VMware User Environment Manager 9.8

Last Modified: Jul 26, 2019 @ 7:48 am

99 Comments

Navigation

This post applies to all User Environment Manager versions including: 9.4.1 (ESB), and 9.8.

💡 = Recently Updated

Change Log

Upgrade

If you are performing a new installation, skip to the Installation Prerequisites section.

When upgrading an existing installation of User Environment Manager, upgrade the FlexEngine on the Horizon Agents first.

From UEM Upgrade 8.7 to 9.2.1 at VMware Communities: The newest FlexEngine (v9.2.1) can still interpret the INI files from v8.7. After your clients (FlexEngine) have been upgraded, you can upgrade the management console, which allow for new options, like elevated privileges and others, which (when enabled) can now be correctly interpreted by the upgraded clients (FlexEngine). After that update the ADMX files.

Installation Prerequisites

Before performing the procedures detailed on this page, make sure you’ve imported the UEM GPO ADMX templates, created the GPOs for Horizon, and configured the Horizon GPOs for User Environment Manager.

VMware Tech Paper Antivirus Considerations for VMware Horizon 7: exclusions for Horizon View, App Volumes, User Environment Manager, ThinApp

VMware Workspace Tech Zone has an excellent Quick-Start Tutorial for User Environment Manager. It’s around 130 printed pages.

Mandatory Profile

Mandatory Profile Creation instructions:

If you want to use User Environment Manager with a Mandatory Profile then follow these basic instructions to create the mandatory profile.

Note: these instructions no longer work in Windows 10 1703. See James Rankin How to create mandatory profiles in Windows 10 Creators Update (1703) for updated instructions.

  1. The mandatory profile is stored in a sub-folder of a file share. Either identify an existing file share (e.g. UEMConfig) or create a new file share.
  2. Login to the Horizon 6 Agent machine as a template account. Do any desired customizations. Logoff.
  3. Make sure you are viewing hidden files and system files.
  4. Copy C:\Users\%username% to your fileshare and rename the folder to mandatory.v2 or something similar. It is important that .v2 (or .v3 or .v4 or .v5 or .v6 depending on the operating system version) is on the end of the path. (e.g. \\fs01\UEMConfig\mandatory.v6).
  5. Note: the mandatory profile must be a subfolder of the file share. You cannot share the mandatory profile directly.
  6. You can copy C:\Users\Default instead of copying a template user. If so, remove the hidden attribute. If you use Default as your mandatory, be aware that Active Setup will run every time a user logs in.
  7. Rename \\fs01\UEMConfig\mandatory.v6\ntuser.dat to ntuser.man.
  8. Delete the NTUSER.DAT log files.
  9. Open the AppData folder and delete the Local and LocalLow folders.
  10. Java settings are stored in LocalLow so you might want to leave them in the mandatory profile. The only Java files you need are the deployment.properties file, the exception.sites file and the security/trusted.certs file. Delete the Java cache, tmp and logs.
  11. Open regedit.exe.
  12. Click HKEY_LOCAL_MACHINE to highlight it.
  13. Open the File menu and click Load Hive.
  14. Browse to the mandatory profile and open NTUSER.MAN in the Mandatory profile folder.
  15. Name it a or similar.
  16. Go to HKLM\a, right-click it and click Permissions.
  17. Add Authenticated Users and give it Full Control. Click OK.
  18. With the hive still loaded, you can do some cleanup in the registry keys. See http://www.robinhobo.com/how-to-create-a-mandatory-profile-with-folder-redirections/ for some suggestions.
  19. Also see How to create a Windows Server 2012 / Windows 8 Mandatory Profile for more profile cleanup.
  20. Highlight HKLM\a.
  21. Open the File menu and click Unload Hive.
  22. Create/Edit a GPO that applies to the Horizon 6 Agents and configure the following GPO settings:
    • Computer Configuration | Policies | Administrative Templates | System | User Profiles
      • Do not check for user ownership of Roaming Profile Folders = enabled
      • Set roaming profile path for all users logging onto this computer = \\fs01\UEMConfig\mandatory (Do not include the .v6 in this path)
    • Computer Configuration | Policies | Administrative Templates | Windows Components | Remote Desktop Services | Remote Desktop Session Host | Profiles
      • Use mandatory profiles on the RD Session Host server = enabled
      • Set path for Remote Desktop Services Roaming User Profile = \\fs01\UEMConfig\mandatory (Do not include the .v6 in this path)

UEM Console Installation

  1. Download User Environment Manager 9.8.0 or User Environment Manager 9.4.1 (ESB).

  2. Run the downloaded VMware User Environment Manager 9.8 x64.msi or VMware User Environment Manager 9.4.1 x64.msi (ESB).

  3. In the Welcome to the VMware User Environment Manager Setup Wizard page, click Next.
  4. In the End-User License Agreement page, check the box next to I accept the terms and click Next.
  5. In the Destination Folder page, click Next.
  6. In the Choose Setup Type page, click Custom.
  7. In the Custom Setup page, change the selections so that only the console is selected, and click Next.
  8. In the Ready to install VMware User Environment Manager page, click Install.
  9. In the Completed the VMware User Environment Manager Setup Wizard page, click Finish.

