VMware Dynamic Environment Manager (DEM) 2303

Last Modified: Apr 1, 2023 @ 8:51 am

267 Comments

Navigation

As of version 9.9, User Environment Manager (UEM) was renamed to Dynamic Environment Manager (DEM).

This post applies to all Dynamic Environment Manager (aka User Environment Manager) versions including DEM 2303 (10.9), DEM 2212 (10.8) ESB, DEM 2111 ESB (10.4), and DEM 9.9 (ESB).

💡 = Recently Updated

Change Log

Upgrade

If you are performing a new installation, skip to the Installation Prerequisites section.

When upgrading an existing installation of DEM or UEM, upgrade the FlexEngine on the Horizon Agents first.

The newest FlexEngine can still interpret the INI files from older DEM console. After your clients (FlexEngine) have been upgraded, you can upgrade the management console, which allow for new options, like elevated privileges and others, which (when enabled) can now be correctly interpreted by the upgraded clients (FlexEngine). After that update the ADMX files.

DEM 2203 and newer move FlexEngine licensing to the configuration share and DEM console. If you are upgrading existing FlexEngines, then the previous license will continue functioning. New FlexEngines need the new licensing configuration method.

Installation Prerequisites

Before performing the procedures detailed on this page, make sure you’ve created the DEM File Shares, imported the DEM GPO ADMX templates, created the GPOs for Horizon, and configured the Horizon GPOs for Dynamic Environment Manager.

VMware Tech Zone Antivirus Considerations in a VMware Horizon Environment: exclusions for Horizon View, App Volumes, User Environment Manager, ThinApp

VMware Workspace Tech Zone has an excellent Quick-Start Tutorial for User Environment Manager. It’s around 130 printed pages.

Mandatory Profile

At user logon, DEM restores profile archives on top of a Windows profile, which is typically a local profile, or a mandatory profile.

If your Horizon Agent machines are single-user, non-persistent that reboot at logoff, then local profiles are essentially the same as mandatory.

If your Horizon Agent machines are multi-user machines (e.g. RDSH) that don’t reboot every day, then you might need a process to delete local profiles when the user logs off. Here are some options:

  • Schedule a delprof2.exe script that runs daily.
  • Configure mandatory profiles, which are automatically deleted a logoff.
  • A more advanced option is to add users to the local Guests group, which causes their profile to be deleted at logoff.

If you choose Mandatory profile, then here are some mandatory profile creation instructions:

DEM Console Installation

As of version 9.9, User Environment Manager (UEM) was renamed to Dynamic Environment Manager (DEM).

In Horizon 2006 (aka 8.0), DEM is available in all editions of Horizon. There are two editions of DEM, each with different downloads and different DEM capabilities.

  • Horizon 8 (2006+) Enterprise Edition and Horizon 7.13 Enterprise Edition are entitled to DEM Enterprise Edition, which has all features.
  • Horizon 8 (2006+) Standard Edition and Horizon 8 Advanced Edition are entitled to DEM Standard Edition, which is limited primarily to Personalization features. If you are using FSLogix Profile Containers, then you don’t need DEM Standard Edition.

DEM 2303 (10.9) is the latest release. DEM 2212 (10.8) is an Extended Support Branch (ESB). DEM 2111 (10.4) is the previous Extended Support Branch (ESB).

  1. Based on your entitlement, download either DEM 2303 (10.9) Enterprise Edition or DEM 2303 (10.9) Standard Edition. For ESB Horizon, download the DEM version included with your ESB version of Horizon.

  2. If upgrading, don’t upgrade the DEM Console until all of your DEM Agents have been upgraded.
  3. On your administrator machine, run the downloaded VMware Dynamic Environment Manager 2303 10.9 x64.msi.
  4. In the Welcome to the VMware Dynamic Environment Manager Enterprise Setup Wizard page, click Next.
  5. In the End-User License Agreement page, check the box next to I accept the terms and click Next.
  6. In the Destination Folder page, click Next.
  7. In the Choose Setup Type page, click Custom.
  8. In the Custom Setup page, change the selections so that only the console is selected and then click Next.
  9. In the Ready to install VMware Dynamic Environment Manager Enterprise page, click Install.
  10. In the Completed the VMware Dynamic Environment Manager Enterprise Setup Wizard page, click Finish.

