3. Right-click the new share and click Properties.
  4. On the Settings page, check the box next to Enable access-based enumeration.

GPO ADMX Policy Template

  1. You can find the GPO ADMX templates on the main Citrix Virtual Apps and Desktops 2407 ISO in the \x64\ProfileManagement\ADM_Templates\en folder.

    • Or they are included in the standalone Profile Management download in the \Group Policy Templates\en folder.
  2. Copy the file ctxprofile.admx to the clipboard.
  3. If your domain has PolicyDefinitions copied to SYSVOL, paste the file there.

    • If you don’t have SysVol PolicyDefinitions, then go to C:\Windows\PolicyDefinitions and paste the file.
  4. If you have an older version of the ctxprofile.admx file in either location, delete it. Note: replacing the .admx file does not affect your existing Profile Management configuration. The template only defines the available settings, not the configured settings.
  5. Go back to the Citrix Profile Management Group Policy Template files.
  6. Copy ctxprofile.adml to the clipboard.
  7. If your domain has a PolicyDefinitions central store in SYSVOL, copy it to the en-us folder in SYSVOL. This is a subfolder of the PolicyDefinitions folder.

    • If you don’t have SysVol PolicyDefinitions,, then go to C:\Windows\PolicyDefinitions\en-US and paste the file. This is a subfolder of the PolicyDefinitions folder.
  8. If you have an older version of the ctxprofile.adml file in the en-US folder in either location, delete it.

CitrixBase:

  1. Go up a folder and then open the CitrixBase folder.
  2. In the CitrixBase folder, copy the file CitrixBase.admx to the clipboard.
  3. If your domain has PolicyDefinitions copied to SYSVOL, paste the file there.

    • If you don’t have SysVol PolicyDefinitions, then go to C:\Windows\PolicyDefinitions and paste the file.
  4. Go back to the Citrix Profile Management Group Policy Templates and copy CitrixBase.adml to the clipboard.
  5. If your domain has a PolicyDefinitions central store in SYSVOL, copy it to the en-us folder in SYSVOL. This is a subfolder of the PolicyDefinitions folder.

    • If you don’t have SysVol PolicyDefinitions,, then go to C:\Windows\PolicyDefinitions\en-US and paste the file. This is a subfolder of the PolicyDefinitions folder.

Group Policy Settings

  1. Edit a GPO that applies to all machines (VDAs) that have the Profile Management service installed.
  2. Go to Computer Configuration | Policies | Administrative Templates | Citrix Components | Profile Management.
    • Note: if you did not install the CitrixBase.admx file, then you can find Profile Management directly under the Administrative Templates node instead of under Citrix Components.
  3. Enable the setting Enable Profile management. Profile Management will not function until this setting is enabled.
  4. If desired, enable the setting Process logons of local administrators.
  5. Enable Path to user store.
  6. Specify the UNC path to the folder share. An example path = \\server\share\#SAMAccountName#\!CTX_OSNAME!!CTX_PROFILEVER!

    1. Profile Versions– Different OS versions have different profile versions. Each profile version only works on specific OS versions. For example, you cannot use a Windows 7 profile (v2) on Windows 10 1607 (v6). The variables in the path above ensure that every unique profile version is stored in a unique folder. If users connect to multiple operating system versions, then users will have multiple profiles.
      1. Windows 10 Profile Versions – Windows 10 has two different profile versions. Windows 10 build 1511 and older use v5 profiles. Windows 10 build 1607 and newer use v6 profiles. v5 and v6 profile versions are incompatible so they should be separated.
      2. Resolved variables – With the example user store path shown above, if the user logs into Windows 2012 R2 RDSH, the profile folder will be \\server\share\user01\Win2012R2v4. If the user logs into 64-bit Windows 10 build 1607, the profile folder will be \\server\share\user01\Win10RS1v6.
      3. Windows 10 v6 vs Windows 2016 v6 – Both Windows 10 (1607 and newer) and Windows Server 2016 use v6 profiles. Do you want to use the same profile for both platforms? If so, remove !CTX_OSNAME! from the Path. Note: Windows 10 supports Store apps while Windows 2016 does not. If you’re allowing Store apps, then it’s probably best to use different profiles for both OS platforms.
      4. Windows 2012 R2 warning: in older versions of Citrix Profile Management, !CTX_PROFILEVER! recognizes Windows 2012 R2 as v2, which isn’t correct. v2 is Windows Server 2008 R2, while Windows Server 2012 R2 is v4. The profile version bug was fixed in Profile Management 5.4 and newer. If you have existing Windows 2012 R2 profiles based on the !CTX_PROFILEVER! variable set to v2, after upgrading to 5.4 or newer, then your profiles might stop working . See http://discussions.citrix.com/topic/374111-psa-upm-54-ctx-osname-server-2012-value-change/ for more details.
    2. Windows 10 and !CTX_OSNAME!: Profile Management sets !CTX_OSNAME! to different strings for different Windows operating system versions, especially different versions of Windows 10: (RS = Redstone, which is a Microsoft codeword)
      • Windows Server 2019 sets !CTX_OSNAME! to Win2019v6.
      • Windows Server 2016 sets !CTX_OSNAME! to Win2016v6.
      • Windows 10 version 1903 and 1909 set !CTX_OSNAME! to Win10RS6.
      • Windows 10 version 1809 sets !CTX_OSNAME! to Win10RS5.
      • Windows 10 version 1803 sets !CTX_OSNAME! to Win10RS4.
      • Windows 10 version 1709 sets !CTX_OSNAME! to Win10RS3.
      • Windows 10 version 1703 sets !CTX_OSNAME! to Win10RS2.
      • Windows 10 version 1607 sets !CTX_OSNAME! to Win10RS1.
    3. If you use !CTX_OSNAME! in your profile store path, then different CTX_OSNAMEs will have different profiles, which means users will lose their profile settings whenever you upgrade Windows 10.
      • Profile Management 1909 and newer have a setting called Automatic migration of existing application profiles under Profile Handling that can alleviate this problem.
    4. Multiple Domains – If you have multiple domains, in the user profile store path, change #SAMAccountName# to %username%.%userdomain% (e.g. \\server\share\%username%.%userdomain%\!CTX_OSNAME!!CTX_PROFILEVER!). That way you can have the same account name in multiple domains and each account will have a different profile.
    5. Hard Code Store Path – Instead of using variables, you can specify a hard coded path. However, the profile incompatibility restrictions listed above still apply. To avoid applying a single profile across multiple operating system versions, place VDAs with different OS versions in different OUs, and then use different Profile Management GPOs on those OUs to specify different Profile Management user store paths.
    6. Migrate User Store – Profile Management 1909 and newer can move profiles from an old profile path to a new profile path.

    7. User-level overrides – Profile Management 2305 and newer support user-level overrides. First, configure Enable user-level policy settings under Advanced Settings. Then add registry keys for user group SIDs with override settings. See Enable and configure user-level policy settings at Citrix Docs.

  7. Disable Active write back. This feature places additional load on the file server and is only needed if users login to multiple machines concurrently and need mid-session changes to be saved, or if users never log off from their sessions. Note: if you don’t disable this, then it is enabled by default.

    1. Profile Management 2303 and newer have an option to only perform Active write back on session lock and disconnection.
  8. On the left, go to the Advanced settings node.
  9. If Microsoft Teams 2.1 or newer, and if Teams is installed per machine, then simply make sure Profile Management is version 2402 or newer. See Enable roaming for the new Microsoft Teams at Citrix Docs.
  10. Enable the setting Process Internet cookie files on logoff. This is probably only for Internet Explorer.
  11. The Replicate user stores setting replicates to multiple file shares. Note: this slows down logoffs. Profile Management 2209 and newer supports replicating profile containers, which seems to use robocopy.exe.