Configure User Environment Manager

Here is a summary of the major User Environment Manager functionality:

  • Personalization (aka import/export user settings) – saves application and Windows settings to a file share. This is the roaming profiles functionality of User Environment Manager. You configure folders and registry keys that need to be saved. The import/export can happen at logon/logoff or during application launch/exit.
    • Pre-configure application settings – configures files and registry keys for specific applications so users don’t have to do it themselves. Some examples: disable splash screen, default folder save location, database server name, etc.
    • Self–support tool – users can use this tool to restore their application settings.
  • User Environment – configures Windows settings like drive mappings, Explorer settings, printer mappings, etc. This is similar to group policy but offers significantly more options for conditional filtering. User Environment Manager can configure any registry setting defined in an ADMX file.
    • User Environment Manager only supports user settings. Computer settings should be configured using group policy.
    • Best practice is to not mix User Environment Manager and user group policy. Pick one tool. If the same setting is configured in both locations then group policy will win.
    • UEM 9.6 adds Windows Server 2019 as an Operating System condition.
  • Horizon Smart Policies – Use Horizon Conditions (e.g. client IP) to control device mappings (e.g. client printing) and PCoIP/Blast Bandwidth Profile.
  • Privilege Elevation (UEM 9.2 and newer)  – allow apps to run as administrator even though user is not an administrator. Installers can also be elevated.

Links:

To perform an initial configuration of User Environment Manager, do the following:

  1. Launch the User Environment Manager Management Console from the Start Menu.
  2. Enter the path to the UEMConfig share, and click OK.
  3. These Settings checkboxes define what is displayed in the management console. Leave it set to the defaults, and click OK.
  4. In the Personalization ribbon, on the far right, click Easy Start.
  5. Select your version of Office, and click OK.
  6. Click OK when prompted that configuration items have been successfully installed.
  7. Review the pre-configured settings to make sure they are acceptable. For example, User Environment Manager might create a Wordpad shortcut (User Environment > Shortcuts) that says (created by VMware UEM).
  8. To roam the Start Menu in Windows 10 1703, see VMware 2150422 How to roam Windows 10 Start Menu layout.
    1. Go to Personalization, click a folder, click Create Config File, select Create a custom config file, and give it a name.
    2. On the Import/Export tab, paste these two lines: 
      [IncludeRegistryTrees]
HKCU\Software\Microsoft\Windows\CurrentVersion\CloudStore
    3. Save the UEM Config file.
  9. Go to User Environment > Policy Settings. If there is a setting to Remove Common Program Groups, then click Edit.

    1. Consider adding a condition so it doesn’t apply to administrators.
  10. You can run Triggered Tasks when a session is reconnected, or workstation is unlocked. This is useful for re-evaluating Smart Policies, as detailed below.

    • UEM 9.4 adds a new Trigger for All AppStacks Attached.
  11. UEM 9.3 adds a setting to store Outlook OST file on App Volumes writable volume. Go to User Environment tab. Right-click App Volumes and create a setting. Check the box next to Store Offline Outlook Data File (.ost) on writable volume. Configure other fields as desired. Note: this setting only applies to new Outlook profiles. More info in the YouTube video VMware User Environment Manager Outlook OST on App Volumes User Writable Volume Feature Walkthrough.

Links:

Horizon Smart Policies

  1. In UEM 9.0 and newer, go to User Environment > Horizon Smart Policies, and create a policy.
  2. UEM 9.8 adds several new Smart Policy Settings, including Drag and drop. See VMware User Environment Management 9.8 Feature Walk-Through at YouTube. 💡
  3. On the Conditions tab, you can use any of the available conditions, including the Horizon Client Property conditions. Note: UEM 9.2 has more conditions (e.g. Active Directory Site Name) than prior versions.

  4. You can also enter a Horizon Client Property condition that corresponds to the ViewClient_ registry keys. In the Property field, type in a property name (remove ViewClient_ from the property name). See VMware Blog Post Enhancing Your VMware Horizon 7 Implementation with Smart Policies. And the 28-page PDF Reviewer’s Guide for View in Horizon 7: Smart Policies, VMware Horizon 7.

  5. UEM 9.1 and newer has Endpoint Platform as a policy condition. Create a Policy, go to the Conditions tab, and select the Endpoint Platform condition. UEM 9.8 adds Chrome to the Platform list.
  6. UEM 9.8 adds Matches Regex to some of the conditions (e.g. Endpoint name and Horizon Client Property > Pool name).

  7. To reapply Horizon Policies when users reconnect to an existing session, go to User Environment > Triggered Tasks, and click Create. Or you can edit one of the existing Triggered Tasks settings.
  8. Change the Trigger to Session Reconnected.
  9. Change the Action to User Environment refresh. Select Horizon Smart Policies, and click Save.