Configure Dynamic Environment Manager

Here is a summary of the major Dynamic Environment Manager functionality:

  • Personalization (aka import/export user settings) – saves application and Windows settings to a file share. This is the roaming profiles functionality of Dynamic Environment Manager. You configure folders and registry keys that need to be saved. The import/export can happen at logon/logoff or during application launch/exit.
    • Pre-configure application settings – configures files and registry keys for specific applications so users don’t have to do it themselves. Some examples: disable splash screen, default folder save location, database server name, etc.
    • Self–support tool – users can use this tool to restore their application settings.
    • DEM Standard Edition supports all Personalization features.
  • User Environment – configures Windows settings like drive mappings, Explorer settings, printer mappings, etc. This is similar to group policy but offers significantly more options for conditional filtering. Dynamic Environment Manager can configure any registry setting defined in an ADMX file.
    • DEM Standard Edition only has a limited set of User Environment settings (e.g., drive mappings). Most User Environment features require DEM Enterprise Edition.
    • Most settings in DEM are only for users, not computers. DEM 2006 (aka 10.0) and newer support ADMX templates for Computer Settings. In older DEM, use Group Policy to configure Computer Settings.
    • Best practice is to not mix Dynamic Environment Manager and user group policy. Pick one tool. If the same setting is configured in both locations then group policy will win.
    • UEM 9.6 and newer support Windows Server 2019 as an Operating System condition.
  • Horizon Smart Policies – Use Horizon Conditions (e.g., client IP) to control device mappings (e.g., client printing) and PCoIP/Blast Bandwidth Profile.
  • Privilege Elevation (UEM 9.2 and newer) – allow apps to run as administrator even though user is not an administrator. Installers can also be elevated.

Links:

Initial Configuration (Easy Start)

To perform an initial configuration of Dynamic Environment Manager, do the following:

  1. Launch the DEM Management Console from the Start Menu.
  2. Enter the path to the DEMConfig share, and click OK.
  3. These Settings checkboxes define what is displayed in the management console. Leave it set to the defaults, and click OK.
  4. In the Personalization ribbon, on the far right, click Easy Start.
  5. Select your version of Office, and click OK. Office 2019 and Office 2016 are essentially the same.
  6. Click OK when prompted that configuration items have been successfully installed.
  7. Review the pre-configured settings to make sure they are acceptable. For example, on the ribbon named User Environment, under Shortcuts, Dynamic Environment Manager might create a Wordpad shortcut that says (created by VMware UEM). You can either Disable this item, or delete it.

  8. Go to the ribbon name User Environment. On the left, expand Windows Settings and click Policy Settings. On the right, if there is a setting to Remove Common Program Groups, then click Edit.

    1. Consider adding a condition so it doesn’t apply to administrators.

DEM Licensing

DEM 2203 and newer moved FlexEngine licensing to the DEM Configuration Share and DEM Console.

  1. Download the Production License File from the same place you downloaded DEM:  DEM 2303 (10.9) Enterprise Edition, or DEM 2303 (10.9) Standard Edition.
  2. In the DEM console, click the top-left star icon and then click License.
  3. Click Manage.
  4. Choose License File and then select the downloaded VMware-DEM-10.9.0-GA.lic file.

  5. Click OK.

DEM Console places the license info in the DEM Configuration Share file under \general\FlexRepository\AgentConfiguration.

Common Configurations

  1. DEM 2303 (10.9) and newer have a Search button to help you find configuration files.
  2. To roam the Start Menu in Windows 10 1703 and newer, see VMware 2150422 How to roam Windows 10 Start Menu layout.
    1. Go to the ribbon named Personalization, click a folder, and click Create Config File.
    2. Select Use a Windows Common Setting and click Next.
    3. Select Windows 10 Start Menu – Windows 10 Version 1703 and higher. This option is only available in newer versions of DEM. It should work with Windows Server 2019, but it doesn’t apply to Windows Server 2016, which is actually version 1607.
    4. Enter a file name. DEM will create a .zip file for each user with this name. Click Finish when done.
  3. You can run Triggered Tasks when a session is reconnected, or workstation is unlocked. This is useful for re-evaluating Smart Policies, as detailed below.

    • DEM 2111 and newer have a Trigger named App Volumes logon-time apps delivered. This was renamed from the older All AppStacks Attached trigger. It was renamed because App Volumes 2111 supports on-demand apps.

  4. UEM 9.3 and newer have a setting to store Outlook OST file on App Volumes writable volumes. Go to the ribbon named User Environment. Right-click App Volumes and create a setting. Check the box next to Store Offline Outlook Data File (.ost) on writable volume. Configure other fields as desired. Note: this setting only applies to new Outlook profiles. More info in the YouTube video VMware User Environment Manager Outlook OST on App Volumes User Writable Volume Feature Walkthrough.

Links:

Horizon Smart Policies

Horizon Smart Policies let you control (e.g. disable) Horizon functionality for external users or other conditions.