    • In Profile Management 2407 and newer, for the container-based profile solution, the Enable in-session policy container failover among user stores policy is automatically enabled to ensure profile redundancy for the entire session.
  12. Customer Experience Improvement Program (CEIP) is enabled by default. It can be disabled here.
  13. See https://www.carlstalhood.com/delivery-controller-cr-and-licensing/#ceip for additional places where CEIP is enabled.
  14. Profile Management 2206 adds Enable asynchronous processing for user Group Policy on logon. This might speed up logons. This feature requires you to disable Always wait for the network at computer startup and logon and enable Allow asynchronous user Group Policy processing when logging on through Remote Desktop Services. More details at Citrix Docs.
  15. Profile Management 2311 and newer support Enable OneDrive container. It works the same way as search index roaming as detailed next. See Citrix Tech Zone Deployment Guide: Citrix Profile Management – OneDrive Container.
  16. Profile Management 7.18 and newer have Enable search index roaming for Outlook.

Notes on Outlook OST and Search roaming:

  1. Microsoft FSLogix is another Outlook search index roaming product that is now free. For details, see the FSLogix section in the computer group policy article.
  2. Profile Management 1906 and newer support 64-bit Outlook 2016 and Office 2019.
  3. VDA 1906 or newer are recommended for the bug fixes for this feature. You can upgrade the VDA without upgrading your Delivery Controllers.
  4. After the first user logon, Profile Management 1811 and newer creates a template VHDX file in a folder named UpmVhd at the root of the user store. The template file is copied to new users, thus speeding up VHDX creation.

  5. In the user’s profile location, a new folder called VHD is created.

    • You can override the VHDX path by configuring Customize storage path for VHDX files as detailed at Citrix Docs.
  6. Inside the \VHD\Win2016 folder are two new thin provisioned .vhdx files – one for OST, one for Search. The per-user .vhdx files are copied from the parent template.
  7. UPM grants Domain Computers Full Control of the VHDX files. Users must have Full Control to the Profile Share, and UPM Folder to be able to grant this permission. Modify permissions are not sufficient. (Source = Robert Steeghs The Citrix Profile management could not mount virtual disk)
  8. When the user logs into a Citrix session, the two VHDXs are mounted to %localappdata%\Microsoft\Outlook and %appdata%\Citrix\Search. This means that OST files and Search Indexes are stored in the VHDX instead of in the user’s profile.


  9. eastwood357 at Outlook OST and Search vhdx not unmounting after log off at Citrix Discussions says that the Profile Management Path to User Store must be all lower case or else the VHDX files will not unmount at logoff.
  10. Only enable this feature for users with new Outlook profiles. If the user already has an .ost file, then you’ll see an error about missing .ost when Outlook is launched.
  11. The Search roaming feature is only supported with specific versions of Windows Search service. Event Log will tell you if your Windows patches are too new.
  12. Profile Management 2206 and newer have an option for Enable concurrent session support for Outlook search data roaming.

    • In older Profile Management, VHDX files can only be mounted on one machine at a time. If you login to two VDAs, and if both try to mount the same VHDX files, then you’ll see errors in Event Viewer.
  13. Search Index Backup – Profile Management 1909 and newer have a GPO setting named Outlook search index database – backup and restore that can provide automatic recovery of the search index if it becomes corrupted. The backup consumes more of the available storage space of the VHDX files.
  14. For a detailed explanation of how the per-user Search Index works, see CTX235347 Citrix Profile Management: VHDX-based Outlook cache and Outlook search index on a user basis.
  15. Profile Management 2109 and newer can Automatically reattach detached VHDX disks. In Profile Management 2203 and newer, it’s available as a group policy setting under the Profile Management | Advanced Settings node.
  16. Profile Management 2303 and newer have a Profile Container GPO setting to Enable VHD disk compaction on user logoff. See Citrix Docs.

    • Additional disk compaction settings can be found under Advanced Settings.

Exclusions, Synchronization, and Mirroring

  1. Profile Management 2209 and newer have File Deduplication > Files to include in the shared store for deduplication. You must specify which files to delete from each user’s profile and instead store in a shared location. See Citrix Docs. Profile Management 2311 support Files deduplication of profile containers.
  2. Under the File system node in the Group Policy Editor, enable the setting Enable Default Exclusion List – directories.
  3. You can use checkboxes to not exclude some folders.
  4. Then edit Exclusion list – directories.
  5. Enable the setting, and click Show.

  6. For Edge Chromium, see Avanite Roaming Edge Chromium.
  7. For Chrome, use the same list as Edge but change \Microsoft\Edge to \Google\Chrome.
  8. Add the following to the list. 
    AppData\Local\Microsoft\Windows\INetCache
AppData\local\Microsoft\Windows\IEDownloadHistory
AppData\Local\Microsoft\Internet Explorer\DOMStore
AppData\Local\Google\Software Reporter Tool
AppData\Roaming\Microsoft\Teams\media-stack
AppData\Roaming\Microsoft\Teams\Logs
AppData\Roaming\Microsoft\Teams\Service Worker\CacheStorage
AppData\Roaming\Microsoft\Teams\Application Cache
AppData\Roaming\Microsoft\Teams\Cache
AppData\Roaming\Microsoft\Teams\GPUCache
AppData\Roaming\Microsoft\Teams\meeting-addin\Cache
  9. Newer versions of Office Click-to-run let you roam the shared computer activation licensing token. See Overview of shared computer activation for Office 365 ProPlus and search for “roam”. The licensing tokens also last 30 days instead of 2-3 days. Source = Rick Smith in the comments. Ideally you should have ADFS integration so users can seamlessly re-activate Office.
  10. James Rankin has a much longer list of exclusions and synchronizations at Everything you wanted to know about virtualizing, optimizing and managing Windows 10…but were afraid to ask – part #6: ROAMING.
  11. Nick Panaccio at IE11 Enterprise Mode and UPM at Citrix Discussions has a list of exclusions for IE in Enterprise Mode. 
    appdata\local\microsoft\internet explorer\emieuserlist
appdata\local\microsoft\internet explorer\emiesitelist
appdata\local\microsoft\internet explorer\emiebrowsermodelist
  12. Then click OK twice to return to the Group Policy Editor.
  13. usrclass.dat*.
    1. Profile Management 1909 and newer automatically include usrclass.dat* in the Files to Synchronize. UPM 2103 and newer add it for Windows 10 but not for RDSH. If added to the exclusion list, then Profile Management 1909 and newer automatically removes it from the exclusion list. See Start menu roaming at Citrix Docs.
    2. usrclass.dat* contains file type associations. For roaming file type associations, you can export/import HKCU\SOFTWARE\Classes\Applications as described by Christoph Kolbicz at User File Type Association Roaming on Server 2016 with Citrix User Profile Manager.
  14. Clean up excluded folders –  If you add to the exclusions list after profiles have already been created, Profile Management 5.8 has a feature that can delete the excluded folders at next logon. See To enable logon exclusion check at Citrix Docs. In Profile Management 7.15 and newer, Logon Exclusion Check is configurable in group policy under the File System node.

    1. Also see Muralidhar Maram’s post at Citrix Discussions for a tool that will clean up the existing profiles.
    2. Also see Jeremy Sprite Clean Citrix UPM Profiles.