Application Blocking and Privilege Elevation

  1. UEM 9.0 adds an Application Blocking feature. To enable it, go to User Environment > Application Blocking, and click the Global Configuration button.
  2. Check the box to Enable Application Blocking. Specify Conditions where, if true, then App Blocking is enabled. These are the same conditions available in other policies and settings. Click OK.
  3. Then you can create an Application Blocking setting to designate the folders that users can run executables from, or what file hashes are allowed.
  4. You can add folders that allow or block apps. Any executable in these paths will be allowed or blocked. By default, executables in Windows and Program Files (including x86) are allowed.
  5. UEM 9.1 and newer allows File Hashes in addition to File Paths. Set the Type to Hash-based, click Add, browse to an executable, UEM will compute the hash, and add it to the list.
  6. UEM 9.2 and newer supports Publisher-based allow. Set the Type to Publisher-based, click Add, browse to an executable, UEM will read the certificate, and add it to the list. Note: A challenge with hash-bashed and publisher-based rules is that the policy might have to be updated whenever the app is updated.
  7. UEM 9.2 adds a Privilege Elevation feature, which allows executables to run as administrator even if users are not administrators. To enable it, go to User Environment > Privilege Elevation, and click the Global Configuration button.
  8. Check the box to Enable Privilege Elevation. Specify Conditions where, if true, then Privilege Elevation is enabled. These are the same conditions available in other policies and settings.
  9. If you allow installers to be elevated, elevate the installer’s child processes too, check the box. This checkbox only applies to installers. Child processes of elevated applications is enabled when creating a Privilege Elevation configuration setting.
  10. When an application is elevated, the user can be asked to allow it. This prompt is intended to inform the user that the application has more permissions than it should, and thus be careful with this application. Click OK.
  11. Then you can create a Privilege Elevation setting to designate the applications that should be elevated. The applications can be specified by a path, a hash, or a publisher certificate. These are essentially the same options as Application Blocking.
  12. Path-based user-installed application lets you elevate installers. The other three options elevate applications, but not installers.
  13. The child processes checkbox applies to applications.
  14. UEM 9.4 adds Argument-based elevated application, which lets you elevate specific scripts and/or Control Panel applets. For details, see the YouTube video VMware User Environment Manager 9.4 Argument Based Privilege Elevation Feature Walk-through.
  15. UEM Group Policy settings can be enabled to log both Application Blocking and Privilege Elevation to Event Viewer

Personalization and UEM Templates

VMware has provided a list of Personalization Templates to simplify your configuration.

  1. To save user settings at logoff and restore at logon, you must specify the settings to save.  Easy Start created a bunch of configurations on the Personalization tab.
  2. You can see what settings these save by clicking Manage, and then Expand.

  3. To save more settings, select a folder (or create a new folder), and then click Create Config File.
  4. A wizard appears. You can use one of the built-in Windows Common Setting or Application Templates. Or you can create your own. UEM 9.2 has more built-in templates than previous versions.


    • UEM 9.4 adds a Windows Common Setting for Windows 10 Start Menu – Windows 10 1703 and higher
  5. The VMware community also uploads additional templates to VMware Communities.
  6. In UEM 9.5 and newer, the UEM Console has a button in the ribbon to Download Config Templates. You will need a My VMware account to access it. See Ivan de Mes VMware UEM 9.5 introduces the VMware Marketplace for templates.
  7. The Browse button on top lets you choose where in the tree you want to save the new Config File.
  8. For older versions of UEM, download a template, and import it.
    1. In the UEM Console, on the Personalization tab, click the Configure button to locate your UEM Configuration file share.

    2. Extract the downloaded templates to the General\Applications folder in the UEM Config Share.

    3. The downloaded template should then show up in the Personalization tab under the Applications folder. If you don’t see it, click the Refresh Tree icon.

Additional UEM Configuration

User Environment Manager 8.7 and newer has a UEMResult feature that lets you see what settings were applied to the user. The .xml file is only updated at logoff. To enable for a particular user, go to the user’s Logs folder and create a folder named UEMResult. At logoff, UEM will put an .xml file in this folder. More information in Appendix G of the User Environment Manager Administrator Guide.

From VMware 2113514 Enabling debug logging for a single user in VMware User Environment Manager: To configure FlexEngine to log at debug level for a single user, create an empty FlexDebug.txt file in the same folder as the standard log file for this user. This triggers FlexEngine to switch to debug logging for this particular user.

UEM Application Profiler

This tool cannot be installed on a machine that has FlexEngine installed:

  1. .NET Framework 3.5 is required.
  2. In the User Environment Manager files, in the Optional Components folder, run VMware UEM Application Profiler 9.6 x64.msi or VMware UEM Application Profiler 9.4 x64.msi (ESB).

  3. In the Welcome to the VMware User Environment Manager Application Profiler Setup Wizard page, click Next.
  4. In the End-User License Agreement page, check the box next to I accept the terms and click Next.
  5. In the Custom Setup page, click Next.
  6. In the Ready to install VMware User Environment Manager Application Profiler page, click Install.
  7. In the Completed the VMware User Environment Manager Application Profiler Setup Wizard page, click Finish.

You may now use the tool to determine where applications store their settings and export a default application configuration that can be pushed out using User Environment Manager.