  1. In UEM 9.0 and newer, go to User Environment > Horizon Smart Policies, and create a policy.
  2. DEM 9.11 has an expanded list of settings configurable using Smart Policies.
  3. UEM 9.8 adds several new Smart Policy Settings, including Drag and drop. See VMware User Environment Management 9.8 Feature Walk-Through at YouTube.
  4. On the Conditions tab, you can use any of the available conditions, including the Horizon Client Property conditions. Note: UEM 9.2 has more conditions (e.g. Active Directory Site Name) than prior versions.

    • To detect external users, select Horizon Client Property > Client Location = External. UAG and Security Server set the session’s location to External.
  5. You can also enter a Horizon Client Property condition that corresponds to the ViewClient_ registry keys. In the Property field, type in a property name (remove ViewClient_ from the property name). See VMware Blog Post Enhancing Your VMware Horizon 7 Implementation with Smart Policies. And the 28-page PDF Reviewer’s Guide for View in Horizon 7: Smart Policies, VMware Horizon 7.

  6. UEM 9.1 and newer has Endpoint Platform as a policy condition. Create a Policy, go to the Conditions tab, and select the Endpoint Platform condition. UEM 9.8 adds Chrome to the Platform list.
  7. UEM 9.8 adds Matches Regex to some of the conditions (e.g. Endpoint name and Horizon Client Property > Pool name).

  8. To reapply Horizon Policies when users reconnect to an existing session, go to User Environment > Triggered Tasks, and click Create. Or you can edit one of the existing Triggered Tasks settings.

    1. Change the Trigger to Session Reconnected.
    2. Change the Action to User Environment refresh. Select Horizon Smart Policies, and click Save.

Application Blocking

  1. UEM 9.0 adds an Application Blocking feature. To enable it, go to User Environment > Application Blocking, and click the Global Configuration button.
  2. Check the box to Enable Application Blocking. Specify Conditions where, if true, then App Blocking is enabled. These are the same conditions available in other policies and settings. Click OK.
  3. Then you can create an Application Blocking setting to designate the folders that users can run executables from, or what file hashes are allowed.
  4. You can add folders that allow or block apps. Any executable in these paths will be allowed or blocked. By default, executables in Windows and Program Files (including x86) are allowed.
  5. UEM 9.1 and newer allows File Hashes in addition to File Paths. Set the Type to Hash-based, click Add, browse to an executable, UEM will compute the hash, and add it to the list.
  6. UEM 9.2 and newer supports Publisher-based allow. Set the Type to Publisher-based, click Add, browse to an executable, UEM will read the certificate, and add it to the list. Note: A challenge with hash-bashed and publisher-based rules is that the policy might have to be updated whenever the app is updated.

Privilege Elevation

  1. UEM 9.2 adds a Privilege Elevation feature, which allows executables to run as administrator even if users are not administrators. To enable it, go to User Environment > Privilege Elevation, and click the Global Configuration button.
  2. Check the box to Enable Privilege Elevation. Specify Conditions where, if true, then Privilege Elevation is enabled. These are the same conditions available in other policies and settings.
  3. If you allow installers to be elevated, elevate the installer’s child processes too, check the box. This checkbox only applies to installers. Child processes of elevated applications is enabled when creating a Privilege Elevation configuration setting.
  4. When an application is elevated, the user can be asked to allow it. This prompt is intended to inform the user that the application has more permissions than it should, and thus be careful with this application. Click OK.
  5. Then you can create a Privilege Elevation setting to designate the applications that should be elevated. The applications can be specified by a path, a hash, or a publisher certificate. These are essentially the same options as Application Blocking.
  6. Path-based user-installed application lets you elevate installers. The other three options elevate applications, but not installers.
  7. The child processes checkbox applies to applications.
  8. UEM 9.4 adds Argument-based elevated application, which lets you elevate specific scripts and/or Control Panel applets. For details, see the YouTube video VMware User Environment Manager 9.4 Argument Based Privilege Elevation Feature Walk-through.
  9. DEM Group Policy settings can be enabled to log both Application Blocking and Privilege Elevation to Event Viewer

Computer Settings

DEM Enterprise Edition 2006 and newer can deploy computer-based ADMX settings.

  • Domain Computers must have Read permission to the DEM Config file share.

DEM 2006 and newer Agents (FlexEngines) must be configured to enable computer settings. You can either configure registry settings on each DEM Agent machine, or in DEM Agent 2103 and newer you can use an installer command-line switch. Both are detailed at Perform Installation with Computer Environment Settings Support at VMware Docs.