Directories to Synchronize

  1. Under the File System\Synchronization node in the Group Policy Editor you can configure which profile folders should be synchronized that have otherwise been excluded.
  2. Edit the setting Directories to synchronize.
  3. Enable the setting, and click Show.
  4. Profile Management 7.16 Fixed Issues says that AppData\Local\Microsoft\Windows\Caches should be synchronized. Also see CTX234144 Start Menu Shows Blank Icons on VDA 7.15 LTSR CU1/7.16/7.17 with UPM Enabled.
  5. CTX489573Office 365 – Account Error: Sorry, we can’t get to your account right now says that Appdata\local\microsoft\identitycache should be synchronized.
  6. To configure Profile Management to sync Saved Passwords in Internet Explorer, add the following directories as detailed by gtess80 at Internet Explorer 11 Saved Passwords Not Retaining Between Sessions at Citrix Discussions. However, if Microsoft Credentials Roaming is enabled, then you should instead exclude these folders from roaming as detailed at CTX124948 How to Configure Citrix Profile Manager when Microsoft Credentials Roaming is Used in the Environment. 
    AppData\Local\Microsoft\Windows\Caches
AppData\Local\Microsoft\Credentials
Appdata\local\Microsoft\identitycache
Appdata\Roaming\Microsoft\Credentials
Appdata\Roaming\Microsoft\Crypto
Appdata\Roaming\Microsoft\Protect
Appdata\Roaming\Microsoft\SystemCertificates

  7. Start Menu and File Type Associations:
    1. If Windows 10 1703 or newer, see James Rankin Roaming profiles and Start Tiles (TileDataLayer) in the Windows 10 1703 Creators Update for information on the new location for Tile data. Citrix Profile Management 5.8 and newer should handle this automatically.
    2. See David Ott’s list of UPM exclusions for Windows 10. This blog post also details how to roam the Windows 10 Start Menu and prevent file share locks.
    3. To roam Start Menu and/or File Type Associations in Windows 10 or Windows Server 2016, see CTX214754 Error “An app default was reset” after signout and Logon in Citrix UPM for info on why this is difficult.
    4. Instead of roaming usrclass.dat, you can export/import HKCU\SOFTWARE\Classes\Applications as described by Christoph Kolbicz at User File Type Association Roaming on Server 2016 with Citrix User Profile Manager.
    5. Daniel Feller at Sync the Windows 10 Start Menu in VDI says that configuring SettlementPeriodBeforeAutoShutdown might improve reliability of Start Menu roaming, assuming users log out of the virtual desktop instead of rebooting the virtual desktop. On a Delivery Controller, open PowerShell, and run the following: 
      asnp citrix.*
Set-BrokerDesktopGroup -Name "NAME_OF_DESKTOP_GROUP" -SettlementPeriodBeforeAutoShutdown 00:00:15
    6. With VDA 7.15 Update 1, the icons on the Start Menu of Windows 2012 R2 and Windows 2016 are sometimes blank.

  8. Click OK twice.

Files to Synchronize

  1. Edit Files to synchronize.
  2. Enable the setting, and click Show

  3. Add the following three entries so Java settings are saved to the roaming profile: 
    AppData\LocalLow\Sun\Java\Deployment\security\exception.sites
AppData\LocalLow\Sun\Java\Deployment\security\trusted.certs
AppData\LocalLow\Sun\Java\Deployment\deployment.properties
  4. Bob Bair at Citrix Discussions recommends these additional files for Chrome: 
    AppData\Local\Google\Chrome\User Data\First Run
AppData\Local\Google\Chrome\User Data\Local State
AppData\Local\Google\Chrome\User Data\Default\Bookmarks
AppData\Local\Google\Chrome\User Data\Default\Favicons
AppData\Local\Google\Chrome\User Data\Default\History
AppData\Local\Google\Chrome\User Data\Default\Preferences
  5. Citrix’s Start Menu Roaming documentation says that Appdata\Local\Microsoft\Windows\UsrClass.dat* should be added to the list. Profile Management 1909 and newer automatically add Appdata\Local\Microsoft\Windows\UsrClass.dat* to the Files to Synchronize list.

    • You can disable the automatic inclusion of these folders by enable the setting Disable automatic configuration located under Advanced Settings.
  6. Then click OK twice to return to the Group Policy Editor.

Folders to mirror

  1. Under File System, in the Synchronization node, enable the setting Folders to mirror.
  2. Enable the setting, and click Show.

  3. Add the following: 
    AppData\Roaming\Microsoft\Windows\Cookies
AppData\Local\Microsoft\Windows\INetCookies
AppData\Local\Microsoft\Windows\WebCache
AppData\Local\TileDataLayer
AppData\Local\Microsoft\Vault
AppData\Local\Microsoft\Windows\Caches
AppData\Local\Packages
AppData\Local\Google\Chrome\User Data\Default
  4. Click OK.
  5. Profile Management 2106 and newer have a setting called Accelerate folder mirroring that stores the mirrored folders in a VHDX file instead of copying back and forth at login and logoff.

    • UPM creates a folder named MirrorFolders in the user’s UPM path and creates a couple thin-provisioned VHDX files in that path.
    • Disk Management shows that the mounted Diff disk has a 50 GB capacity limit.
    • Logging into multiple sessions concurrently results in multiple Diff disks.
    • If the file server is unavailable then unpredictable behavior occurs. After the file server is back up, the session continues to misbehave and won’t recover until users log off and log back on. Plan for file server high availability that can handle always-open VHDX files. DFS won’t help you.
    • Profile Management 2109 and newer can Automatically reattach detached VHDX disks.
  6. According to CTX213190 Configure UPM to save password in Internet Explorer, you’ll also need a User Configuration > Preferences > Windows Settings > Folders item to create the %localappdata%\Microsoft\Vault folder.

Profile Container

Profile Management 2407 and newer have new Container features, including:

  • In-session profile container failover among multiple user stores – Citrix Docs
  • Registry exclusion and inclusion support extended to container-based profile solution – Citrix Docs
  • Reset container-based profiles without the risk of losing user data – Citrix Docs
  • Collects statistical data on VHD compaction actions and provides it to Workspace Environment Management (WEM) for reporting

To configure profile container:

  1. Profile Management 1903 and newer have a Profile container setting.
    • In Profile Management 2009 and newer, the Profile container setting moved to its own node.
    • In older versions of Profile Management, Profile Container is located under File System | Synchronization.
  2. Click the Show button to specify profile paths that should be placed in the mounted file share profile disk (VHDX file) instead of copied back and forth at logon and logoff.
    • In Profile Management 2009 and newer, you can specify * to put the entire profile in the Container. Then use the other two settings to exclude folders from the Container. See Profile Container at Citrix Docs.

    • In Profile Management older than version 2009, this setting is for large cache files (e.g. Citrix Files cache) and is not intended for the entire profile.
  3. Profile Management 2103 and newer have a setting to Enable local caching for profile containers. Combine this with Profile Streaming for faster logons. The entire profile should be stored in the profile container.
  4. Profile Management 2311 and newer can Log off users when profile container is not available during logon.
  5. On the left, under Advanced Settings, Profile Management 2103 and newer have a setting to Enable multi-session write-back for profile containers. This setting applies to both UPM Profile Container and Microsoft FSLogix Profile Container. If the same user launches multiple sessions on different machines, changes made in each session are synchronized and saved to the user’s profile container disk.
  6. Profile Management 2109 and newer can Automatically reattach detached VHDX disks.
  7. Citrix recommends using Profile Container for Microsoft Teams.
  8. See CTX247569 Citrix Profile Management: Troubleshooting Profile Containers.
  9. Profile Management 2209 and newer can replicate the profile container to multiple shares. 

    • In Profile Management 2407 and newer, for the container-based profile solution, the Enable in-session policy container failover among user stores policy is automatically enabled to ensure profile redundancy for the entire session.
  10. Profile Management 2308 and newer can auto-expansion the container.

    • Advanced settings node has additional auto-expansion settings.
  11. On the CVAD 2311 and newer ISO, at \x64\ProfileManagement\Tools is a script that can migrate profiles from FSLogix to Citrix Profile Container. Prior to CVAD 2311 the Tools folder is not on the CVAD ISO but is instead included with the separately downloaded Profile Management. See Migrate user profiles at Citrix Docs.

Registry Exclusions

  1. On the left, under Profile Management, click Registry.
  2. On the right, open Enable Default Exclusion List.
  3. Enable the setting. You can use the checkboxes to control which registry keys you don’t want to exclude.
  4. According to Citrix CTX221380 Occasionally, File Type Association (FTA) Fails to Roam with Profile Management 5.7 on Windows 10 and Windows Server 2016, Software\Microsoft\Speech_OneCore should be unchecked. Click OK.
  5. The setting Exclusion List under Registry lets you exclude registry keys from the roaming profile.
  6. Nick Panaccio in the comments says that if Office with ADFS constantly prompts for login, then you should exclude the following: 
    Software\Microsoft\Office\16.0\Common\Identity
  7. Nick Panaccio at IE11 Enterprise Mode and UPM at Citrix Discussions has a list of registry exclusions for IE in Enterprise Mode. 
    Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\EmieUserList
Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\EmieSiteList
  8. Click OK when done.
  9. For the NTUSER.DAT backup setting, which is disabled by default, you can enable it to provide some resiliency against profile corruption.