UEM Support Tool

vDelboy – VMware UEM Helpdesk Support Tool

Do the following to configure the environment for the support tool:

  1. In the User Environment Manager Console, click the star icon on the top left, and click Configure Helpdesk Support Tool.
  2. Click Add.
  3. In the Profile archive path field, enter the user folder share (the same one configured in User Environment Manager GPO). At the end of the path, enter \[UserFolder]\Archives.
  4. Check the other two boxes. The paths should be filled in automatically. Make sure they match what you configured in the User Environment Manager group policy object. Click OK.
  5. Click Save.
  6. VMware recommends creating a new GPO for the Support Tool. This GPO should apply only to the support personnel.

  7. On the Scope tab, change the filtering so it applies to UEM Support and UEM Admins. If this GPO applies to machines with group policy loopback processing enabled, then also add Domain Computers.
  8. Edit the GPO.
  9. Go to User Configuration | Policies | Administrative Templates | VMware UEM | Helpdesk Support Tool.
  10. Double-click the setting UEM configuration share.
  11. Enable the setting, and enter the path to the UEMConfig share. Click OK.
  12. Consider enabling the remaining GPO settings. Read the Explain text or refer to the documentation.

Do the following to install the support tool.

  1. .NET Framework 3.5 is required.
  2. Some support tool functions require the FlexEngine to be installed on the help desk machine.
  3. In the extracted User Environment Manager files is an Optional Components folder. From inside that folder run VMware UEM Helpdesk Support Tool 9.6 x64.msi or VMware UEM Helpdesk Support Tool 9.4 x64.msi (ESB).

  4. In the Welcome to the VMware UEM Helpdesk Support Tool Setup Wizard page, click Next.
  5. In the End-User License Agreement page, check the box next to I accept the terms and click Next.
  6. In the Destination Folder page, click Next.
  7. In the Ready to install VMware UEM Helpdesk Support Tool page, click Install.
  8. In the Completed the VMware UEM Helpdesk Support Tool Setup Wizard page, click Finish.

Once the Helpdesk Support Tool is installed, you can launch it from the Start Menu, search for users, and then perform operations on the archives.

Related Pages

99 thoughts on “VMware User Environment Manager 9.8”

  2. Hi Carl,
    thank you for a great articles, we learned alot from your posts.
    I need to ask you about the Outlook profile with instant clone . how can we let the user get his outlook profile when he log-in. apart from app-volume writeable volumes methode . any other proceedures to get this done with local exchange

    Reply

    1. The Outlook profile is in the user’s registry and it should be captured by one of UEM’s built-in Personalization templates.

      Or are you asking about the .ost file? In that case, FSLogix is an alternative to Writable Volumes. Microsoft intends to release FSLogix for free.

      Reply

  3. Hi,

    What a great document. Thank you very much!

    We are considering using UEM on an RDSH farm for a largish management environment, which will eventually be migrated to a Horizon VDI solution.

    The main reason for this was to help create consistent environment for users and to manage folder redirection to protect against long log in times.

    I notice that you say you usually use group policy to manage folder redirection and I was wondering why you state this because I though that this was one of the main uses for UEM and managing the experience. We need to sync appdata as the users use tools like putty, SQL Management Studio, Winscp which often store their connection strings in appdata.

    Thanks in advance

    Reply

    1. Folder Redirection and UEM Personalization are two different things. Normally your profile is located under C:\Users on any machine you’re logged in. When Folder Redirection, some of the folders under C:\Users\%username% are instead redirected to a file share, which means the redirected folders don’t need to be synced at logon and logoff. For the files under C:\Users\%username% that are not redirected, UEM Personalization backs up the files to a file share, and then restores that flies at next logon.

      Reply

      1. Yes that’s my understanding too. I have previously used VMware persona management to do the redirection and it helped a great deal. I think I read that this is due to be EoL, will UEM replace this functionality? We needed to use persona management to help reduce log in times due to some large files in the C:\Users\%username%\appdata folder and PM allowed some of these to be synced after login and helped to reduce this login time (this was several years ago so I may be mistaken as to the exact reason)

        Reply

  4. Hi Carl,
    We are on Horizon 7 with instant clones and UEM. We are trying to hook up our VDI to TV through HDMI. When we tried doing that we didnt get any audio from the TV. Is there a way to accomplish that ? Thanks.

    Reply

  5. Hi Carl,

    I have requirement to add the safe sender list in outlook for all the users. How do I create predefined settings for specific settings like safe sender list and import to users. The challenge is that, if I export my configuration of outlook and import to users as predefined settings, then they would get my outlook profiles, would be messed up outlook.

    Reply

  6. Hi Carl,
    Thanks for this amazing post. I am having issue with desktop pools in which when any virtual desktop gets locked automatically or manually (ctrl + L) and then log off, when user tries to connect to any desktop pool in horizon client again(without signing out from client) it shows administrator account and user has to switch user first and have to enter username and password again. I looked everywhere but couldn’t find a solution. Have you ever came across this issue. ? Thanks.

    Reply

      1. Hi Carl, Thanks for your reply. Its actually neither of the two. To reproduce this issue below are the steps:
        1. Login to the horizon client
        2. Login into a desktop through any desktop pool
        3. lock the desktop manually or let it lock by itself
        4. Unlock the desktop
        5. Logoff from the desktop and don’t logout of Horizon client
        6. Login into any desktop pool again
        7. It shows desktopname\administrator account
        8. To login back user has to click on “switch user” then click on “other user” and enter his username and password again.

        I looked everywhere but couldn’t find a solution for this. I checked in other environments and everyone seems to have this problem. Not sure if you ever came across this but I think you should be able to reproduce it by following above steps.

        Reply

  7. Hi Carl,

    Thanks for the update, we are planning to copy the ADMX template to AD, is there any impact to the existing UEM setup and existing group policy in AD, we wan to implement or copy ADMX in sysvol folder,

    kindly let us know impact and issue,

    Thanks in advance
    Regards

    Renu

    Reply

    1. ADMX files define the available settings, not the configured settings. Updating ADMX files gives you new available settings but doesn’t affect the settings already configured.

      Reply

  8. Hi Carl,

    We are planning to upgrade DaaS 17.2 to 18.3 version, we are bit confused about UEM console upgrade,
    1. Can we upgrade UEM from 9.2 to 9.4 directly(inplace upgrade)
    2. can we install UEM 9.4 as new installation on different server and point the UEM_config, UEM_archive and home folder,

    Please help understand make the decisions

    Thanks in advance

    Regards

    Renu

    Reply

    1. The general guidance is to in-place upgrade the UEM Agents first. Then you can upgrade your management consoles, which unlocks new features

      They’re just files and you can certainly point your UEM Agents to a new location for those files.

      Reply

  9. Carl – What are your thoughts on the NoAD mode configuration of UEM? It seems to simplify things by doing away with the GPOs, but I don’t see many people talking about it.

    Reply

    1. My peers have done it several times, especially in complicated AD environments. If the UEM GPO settings were available per-machine instead of per-user then it would be less of a problem.

      Reply

      1. Hey Carl, do you (or your peers) often encounter such complicated AD environments where user policy is tricky to configure, but machine policy would help out if that were available?

        Would it help if you could configure the UEM agent through machine policy, even if you would be required to still configure a single setting (“Run FlexEngine as a Group Policy client-side extension”) via user policy? Or would the latter make the former pointless?

        No guarantees either way – just seeing if I can use your response as a feature request 🙂

        Reply

    2. I’m not aware of any issues with NoAD. The only functional gap compared to GPO-based configuration, is that all UEM agents that use a particular UEM configuration share will get the same “policy”. With GPO-based configuration, you can define multiple GPO’s, so that agents in OU1 create 5 backups, and agents in OU2 10, for instance. With NoAD, all agents get their settings from a single NoAD.xml file, so that granular configuration is (currently…) not possible.

      Reply

  10. Is there some logic in UEM Helpdesk Support Tool that hides certain profile archives? I have a working system, I recently created a new Personalisation Config (built-in ODBC) and also a custom one (for HKCU\SOFTWARE\VB and VBA Program Settings) – both these appear to function OK, I can see them on disk, but neither of them appear in the Helpdesk Support Tool. All others do. Deleting user’s UEM profile folder doesn’t impact issue.

    Reply

    1. Hi Nathan,

      At a high level, the Helpdesk Support Tool works like this: it scans the configuration share for .INI files (i.e. Personalization config files), scans the profile archive folder and profile archive backups folder of the selected user for archives and backups corresponding with those .INI files, and displays the config files for which there’s an archive or a backup in the list.

      I’m not aware of any issues with this. Do you see any other archives or backups in the Helpdesk Support Tool?

      Reply

      1. Now I understand the problem: multiple environments vs Helpdesk Support Tool.

        I have 3 UEM environments, with different configurations. HST’s config file is configured with all 3 environments, but will only look at one config (I’ll call it ‘main’). Hence, if my 2nd or 3rd environments have configuration items that are not present in the main environments, then HST won’t display the archives for those configuration items, as they are not present in Main config. How silly.

        My fix will be to have separate HST configs per environment, and launch HST with -FlexConfig to switch to my 2nd or 3rd environment as required.

        Reply

  12. Dear Carl,

    first of all: Happy New Year! 🎆 I hope that still counts on January 10th 😉 My best wishes to you!

    I found something interesting within UEM and logging of information and I was wondering if you could help me figuring out where the problem is: What difference is there between a user account in a OU and the same user in a group instead in the same OU?

    Please let me specify:
    I created a OU called ‘Horizon’. Within that OU I had a bunch of users that existed only for testing and they all worked fine in terms of logging information according to the level specified in the GPO “FlexEngine logging”.

    But when I wanted to extend my test and involve some of the colleagues that originally have been placed in other OUs I created a new Group in this Horizon OU and added those users (so to speak) indirectly to that group.

    Now these users can log on but the UEM policies are not applied and also no logging information is written, their user folder is not even created in the UEM user config share 😐

    Is there a way to straighten this behaviour? I was expecting this would work regardless of the users being directly in that OU or indirectly by putting them in a group but as it seems I have been mistaken. Where is the error?