Log Settings

  1. In the Log Settings node, enable the Enable logging setting. This will make it easy to troubleshoot problems with Profile Management. The logfile is located in C:\Windows\System32\LogFiles\UserProfileManager.
  2. Edit the Log settings setting.
  3. Enable the setting and check the boxes next to Logon and Logoff. Click OK.
  4. If your VDA is a Provisioning Services Target Device and/or non-persistent, consider moving the log file to the local persistent disk (e.g. D:\Logs), or to a central share. If a central share, the VDA computer accounts (e.g. Domain Computers) will need Modify permission to the log file path. To change the log file path, edit the Path to log file setting.


  5. CTX123005 Citrix UPM Log Parser
  6. CTX200674 How To: Review Profile Management Log Files using Microsoft Excel 

Profile Streaming

  1. Go to the Profile handling node under Profile Management.
  2. Profile Management 1909 and newer have a setting called Automatic migration of existing application profiles under Profile Handling that can migrate existing profiles when you upgrade the version of Windows 10. This setting requires the !CTX_OSNAME! variable in your profile store path.
  3. Enable the setting Delete locally cached profiles at logoff. Note: this might cause problems in Windows 10.

    Helge Klein has a tool to delete locally cached profiles on a session host. http://helgeklein.com/free-tools/delprof2-user-profile-deletion-tool/. This tool should only be needed if profiles are not deleting properly.
  4. For Windows 10/2016 machines, CTX216097 Unable to Delete NTUSER.DAT* Files When a User Logs off recommends setting Delay before deleting cached profiles to 40 seconds.

  5. Enable the setting Migration of existing profiles and set it to Local and Roaming.  Citrix CTX221564 UPM doesn’t migrate local user profile since version 5.4.1.

  6. Enable the setting Local profile conflict handling, and set it to Delete local profile. Note: this might cause problems on Windows 10.

  7. For fastest logons, Citrix recommends Profile streaming + Enable profile streaming for folders + Accelerate folder mirroring all enabled, or only enable Profile Container for the entire user profile. More details at CTX463658 Reduce logon time with Profile Management.
    1. Under Profile Management > Streamed user profiles is Profile streaming. Enable this setting to speed up logons.
    2. Profile Management 2103 and newer have a setting to Enable profile streaming for folders, which should speed up logons. In Profile Management 2402 and newer, profile streaming for folders is enabled by default.
    3. Profile Management 2106 and newer have a setting under File System > Synchronization called Accelerate folder mirroring that stores the mirrored folders in a VHDX file instead of copying back and forth at login and logoff.
    4. Profile Management 2206 adds Enable profile streaming for pending area. Enable this setting if users run multiple Citrix sessions concurrently and you have Active Write Back enabled.
  8. Profile Management 7.16 and newer have XenApp Optimization (aka Citrix Virtual Apps Optimization) feature, which uses Microsoft UE-V templates to define specific settings that should be saved and restored at logoff and logon. See George Spiers XenApp Optimization (new in CPM 7.16+) for details.

  9. After modifying the GPO, use Group Policy Management Console to update the VDAs.
  10. Or run gpupdate /force on the VDAs, or wait 90 minutes.

App Access Control

Profile Management 2303 and newer support app access control. This is similar to FSLogix App Masking.

Citrix WEM Cloud Service has a GUI-based Rule Generator.

  1. In Citrix Cloud, go to Workspace Environment Management. 
  2. Switch to the Utilities tab, find WEM Tool Hub, and click Download.
  3. Extract the WEM Tool Hub and run Citrix.WEM.AdminToolHub.exe.
  4. Click Rule Generator for App Access Control.
  5. Click Create app rule.
  6. Click Scan to select an app installed on the local machine.
  7. The tool scans the selected app and automatically adds rules for the app. Click Add when done.
  8. Give the app a name and click Next.
  9. Assign the rule to users, computers, or processes. Click Done.
  10. Select the app rules and click Generate raw data.
  11. Click Save to file.
  12. Use WEM or Group Policy to push the string to the VDAs. App Access Control is currently a preview feature. Enable it in Citrix Cloud > Workspace Environment Management > Manage > Web Console > Home page > Preview features.

  13. Then edit a Configuration Set. Go to Profiles > Profile Management Settings and find App access control. Browse to the .rule file saved earlier.

If you don’t have access to WEM Cloud, then the PowerShell Rule Generator is on the CVAD 2311 or newer ISO under \x64\ProfileManagement\Tools. Prior to CVAD 2311, the Tools folder is in the downloaded standalone Profile Management.

  1. The CPM_App_Access_Control_Config.ps1 PowerShell script is in the Tools folder.
  2. The Rule Generator script lists all locally installed apps and asks you choose one.
  3. The tool auto-generates some rules for the app and asks you to edit the rules or go to the next step to manage assignments.
  4. You can assign groups that can view the app. When done, press 4 to generate the rules for deployment.
  5. The script can push the rules to a GPO. Or you can press 3 to generate the string that you then must configure yourself in the GPO.
  6. The GPO setting is at Computer Configuration | Policies | Administrative Templates | Citrix Components | Profile Management | App Access Control. Enable the setting named App access control and paste the string that the Rule Generator provided. 

Also see CTP James Rankin QuickPost – Citrix UPM App Access Control

Mandatory Profile – Citrix Method

Profile Management 5.0 and newer has a mandatory profile feature. Alternatively, use the Microsoft method. Also see CTP James Rankin How to create mandatory profiles in Windows 10 Creators Update (1703).

  1. Create a file share (e.g. \\fs01\profile). Give Read permission to Users and Full Control to Administrators.
  2. Login to the VDA machine as a template account. Do any desired customizations. Logoff.
  3. Make sure you are viewing hidden files and system files.
  4.  
  5. Copy C:\Users\%username% to your fileshare. Name the folder Mandatory or something like that. Citrix Profile Management does not need .v2 or .v4 or .v6 on the end.

    1. You can copy C:\Users\Default instead of copying a template user. If so, remove the Hidden attribute. If you use Default as your mandatory, be aware that Active Setup will run every time a user logs in.
  6. Open the AppData folder and delete the Local and LocalLow folders.
  7. Java settings are stored in LocalLow so you might want to leave them in the mandatory profile. The only Java files you need are the deployment.properties file, the exception.sites file, and the security/trusted.certs file. Delete the Java cache, tmp and logs.
  8. Open regedit.exe.
  9. Click HKEY_LOCAL_MACHINE to highlight it.
  10. Open the File menu and click Load Hive.
  11. Browse to the mandatory profile and open NTUSER.DAT. Note: Citrix Profile Management does not use NTUSER.MAN and instead the file must be NTUSER.DAT.
  12. Name it a or similar.
  13. Go to HKLM\a, right-click it, and click Permissions.
  14. Add Authenticated Users and give it Full Control. Click OK.
  15. With the hive still loaded, you can do some cleanup in the registry keys. See http://www.robinhobo.com/how-to-create-a-mandatory-profile-with-folder-redirections/ and http://appsensebigot.blogspot.ru/2014/10/create-windows-mandatory-profiles-in.html?m=1 for some suggestions.
  16. Citrix CTX212784 Slow User Logon When Using Mandatory Profiles – set HKCU\a\Software\Citrix\WFSHELL\SpecialFoldersIntialized (DWORD) = 1
  17. Highlight HKLM\a.
  18. Open the File menu, and click Unload Hive.
  19. Go back to the file share and delete the NTUSER.DAT log files.
  20. Create/Edit a GPO that appplies to the VDAs. Make sure the Citrix Profile Management policy template is loaded.
  21. Go to Computer Configuration > Policies > Administrative Templates > Citrix Components > Profile Management > Profile handling. Edit the setting Template profile.
  22. Enable the setting and enter the path to the Mandatory profile.
  23. Check all three boxes. Then click OK.