    Thanks in advance for your helpful advice!
    Best regards!

    Reply

    1. GPOs apply to users or machines. GPOs do not apply to user groups.

      The easy method of handling this is to enable Group Policy Loopback Processing so that these settings apply to machines and any user that logs into those machines. You can optionally filter the GPO so it only applies to the one user group by configuring the Security Filtering section on the first tab of the GPO.

      Reply

      1. Hey Carl!

        Thank you very much, that helped a lot.
        Together with the loopback processing enabled and the two RDS hosts added as computer accounts in the scope filter I was able to get things going — great stuff!
        Have a great day ahead 🙂

        Reply

  13. Carl – question about printer mappings – with a single environment printer mappings are taking increasing longer to achieve after logon – as we have more printer mappings with each dept we migrate in this is taking longer. we have multiple large campuses and some people migrate between and others do not. if we create separate environments for each campus then the printer mapping list is divided and would process faster – but- we then have to keep track of where each user goes and add/change memberships in AD – If we have multiple environments – 1 for each campus can we point end point devices to the correct environment automatically ?-So If a user goes from A to B the environment is automatically selected by IP or device name at logon? That way printer mappings could be split without having to go through 600 – 700 lines every time.

    Reply

  14. Hi Carl, thanks so much for the write up. We are working on a VDI enviorment. Currently we are using 7.5 instant clone with non persistent disks. The issue we are running into is. We want to install Microsoft visaul studio on the “gold”image and be able to save the users settings(ie connection strings) on any instant clone dekstop they connect to. Is that a case where App Volume install is needed or is that something that can be done from the UEM? I am a bit confused of what would be the best direction to go. Thank you for any insight !

    Reply

  15. Hi Carl, in regards to folder redirection, are you using the setting in the UEM console or the folder redirection option in group policy?

    Reply

  16. Hey Carl,
    I have an issue with 7.2 horizon. Seems very intermittently I find that the Volatile Environment variables are not getting written to the registry. I would like to utilize UEM to perhaps refresh the variables or at least prompt me and let me know the VM is no Set properly with the variables.( our app need the device name not the vm name) I cant reproduce the error but it happens randomly. Do you know of a way to use UEM to set the refresh env variables option if a scan finds the Variables(specifically ViewClient_Machine_Name). I have written a vb script to detect this issue . I would run the vbs at logon but would rather be able to run a refresh when detected.
    Hoping that this is clear.
    Cheers
    Ron

    Reply

    2. Hey Ron,

      Just to make sure I understand correctly: the ViewClient_ values are sometimes missing in HKCU\Volatile Environment?

      UEM won’t be able to fix that, as those values are set by the Horizon agent. It will also be hard to use UEM to detect that they’re missing, as they don’t exist yet at that location when UEM runs at logon… You could of course use UEM to put a shortcut to your detection VBS in the startup folder, but that’s about it, I’m afraid.

      Reply

      1. Yes i was hoping for miracles.. I too didnt think UEM could this.. it is strange.. that the vm would launch and the Env variables are not there. this puts our App in the hole because we really need the device name. Would you know of a way to evoke the agent to write the values at all.. Vmware has not been much help yet on this issue. and I cant get logs being that the machine is destroyed before we even know about the issue.. it’s a pickle..

        Reply

        1. Sorry, I don’t know much about the Horizon agent. When the values are missing from the Volatile Environment key, are they available at the subkey of HKLM\Software\VMware, Inc.\VMware VDM\SessionData that corresponds with the session ID? Just curious.
          As for getting logs: maybe that’s where your detection script can come in? Grab the logs when it detects that the ViewClient_ values are missing?

          Reply

    1. Configuring UEM to store different app settings in different archives gives you benefits. For example, you can reset one archive without affecting others. Most archives will work on multiple OS versions.

      Otherwise, I wonder if you can add a setting to capture everything under AppData\Roaming, AppData\Local and everything under HCKU\Software. Make sure you add exclusions similar to the ones I have listed in my Citrix Profile Management article.

      Reply

  18. Carl, thank you again for such an amazing write up.

    I have a few questions in regards to UEM:

    – Can the new administrative templates that came with 9.3 still work with UEM management console 9.0?

    – Can a new 9.3 management console utilize the same shares that 9.0 was using?

    That way I can have my 2 environments coexist as I migrate users to a new platform without having to recompose all my 9.0 UEM users.

    Reply

    1. https://docs.vmware.com/en/VMware-User-Environment-Manager/9.2/com.vmware.user.environment.manager-install-config/GUID-FE6EBDC8-0F0E-499F-8492-471A01594AC4.html Shows the order in which the components need to be upgraded. FlexEngine (agent) first.

      Upgrading the console will sometimes result in upgraded definitions, which might not work in older FlexEngine.

      ADMX templates are last. Technically they only contain the “available” settings, but not the “actual” settings. The “actual” settings are configured in Group Policy. If those don’t change, then updating the templates probably won’t have any effect.

      Reply

      1. Carl, thanks again for all the great information.

        Great question and great response.