Redirected Profile Folders

  1. Make sure loopback processing is enabled on your VDAs.
  2. Edit a GPO that applies to all VDA users, including Administrators.
  3. Go to User Configuration\Policies\Windows Settings\Folder Redirection. Right-click Documents, and click Properties.
  4. In the Setting drop down, select Basic.
  5. In the Target folder location drop down, select Redirect to the user’s home directory.
  6. Switch to the Settings tab.
  7. On the Settings tab, uncheck the box next to Grant the user exclusive rights. Click OK. Note: Move the contents to the new location might cause issues in some deployments.
  8. Click Yes to acknowledge this message.
  9. Right-click Desktop and click Properties.
  10. Change the Setting drop-down to Basic.
  11. Change the Target folder location to Redirect to the following location.
  12. In the Root Path box, enter %HOMESHARE%%HOMEPATH%\Desktop. It is critical that this is a UNC path and not a mapped drive. Also, since we’re using home directory variables, all users must have home directories defined in Active Directory.
  13. Switch to the Settings tab.
  14. Uncheck the box next to Grant the user exclusive rights to Desktop and click OK.
  15. Click Yes when prompted that the target is not a UNC path. You get this error because of the variable. It doesn’t affect operations.
  16. Repeat for the following folders:
    • Documents = Redirect to the User’s Home Directory
    • Desktop = %HOMESHARE%%HOMEPATH%\Desktop
    • Favorites = %HOMESHARE%%HOMEPATH%\Windows\Favorites
    • Downloads = %HOMESHARE%%HOMEPATH%\Downloads
  17. Redirect the following folders but set them to Follow the Documents folder.
    • Pictures
    • Music
    • Videos

Folders not redirected will be synchronized by Citrix Profile Management.

Verify Profile Management

  1. Once Profile Management is configured, login to a Virtual Delivery Agent and run gpupdate /force.
  2. Logoff and log back in.
  3. Go to C:\Windows\System32\LogFiles\UserProfileManager and open the pm.log file. Look in the log for logon and logoff events.

Profile Management Troubleshooting

UPM Troubleshooter

Citrix Blog Post – UPM Troubleshooter: UPM Troubleshooter is a Windows-based standalone application that examines the live User Profile Management-enabled system in a single click, gives Profile Management Configurations, information on the Citrix products installed, facility to collect and send the logs along with system utilities dashboard to analyze the issue in an effective, simplified, quick and easier manner. See the blog post for more details.

Profile Management Configuration Check Tool

UPMConfigCheck is a PowerShell script that examines a live Profile management system and determines whether it is optimally configured. UPMConfigCheck is designed to verify that Profile management has been configured optimally for the environment in which it is being run, taking into account:

  • Hypervisor Detection– The presence or absence of supported hypervisors (for example, Citrix XenServer, VMware vSphere, or Microsoft Hyper-V)
  • Provisioning Detection– The presence or absence of a supported machine-provisioning solution (for example, Machine Creation Services or Provisioning Services)
  • XenApp or XenDesktop– Whether it is running in a XenApp or a XenDesktop environment
  • User Store – Determines that the expanded Path to User Store exists.
  • WinLogon Hooking Test – Verifies that Profile management is correctly hooked into WinLogon processing. This test is for Windows Vista, Windows 7, Windows Server 2008, Windows Server 2008 R2 and requires the user running the Configuration Check Tool to have permission to access the relevant registry keys, or an error may be returned.
  • Verify Personal vDisk enabled / disabled – Whether the Personal vDisk feature of XenDesktop is enabled
  • Miscellaneous – Other factors that it is able to determine through registry or WMI queries, such as whether the computer running Profile management is a laptop

Profile Size

Sacha Thomet at Monitor you Profile directories has a script that displays the size of profiles in a profile share.

Log Parser

CTX123005 Citrix UPM Log Parser

View Log Files using Excel

CTX200674 How To: Review Profile Management Log Files using Microsoft Excel 

1,143 thoughts on “Citrix Profile Management 2407”

  1. Hi Carl,

    thanks for this blog. Got loads of information so far.

    Still I’m struggling with UPM on some deployments where folders are not created as configured within policies and UPM logging doesn’t work properly.

    You configured settings in ADMX-Policies rather than in the Citrix Policies GUI of the GPO-Editor (not Delivery Controller GUI). What is the diffenrence here an which way is best to go? What happens if there are conflicts?

    You suggest to use Windows method of folder redirection rather than citrix method. To what benefit?

    Thanks for any answer and help.

    Cheers, Stefan

    Reply

    1. GPOs can apply to multiple farms.

      Microsoft Folder Redirection is supported by Citrix and Microsoft. Citrix Folder Redirection is only supported by Citrix. Citrix Folder Redirection does not have any functionality that I can’t do with Microsoft Folder Redirection.

      Reply

      1. Hi Carl,

        thanks for really quick response.
        Got the point with applying to multiple farms but that should even work both ways
        ->GPO->Computer Configuration->Policies->Citrix Policies->Policies (with Citrix GUI)
        or
        ->GPO->Computer Configuration->Administrative Templates->Citrix Components->Profile Management

        I’m not talking about using Delivery Controller Policy-GUI to configure UPM.

        Am I right here? If yes, where is the difference or what is best to go? Especially if updating UPM Version.

        About redirection well ok, if it should work in mixed environments MS folder redirection might be the recommended method.
        Trouble is I’ve configured citrix folder redirection but ist does not work and UPM Check tool says there is no redirection configured at all. And UMP log is not updated too. Strange situation.

        thanks, Stefan

        Reply

        1. OK. I find GPO ADMX templates to have fewer moving parts, so easier to troubleshoot. I can’t think of anything in Citrix Policies that can’t be done using ADMX instead.

          Reply

    2. I am wondering if anybody got template profiles to work with XD7.11. I have created a mandatory profile the “Citrix way”. However I still get errors, which prevent the profile from getting created.
      Here are some of the errors that I get in the UPM log file:

      2017-02-27;16:14:44.330;INFORMATION;CORPNET;WisMatthC;3;4056;CRegistryHive::ResetSecurity: Starting to reset security on registry hive …
      2017-02-27;16:14:45.033;ERROR;CORPNET;WisMatthC;3;4056;AddACEs: The call to SetNamedSecurityInfo for file/dir failed with: The system cannot find the file specified.
      2017-02-27;16:14:45.033;ERROR;CORPNET;WisMatthC;3;4056;CRegistryHive::ResetSecurity: Failed to reset security on registry hive .
      2017-02-27;16:14:45.033;ERROR;CORPNET;WisMatthC;3;4056;CreateLocalProfileFromTemplate: Could not create a local profile from a template: The system cannot find the file specified.
      2017-02-27;16:14:45.049;INFORMATION;CORPNET;WisMatthC;3;4056;CRegistryHive::Unload: Unloaded registry hive .
      2017-02-27;16:14:45.049;ERROR;CORPNET;WisMatthC;3;4056;ProcessLogon: Failed to set up local mandatory profile from template.

      Anybody ran into this? If so, were you able to fix it?

      Reply

        1. On the Mandatory profile, the item that I missed is on the permissions when the hive is loaded. I needed to go to advanced to ensure that the permissions you replace all child objects for the authenticated user permission.

          Carl, you are the best. I start all my Citrix google questions with Citrix Carl. Thanks so much!

          Reply

  2. Hi Carl

    I have tried the fix CTX214754 , i am on xendesktop 7.12, and upm 5.6 however no matter what my pooled desktop do not want to roam users fta settings, it just reset to edge as the default browser each time!! Any ideas?

    Reply

  3. Hi Carl,

    In my Citirx XenDesktop 7.6 environment I m using CPM with folder redirection policy..
    The problems is day to day users profiles increasing facing slow logon issues and we don’t have control on that.
    Requesting you to suggest how I can limit users profile and what are the best practices we need to follow to avoid such kind of issue.

    Reply

    1. Are the profiles getting bigger? If so, what folders in the profiles are increasing?

      Profile Streaming is enabled?

      Troubleshooting long Logon times can be a long, difficult process. Director has some logon time breakdown. Commercial monitoring products (e.g. Goliath) will break down the logon time to much greater detail so you can find the culprit. You can also run procmon during a user logon to watch the processes.

      What OS for the VDA?

      I’ve seen many different causes of long logon times. I have some Citrix-specific causes at https://www.carlstalhood.com/virtual-delivery-agent-vda-7-12/#logondelay

      Reply

      1. Hi Carl,

        Thanks for reply.

        Below mentioned folders are getting bigger in users profiles folder.

        AppData\Local\Thunderbird\Profiles
        AppData\Roaming\Kingsoft\office6\backup
        AppData\Local\Microsoft\Windows\WER

        I m using Win 2008 R2 HSDs in my environment. If i deleted files form above folders then there is no logon delay while login users into Citrix. sounds like good, when I excluded above directory from UPM policy.

        Thanks & Regards,
        Ilyas Ahmed

        Reply

  4. Hi Carl,

    I run in to a Problem with Visio as published application when I exclude AppData\Local\Microsoft\Windows\INetCache in UPM. I can start Visio but when I want to create or open a file Visio crash. In Desktop mode in don’t have this problem. I figured out that Visio need the folder INetCache otherwise it will crash.

    Reply

    2. Had the same issue, another solution is open the template profile and navigate to HKCU\Software\Microsoft\Windows\Current Version\Explorer\User Shell Folders then set the Cache key to C:\temp or similar

      Reply

  5. Hi Carl,

    I have XenApp 7.12 VDAs with UPM 5.6 installed on Windows Server 2016. My question is will UPM delete locally cached profiles if you DO NOT specify a profile store? We are using Immidio Flex for UEM and would like to leverage the disk clean up that is available in UPM. I’ve enabled UPM logging through GPO and I get the following message when a user logs off.

    2017-02-08;18:48:03.823;INFORMATION;ASE;;9;2204;ProcessLogoff: Local profile is not a UPM profile. Aborting.

    Thanks,

    Jason

    Reply

    1. I think it only deletes roaming profiles.

      For Flex, I would do a mandatory profile, since that gets deleted on log off. I think my VMware UEM guide explains it.

      Reply

  6. Hello Carl,

    Hope you are doing well.

    Does Profile Management Version 5.5 works well with Xenapp 6.5? If yes what will be variable for the user profile store? I have configured to use \\fileserver\fileshare\%username% but everytime i login it comes up with a temporary user profile message.

    Thanks,
    Pavan

    Reply

    1. Are the share permissions (share and NTFS) configured correctly? What error are you seeing in the UPM log?

      Reply

  7. Hi Carl,

    I am using UPM 5.6 and one of the server is not creating roaming profile and getting this error:

    GetFileAttributesAPIWrapper: GetFileAttributes of failed with: The system cannot find the file specified.
    GetFileAttributesAPIWrapper: GetFileAttributes of failed with: The system cannot find GetFileAttributes of

    <C:GetFileAttributesAPIWrapper: GetFileAttributes of failed with: The system cannot find the path

    specified.
    GetFileAttributesAPIWrapper: GetFileAttributes of failed with: The system cannot find the path specified.

    Is the default profile corrupted?

    Reply

  8. Hi Carl. I’m deploying Windows 10 in XenDesktop for the first time. (I’ve done Win7 many times) I’m reading about all the issues with the new start menu and roaming profiles. I’ve set my UPM policy to the recommended settings but I’m wondering if I could just avoid the issue by redirecting Start Menu. I know some people don’t like to redirect the Start Menu but I’ve had good luck with it in Win7 deployments. Could this work around the problems with roaming profiles? Your write up is terrific as are the others you linked in but none of them mention the possibility of folder redirection as a solution.

    Reply

  9. Hey Carl, when configuring UPM with GPO, as you’ve advised, copy the exclusions from the .ini file into the GPO. Other guidance else where has suggested to rename the .ini after doing this to avoid conflicts between the GPO and the .ini file.

    Thoughts?

    Reply

  10. Hello Carl, great document as usual. You might consider that if using folder redirection to exclude the redirected folders in the “Exclusions List – directories” so you don’t end up with duplicate empty folders. This can confuse admins and users depending on how the home drive mapping is done (call it OCD..;). If you redirect all folders (I don’t redirect downloads generally) it will keep the profile size at around 80-100 MBs:

    Additional List:
    AppData
    Contacts
    Documents
    Favorites
    Links
    Music
    Pictures
    Saved Games
    Videos
    Local Settings
    Downloads
    Desktop

    Reply

    1. UPM is supposed to detect folder redirection and exclude these automatically. At least that was fixed in version 3, I think. You’re not seeing that? Of course, if you enable redirection after you’ve already been roaming, then it won’t delete the existing roamed files.

      Reply

      1. Hi Carl, I’ll test it again. This is the first time deploying 5.5. I’m doing a new deployment, so this will be green space. Thanks!

        Reply

  11. Quick clarification question:

    Are the two below locations the same as it relates to the location of user’s local app data path?

    AppData\Local
    !ctx_localappdata!

    Reply

  13. Hi Carl, and Happy New Year!!!

    Please tell me to which folder are the user certificates redirected? I mean for example user has a cert in IE. Where is it redirected at logoff? Profile Mgmt is configured with Citrix UPM THX!

    Reply

      1. Hi Carl, Great post and has greatly helped. I have an issue here; Do you have any idea why when a user launch a Dedicated Virtual Desktop and Apps their Favorites are loaded without issues. But when they launch the pool desktops, Their profile are not recreated when refreshed even though it launches. Doesnt load the user settings and Favorites. Any help will be greatly appreciated… Thanks

        Reply

          2. If you did not change the path, then logs are at C:\Windows\System32\LogFiles\User Profile Manager

          3. Four (4) Text Files with the names
            Domain#MAchineName_pm
            Domain#MAchineName_pm_config
            Domain#VDAImageMachineName_pm
            Domain#VDAImageMachineName_pm_config

      2. Hi Carl,
        hope you are doing well.
        This is regarding profile redirection, in my environment i have apply folder redirection policy on users level, my question is instead of users level can we apply folder redirection policy on computer level.

        Thanks & Regards,
        Ilyas Ahmed

        Reply

        1. That’s kind of the point of enabling Group Policy Loopback Processing Mode. You enable this on a computer. Then all users that log into the computer get the computer’s user settings.

          Reply

  14. Hi Carl
    can we use profile management 5.6 with xd 7.12 installed on server 2008R2 and vda on windows 7.
    thanks in advance….

    Reply

  15. Hello,

    I have this message in the action center when UPM is enable : an default app was reset
    this for .pdf, html, jpeg…
    Default app are photos and internet explorer.

    Do you have any recommandation on this ?

    Thank you in advance.

    Reply

    1. Are you roaming usrclass.dat files? I think they should be excluded.

      Otherwise, there’s a known issue with roaming user-select file type associations. Call Support and they might have a private fix.

      Reply

  16. hi Carl,
    I have a problem with the outlook profile.
    Each time a user makes a new login the mailbox will be downloaded as the first time (i use exchange).do you konw how to set up the policy?
    thanks
    Michele

    Reply

    1. You mean user has to setup the Outlook profile again? If so, that suggests roaming profiles aren’t working. Check your UPM logs in c:\windows\system32\logfiles\user profile manager.