        We are in a similar situation. We are slowly migrating our users to Windows 10 v1709, and found that we need to upgrade to UEM 9.3 for comparability with Windows 10. We found that the latest Flex Engine works with UEM Manager 9.0. Would it be safe to run this mixed versions until the W10 migration is complete? We are trying to avoid upgrading the Console and being forced to recompose thousands of end users.

        Thoughts?

        Reply

        1. Hi Ivan,

          Your scenario is perfectly supported – it’s exactly why the steps to upgrade UEM are the way they are. New versions of FlexEngine (the UEM agent) are compatible with config files created with earlier versions of the Management Console, so you can indeed run FlexEngine 9.3 with Management Console 9.0.

          Once all your users have been migrated you can upgrade the Management Console and start using the new functionality.

          Reply

  19. Carl, your articles are the best by far on the internet and truly follow real world scenarios. Thank you for having a great site and providing wonderful help to all professionals.

    I am about to deploy a new linked-clone 7.3 horizon deployment and am trying to understand which ti use for profile management. In reading everything, manual profiles in UEM don’t persist at log off and if a user logs back on personal settings are not kept. What scenario would I use for linked-clones and have the user keep all individual changes when they log back in?

    Horizon (linked-clones) -> UEM – Mandatory profiles?
    – Roaming Profiles?

    Horizon (linked-clones) -> Persona M. – ?

    Just curious what is the best approach.

    Also, using AppVolumes for Office, Apps, Etc…

    Thank you in advance.

    Reply

    1. UEM provides the greatest flexibility – you can specify what is saved, and by extension, what is not saved. But, you have to tweak the config as apps are updated or introduced. The saved configurations are stored on a per-app basis, thus allowing for settings to apply to multiple profile versions. The Personalization tab is where you configure what is saved at logoff.

      Persona generally only requires an initial configuration, but it saves everything. However, VMware seems to be deprecating Persona, so they recommend UEM.

      VMware is also deprecating Writable Volumes for user profiles.

      Reply

          1. did you try this? Doesn’t work for me. As I understand this is how I should add it to config file
            “[Include Folder Trees] ”
            “[Include Registry Trees] “

          2. Have you tried this, doesn’t work for me. I added config
            “[Include Folder Trees] ”
            “[Include Registry Trees] “

  20. Hi carl !!
    I am setup roaming profiles and UEM, however when I set redirection desktop folder the customizations were lost, due UEM setting.

    is there some way to fix it ?

    Kinde regards,

    Reply

      1. Sure !!
        I did the setup mandatory profile on Windows 10 1607 and it is working pretty well. Every time that I made login i get the profile from mandatory.
        I setup UEM with folder redirection and GPOs to UEM, it is working too, perfectly !
        But, when I did login on VDI desktops ,the UEM setting have preference over mandatory profile setting, and the desktop shortcuts that I had on mandatory aren’t imported. If I disable redirection of desktop on UEM setting, the desktops setting from mandatory profile works.

        Sorry, for my english.
        Do you understand my issue ?

        Reply

        1. Let me see whether I understand: you have desktop shortcuts configured as part of your mandatory profile, but you’re also redirecting the desktop folder? In that case, the shortcuts in the mandatory profile will indeed be ignored, as Windows is looking to the redirected location instead.

          Reply

          2. Hi Wesley,

            Somehow the site didn’t give me the option to reply to your latest post, so I’m replying to myself instead 🙂

            There is no behavior te address: with folder redirection you’re telling Windows to ignore the original location, and look for files in the redirected location. That’s why the shortcuts you defined in your mandatory profile are “ignored” – you’re telling Windows to do that, as you’ve redirected the desktop folder.

            If you want to provide “admin-defined” desktop shortcuts to your users, why not use UEM for that? Much easier to manage (and modify) than baking them into the mandatory profile, and you also don’t run into this “conflict” with folder redirection.

  22. Hi Carl, lot’s of good info. I’ve been experimenting with ways to get Win10 1607 to take default apps and file extensions and trying to stop Edge from hijacking pdfs. There are different approaches, what do you suggest?

    thanks,

    James

    Reply

  23. Hi Carl, Is there any way to base a condition on a specific AD Username? I can find AD Group, but it would be good to condition a certain action on a handful of AD users too, at least just for testing.

    Reply

    1. Hi Barry, there’s no specific username condition, but you can use the environment variable condition, and check against the “username” env var.

      Reply

  24. Hi Carl, Thanks for great artical. Could you please suggest how we can manage 2 different java versions (Java 6u45 and Java 8 u101) on one VDI using UEM. There are fews users how access web links few links required java 6u45 and few links required java 8 u101. We’ve installed both the version on VDI using app volume but it’s getting conflict. Only java latest version is working. Could you please suggest us. Thank You!

    Reply

    1. Since Layering Technologies don’t isolate apps, you’ll need a different tool to perform isolation. App-V is common.

      Reply

  25. Trying to run a logoff script (simple .bat file) with UEM but can’t get it to work from network share. Any thoughts?

    Reply

  26. We have set up Horizon 7.0.2 with UEM 9.1 and AppVolume Manager 2.11, however I have noticed that Smart Policy for USB disablement doesn’t work at initial login it does work at re-connect, can someone test this in their environment and advise the outcome?
    Cheers

    Reply

  27. Hello Carl, Firs of all thank you for really helpful info.
    We have non persistent linked clones environment with Zero clients locally attached USB printers. We have to change define different printer settings for different users. Is it possible to manage this setting with UEM or use Persona roaming profiles ?

    Reply

  30. Carl question. We are using Windows 10 with Instant Clones. We have some trouble getting some OS Settings out of WIndows 10 for users like Start Menu, Default Programs and other settings that seems to be saved in AppData\Local. Right now we are using Persona Management to also capture AppData\Local. That seems to have resolved our issues. Are you seeing other solutions to issues with Windows 10 specifically and capturing OS related User Settings that are not easily captured via UEM?

    Thanks
    Jesse

    Reply

  31. Great article! I just finished migration from persona management to UEM, but I have some issues:
    In FlexEngine.log I see warning: “WARN Previous import not marked as successful — skipping export.”
    How fix this issue?

    Reply

      1. Hi Iknife and PlumBob,

        Sorry, just found this site… If you’re migrating from Persona to UEM, you probably only run UEM at logoff? In that case you need to “force” the export at logoff by passing the additional “-F” argument (so, “…\FlexEngine.exe -s -F”).

        Reply

  32. Question – I am rolling out a new non persistant Windows 10 Deployment oN horiz 6.x . Followed the UEM and GPO info to a “T”. The problem I am having is that the Windows would take up to 10 Minutes at times to logon / provide a machine. The backend storage is very robust and all FLASH SAN.

    Why would the logons take so long to process??

    Reply

      1. Hi Carl – thanks for the prompt response. No we are not using a mandatory profile. I don’t recall doing this for our Win7 deployment. None the less are you saying the mandatory profile is the ticket to quicker logon nirvana for Win 10 Non persistence?

        Reply

          1. Thanks.. working through it now. However on the template user profile i copied over there is no NTUSER.DAT file. Yes I do have show hidden files ticked and protected operating system files checked. I do see them in the “default” user folder but not the template user. So with that said what would i load the hive with or simply bypass that section?

          2. Thanks again Carl. Looks like my template is borked. I appreciated your prompt responses on this topic.

          3. OK just an update. I essentially started from scratch with my Win 10 NON-persistent Horizon project with mandatory profile v5 created successfully.

            And login times are still slow. Has anyone else on here have done non persistent Windows 10? If so how did you over come your slow login times?

    1. The whole idea of exclusion is to prevent those folders from being saved in the roaming profile. However, redirection removes the folder from the roaming profile and thus there’s nothing to exclude. All data created by the apps is automatically saved in the redirected location.

      You can turn off redirection and then configure exclusions. Or you might have to use scripts to delete content from the redirected folder location.

      Reply

      1. I’m trying to exclude outlook from appdata but it doesn’t work. I tried include folder first and then exclude first but still outlook folder is created. With Citrix is just add exclusion but here I cannot make it work.
        [IncludeFolderTrees]
        \Microsoft
        [ExcludeFolderTrees]
        \Local\Microsoft\Outlook

        Any idea how to make it work?

        Reply

  34. Hi Carl, Fantastic work by the way! I am trying to use UEM to configure predefined settings that set the default search engine in IE11 to be google rather than Bing. I see there is an IE Application Template. Do I amend this template? How do I configure the above setting?
    Thanks
    Sean

    Reply

  35. Hi Carl, wonderful post through and through. I have a question as per UEM. I just would like to demonstrate the Application blocking capabilities. What is the minimum install required for this?

    I quote your statement above, “Before performing the procedures detailed on this page, make sure you’ve imported the UEM ADMX templates, created the GPOs for Horizon, and configured the Horizon GPOs for User Environment Manager.”
    Must i do all this to demonstrate Application blocking?
    Thanks for your response.

    Reply

  37. I cannot make it work with 2012r2 TS, GPOs just
    Use mandatory profiles on the RD Session Host server = enabled
    Set path for Remote Desktop Services Roaming User Profile = \\fs01\UEMConfig\mandatory (Do not include the .v5 in this path)
    Does 2012r2 supports this config?

    Reply

    1. The folder should be named .v2 or .v4, depending on if you’ve enabled the newer profile version by changing the registry key. But I think it will tell you in the Application Log what path it’s looking for.

      Reply

  39. Is there a way to have multiple UEM Configuration Shares? We need a test and production share.

    It seems like I seen someone on a video and they had an option to chose from multiple UEM Configuration Shares.

    Thanks
    Sunshine Baines

    Reply

    1. You can certainly use the console to edit multiple Config Shares. If you click the Star icon on the top left you can add and switch environments.

      Reply

  40. I’m not able to get the window settings to export. I ran the easy start to do a proof of concept. I made some changes in the IE settings and Taskbar, but it is not exporting the settings at logoff. I do see settings exporting for notepad and wordpad, but I’m not able to get the window settings working. Any ideas?

    Thanks
    Sunshine

    Reply

Leave a Reply