      Or are you saying that Outlook Cached Mode has to re-download on every login? Are you excluding the .ost from roaming? If on-premises Exchange, you usually disable Outlook Cached Mode. If hosted Exchange, give the user a persistent desktop, or look into FSLogix to manage the .ost file.

      Reply

  17. Hello Carl,

    Have a question for you.

    I have used TS Profiles on XenApp, and UPM on Xendesktop. I never really comparef the two in a load phase.
    Load phase meaning who is better ect.
    I was curious if Citrix offers which one is better over the other for XenApp?

    Have you had any experience with this?

    Reply

  18. Carl, do you know if you can install the latest version of UPM if we have 7.6.3 vda’s installed on xenapp/xendesktop machines?

    Reply

    1. UPM is not LTSR compliant but is LTSR compatible. Support might ask you to duplicate an issue on the latest version of UPM.

      Reply

      1. Hi Carl,

        In upgrading UPM 5.4 to 5.6. It is safe to change the adm template now then may upgrade the msi later as in a couple weeks or may months?

        Citrix says that we have to create a new policy then reapplying the previous setting to new gpo. will it still be working without creating new policy and reapplying means recreate on the new policy?

        Do I have to create a new shared drive for new profile and will the old shared drive and porfile work?

        Thanks,

        Reply

        1. .admx files contain potential settings, not the actual settings. Updating .admx files should not change the actual settings. So it’s not needed to create a new GPO.

          A simple in-place upgrade will work. There’s no need to recreate all profiles.

          Reply

          1. Do I have to add the template in the GPO immediately or as long as I am not changing anything its ok to not yet add the template and remove the old template in gpo editor?

          2. You only need the template if you want to change settings, or view them. They work without the template.

    2. Hi Carl,

      I upgrade UPM 5.4 to 5.6 after the reboot I got this error. “The Citrix Profile Management driver could not be loaded. Processing can not continue. The user will be given a temporary profile. Cause: The Citrix Profile Management Service on this computer could not connect to the driver while processing a user logon. Action: Restart the machine. If the problem persists, uninstall and reinstall Citrix Profile management.”

      and getting temp profile. what causes this to happen?

      Reply

  22. Carl,

    Is there a reason why “Favorites” is redirected to “%HOMESHARE%%HOMEPATH%\Windows\Favorites” instead of “%HOMESHARE%%HOMEPATH%\Favorites”?

    Reply

  23. Carl, thanks for this information, very well written. Just one question. We are implementing XenApp 7.11 with Windows Server 2016. Everything seems to be working ok, except for the default apps. We let our users chose their default browser, but this isn’t remembered. I have tried all sort of inclusions in UPM, but nothing seems to work. Do you know what to enable to remember this?

    Reply

  24. Hi,

    I have Citrix XenDesktop 7.11, UPM 5.5, Windows 10 LTSB 1607. I Followed your Tips, but profiles are not saved correctly.

    Your settings have been set by the citrix policy.

    I logon on RPD, the profile good work, in my folder profile it creates UPMSettings.ini
    I logon on Citrix Storefront (Netscaler), the profile not work, in my folder profile it not creates UPMSettings.ini

    Can you help me?

    Best Regards

    Reply

  25. Hi Carl,

    How do you deal with Profile Manger ripping out a lot memory as much as 5GB, also I seem to be getting ESENT errors and I have followed your procedure to create the right permissions on the folder share. Do you also have a procedure to upgrade UPM 5.2.0 to 5.2.1?

    Reply

  28. hi Carl,
    what’s the difference of mechanism between “Folders to mirror” and “Directories to synchronizes” ?

    thanks

    Reply

  30. Hi Carl,

    Daft question coming up.

    I am upgrading from 7.6 to 7.11 over the weekend.

    As I am preparing for the upgrade for the UPM part I read the notes that say the following:-

    Install the Profile management .msi file on each computer whose user profiles you want to manage.

    is that right? I just don’t recall ever installing this on my gold XenApp 7.6 server image and its been working fine.

    I did note a previous comment which says the 7.11 VDA now automatically bundles UPM 5.5.

    If I upgrade my VDA component, will it still automatically install the UPM 5.5 part or do I need to install this separately.

    Reply

  31. The UPM Cleanup tool that is posted seems to only work on 2008R2. Is there an updated or alternate version that will work to clean up profiles on 2012R2?

    Reply

  32. Hi Carl,
    AppData\Local is not in the exclusion list and causing profile bloats, is there a reason it’s not excluded?
    Shouldn’t Local application data (i.e. non-roaming); be excluded by default?

    Reply

    1. It used to be in older versions, but then it wasn’t capturing useful files. Citrix defaults to “capture everything”, and then you specify what you don’t want. In theory, this is a “set and forget” methodology.

      Reply

  33. Yes, we already tried this:

    HKEY_LOCAL_MACHINE\Software\Citrix\Logon\DisableStatus=1
    HKEY_LOCAL_MACHINE\Software\Wow6432Node\Citrix\Logon\DisableStatus=1
    HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs=mfaphook64.dll
    HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs=mfaphook.dll

    ….and in addition opened a ticket with Citrix & Microsoft who both were not able to help us.
    Therefor we want to stick with our 70-80 seconds logon time and bring the first sign-in animation during each logon while using Citrix UPM.

    Reply

  34. Hi Carl,

    this might sound stupid, but is there a possibility with active Citrix UPM to always show the first sign-in animation?
    We have set the GPO accordingly (Show first sign-animation to Enabled) but once the user profile has been created this screen does not appear any longer and the black screen comes again.

    This seems to be the only way to hide the black screen completely for all users on Windows 10 (1607) using XenDesktop 7.9 with Provisioning Services 7.9.

    What I have already tried to hide the black screen can be found here :
    https://discussions.citrix.com/topic/342198-xendesktop-7-interactive-session-slows-logon/page-4

    We really would like to use the first sign-in animation as this will show at least some prgress to the end user.

    Regards,
    Stefan

    Reply

      1. Here are the keys in case anyone also always wants to show the animation:

        ‘# HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
        ‘# FirstLogon = 1 (Default = 0)
        ‘# HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
        ‘# UserSignedIn = 0 (Default = 1)

        Reply

  35. Hi Carl,
    after some research I think its not possible to mix the “Enable Default Exclusion List – directories” and “Exclusion list – directories”. When I activate both options only the custom exclusion list for example “AppData\Local\Microsoft\Windows\INetCache” is being excluded.
    Can you verify this? I checked it with the UpmConfigCheck script.

    Cheers
    Mokki

    Reply

  36. Hi Carl,
    does UPM automatically install together with VDA installation, or do I have to install separately?
    Which UPM version does come with which VDA version?

    BTW: Great website!

    Best regards,
    Volker

    Reply

    1. Yes, it comes with VDA. 7.11 comes with 5.5. The various versions of 7.6 come with different UPM versions.

      Reply

        1. I don’t think so.

          You can install an UPM version you want. You can use command line to exclude UPM from the VDA install. Or simply upgrade it after installation.

          If you look in the ISO, x64\ProfileManagement\ADM_Templates\en might show you the included version.

          Reply

  37. Hello Carl, your website it’s fantastic!
    I have a question about combine “Citrix UPM 5.5” with “User Roaming Profile” and “Folder Redirection”.
    I am working in a new environment with XenApp solution with W2k12R2 and Citrix 7.9, my client has an older Citrix farm with PS 4.5 and “Microsoft active directory” with “TS Roaming User Profile” and “TS User Home Directory” put in a network share and mapping C: drive letter.
    Can I have the new deployment with “Citrix UPM” and “Microsoft GPOs” but without lose the unit C:, or maybe can I get only with “Citrix UPM” keep C: like my home folder in my roaming user profile?

    Thanks in advanced and sorry for my bad English.
    Nacho.

    Reply

    1. Are you asking how to install Citrix and Windows to a drive other than C: so you can map your home directory to C:?

      UPM stores locally cached profiles on whatever drive Windows is installed. Home directories are completely different. When you logoff, UPM copies the profile to a new share, which is not your home directory.

      Folder Redirection can point to your home directory (UNC path), but not a drive letter. This is a Microsoft restriction.

      Reply

      1. Ok Thank you Carl, so Can I use “Citrix UPM” to store locally cached profiles on network share? and “GPOs” to put the home directory in other network share?, It’s possible?
        Thanks

        Reply

  39. Carl,

    Currently we have mixed environment XenApp 6.5 with UPM 4.0 and XenApp 7.8 with UPM 5.4. We will be decomissioning the XenApp 6.5 shortly. We have been facing issues with the users settings not getting saved. I found that we have folder redirection policy for the XenApp 7.8 for the App Data (Roaming) but the path is the XenApp 6.5 profile store and not the new one. Do we need this setting if we have the Profile management configured. Could you please suggest how do we resolve this,do we need to change the path to the new store or remove this policy.

    Reply

    1. I normally do not redirect AppData. If you need to keep the data, then you might have to write a script to move the files to the new location (e.g. UPM profile) and then reconfigure it after moving the files.

      Reply

  40. Hi Carl,

    Love the website!

    Just had a quick question, if using the Citrix Studio – Policies node method instead of Microsoft Group Policy (due to access limitations), would you still need to copy the admx files anywhere?

    Reply

  41. Hi Carl,

    Is there a reason you have not set the AppData folder to redirect under Folder Redirections GPO. I thought you would you use folder directions policy in conjunction with UPM exclusions to speed up logon performance.

    Thanks

    Reply

  42. Hey Carl, I was looking through your Citrix Profile Management document and on the section about setting up the file share I wanted to comment about your instructions. While for a test lab you can probably get away with Everyone I wouldn’t suggest using that in any environment with PCI data. Audit firms have been hitting on organizations for using the Everyone group and in some cases even domain users group. They prefer a specific group be created just to grant access.

    Reply

    1. Everyone is the default permission created by Windows. You’re welcome to change it to anything. I usually do Authenticated Users, or a Citrix Users group.

      Reply

  43. Hi Carl,

    We have two Profile Servers with DFS-R is re-enabled between them.

    \\ctxprofile01\~userdata\%username%
    \\ctxprofile02\~userdata\%username%

    The UPM is stored in \\ctxprofile01\~profiles\UPM and \\ctxprofile02\~profiles\UPM

    This is how the consultant set it up.

    Originally had exclusive rights and move content ticked then we have followed your folder redirection method to only Move Content but still getting an issue when into the other delivery group for Disaster Recovery using the secondary profile server, everything stays except Favorites which gets deleted from the Primary Site Profile Server which replicates to the other one. I noticed only difference between ours and yours is that we have create a root folder instead of ‘Redirect to the following location’. I keep scratching my head and cannot find a resolution to this. Both Group Policies are set for both Profile Servers using loopback.

    Should we just do a nightly robocopy between \\ctxprofile1\ to \\ctxprofile02\ as you mentioned dfs-r is not supported?

    Reply

        1. I suspect that “move contents” is wiping the folder. Not sure. Test with it on and off.

          You can configure Folder Redirection so it only applies to Citrix users by using Loopback processing.

          Reply

      2. Hi Carl, will this need to be done from the primary profile server gpo or the secondary?

        Also we have some windows users who use citrix sometimes so if i untick move contents will that not impact the folder redirection even though we have migrate existing profiles ticked in upm?

        Reply

  44. Hi Carl,

    Just want to say, YOU ARE THE MAN. You are my go to for anything Citrix.

    Anyway, quick question. Can i run UPM 5.5 with XenApp 7.9? I am doing so, but getting a black screen once logon is processed for around 5 seconds before the desktop is displayed. 2012R2.

    Thanks,

    Mat

    Reply

    1. UPM 5.5 should work fine.

      5 seconds is not excessive. Did you DisableStatus?

      If you want to troubleshoot, use procmon or similar to see what’s happening during those 5 seconds.

      Reply

    2. Hi Mathew, I am having the same black window (full screen) for about 5 seconds. This is fine when launching published desktop but annoying when using published apps. It is happening with 2016 only, 2012R2 is fine (all servers are in the same OU, so the same set of GPOs) UPM 5.5, XA 7.11.

      If I add this to the registry:
      https://support.citrix.com/article/CTX135782
      [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\Logon]
      “DisableStatus”=dword:00000001
      This black screen is replaced with windows logon screen (full screen as well), which is not a workaround for me.

      Have you found anything about this?
      Looks like a bug.

      Reply

  45. Hi Carl, In our environment firefox blocking the outdated Adobe flash player and Java. Each and everytime user has to click Allow and remember option to enable it. However it is working just for that session.

    Upon next logon, it does not remember and asking the same options again. Is there anything which I need to specifically include in Profile management policy to retain this settings ?

    please let me know your suggestions

    Reply

    1. Does it work on a PC? Does it work when you close the browser and reopen it without logging off? I suspect the browser will ask you every time you open it unless there’s an option to remember your answer.

      Reply

  46. Hi Carl,

    I am having a weird issue I thought I might run by you. I am using Profile Management in XenApp 7.6. I have the GPO set to pull profiles from a network share using the Absolute path or path relative to the home directory: setting.

    What I am seeing for some users, their profile location that is set in Active Directory is being pulled into Citrix. This is causing slow login times and login failures because those profiles are so large. The Citrix GPO is a loopback policy so only the setting in that GPO should be applying to Citrix. I just need help figuring out why this is happening. I do have logging enabled for UPM, just not sure what to look for.

    Any help is appreciated.

    Reply

    1. Is profile migration enabled? It’s enabled by default.

      Is UPM Service enabled? It’s not enabled by default.

      Reply

  47. Do you have any recommendations for setting up profiles so that my user’s have a seamless experience whether they log into a local machine for a virtual desktop? I want the profiles to be the same no matter where they log in. However, with the profile path changing all the time with new version of OS and UPM this seems unmanageable. Thoughts?

    Reply

    1. Try a UEM product that has profile capabilities. Microsoft UE-V. AppSense. RES. Etc. Each of them save settings on a per-app basis and work across OS versions.

      Reply

  48. Hi Carl

    I’ve just spent quite a long time trying to work out why I couldn’t see the 5.5.0 ADMX settings under Citrix Components only to finally realise that I don’t have a Citrix Components subheading in my GPOs it is straight off the root i.e. Computer Configuration\Policies\Administrative Templates\Profile Management. You show something different in your graphic and your instructions also say:

    Go to Computer Configuration\Policies\Administrative Templates\Citrix Components\Profile Management. If older than 5.5, the settings are beneath the Citrix folder.

    My ADMX/ADML set for ctxprofile5.5.0 are dated 01/08/16 and came from the “Components that are on the product ISO but also packaged separately.” link as you suggested, the .zip file is dated the same as your graphic shows so not sure why there is a discrepancy. Will teach me to look a bit harder next time as I’ve just spent 1.5 hrs troubleshooting AD as I had presumed there was a replication problem or something!

    Thanks for the website though, it is a great resource.

    Ollie

    Reply

    1. There’s a CitrixBase.admx file that also needs to be copied. Is that in your 5.5 folder? I thought I included that in my instructions.

      Reply

  49. Carl,

    I have a mixed environment. I have the old Xenapp 6.5 that is Production and Xenapp 7.8 that has been tested and will be turned into Prod. So, I have the old ctxprofile4.1.1..admx file still there in PolicyDefinitions. I am not sure if I can delete that because that is being used by the old environment. What do you suggest we do with mixed environments?

    Regards,
    Satish.

    Reply

    1. Deleting an .adm doesn’t remove the settings. It only removes your ability to configure the settings. The newer .adm template includes all of the 4.1 settings.

      Reply

      1. Thanks Carl. That is indeed true. One more question, when we installed 7.8, the version of profile management was 5.4 and so the policies are 5.4. Can I install PM 5.5 even if I keep the Xenapp version at 7.8?

        Reply

Leave a Reply

Your email address will not be published. Required fields are marked *