  • Group Policy Preferences can push these registry keys to the Horizon Agent machines. Or you can manually modify the registry in your master images. If you use group policy, then make sure the group policy applies to your master image. The minimum registry values are Enabled and ConfigFilePath as detailed at Perform Installation with Computer Environment Settings Support at VMware Docs. For the list of additional registry values, see FlexEngine Configuration for Computer Environment Settings at VMware Docs.
  • Command line install looks something like below. The command line installer switch sets the same ConfigFilePath and Enabled registry values as shown above. 
    msiexec /i "\\fs01\bin\VMware\DEM\VMware-DEM-Enterprise-2303-10.9-GA\VMware Dynamic Environment Manager Enterprise 2303 10.9 x64.msi" /qn COMPENVCONFIGFILEPATH=\\fs01\DEMConfig\general

Do the following to enable Computer Environment settings in the DEM Console:

  1. In the DEM Management Console, at the right side of any ribbon, click Configure.
  2. At the bottom of the General tab, check the box next to Computer Environment.
  3. A new Computer Environment ribbon is added. DEM 2009 and newer have Startup Tasks and Shutdown Tasks.
  4. With ADMX-based Settings highlighted on the left, click Manage Templates in the ribbon.
  5. At the bottom of the window, click Add Folder.
  6. If you have PolicyDefinitions in your SYSVOL, then browse to that. Or you can point it to C:\Windows\PolicyDefinitions. Click OK.
  7. Click OK after import is successful. DEM copied the .admx files into the DEM Config share. You can run this again any time to update templates.
  8. With ADMX-based Settings selected on the left, click Create in the ribbon.
  9. At the bottom, click Select Categories.
  10. Select a category where your setting is located and click OK.
  11. At the top of the window click Edit Policies.
  12. Only the settings for your chosen categories are shown. Configure these settings the same way you would configure them in group policy. Then close the window.
  13. DEM shows the configured settings.
  14. On the Conditions tab, you can add conditions. Obviously the user-based conditions will not be available for computer-based settings.

Personalization and DEM Templates

VMware has provided a list of Personalization Templates to simplify your configuration.

  1. To save user settings at logoff and restore at logon, you must specify the settings to save.  Easy Start created a bunch of configurations on the Personalization ribbon. Note: DEM 9.11 adds a Find box to this ribbon.
  2. You can see what settings these save. On the tab named Import / Export, on the top right, click Manage, and then click Expand.

    1. Click Yes to expand it.

    2. After reviewing the config, click a different Personalization setting, and then click No to not save your changes.
  3. To save more profile settings at logoff, on the ribbon named Personalization, select a folder (or create a new folder), and then click Create Config File.
  4. A wizard appears. You can use one of the built-in Windows Common Setting or Application Templates. Or you can create your own.


    • DEM 9.10 and newer have a Windows Common Setting named Default applications – File type associations and protocols. For details, see Ivan de Mes at Managing File Type Associations (FTA) natively using Dynamic Environment Manager.

      • Also enable the GPO setting Do not show the ‘new application installed’ notification at Computer Configuration > Policies > Administrative Templates > Windows Components > File Explorer.
      • To avoid a delay in applying FTAs after login, VMware 83679 recommends setting HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Serialize\StartupDelayInMSec (DWORD) = 0.
    • UEM 9.4 and newer have a Windows Common Setting for Windows 10 Start Menu – Windows 10 1703 and higher
  5. In UEM 9.5 and newer, the DEM Console has a button in the ribbon to Download Config Templates. You will need a My VMware account to access it. See Ivan de Mes VMware UEM 9.5 introduces the VMware Marketplace for templates.
  6. The Browse button on top lets you choose where in the tree you want to save the new Config File.
  7. DEM 9.11 and newer have a Find box.
  8. For older versions of UEM, download a template, and import it.
    1. In the DEM Console, on the Personalization tab, click the Configure button to locate your DEM Configuration file share.

    2. Extract the downloaded templates to the General\Applications folder in the DEM Config Share.

    3. The downloaded template should then show up in the Personalization tab under the Applications folder. If you don’t see it, click the Refresh Tree icon.
  9. DirectFlex – to speed up logins, enable DirectFlex whenever possible. Instead of restoring the files during logon and thus delaying the login, DirectFlex restores the settings on-demand when the user launches the application. DirectFlex can be enabled on most application configurations. However, Windows settings (e.g. Start Menu) should be loaded during login rather than on-demand after login.

Additional DEM Configuration

User Environment Manager 8.7 and newer has a UEMResult feature that lets you see what settings were applied to the user. The .xml file is only updated at logoff. To enable for a particular user, go to the user’s Logs folder and create a folder named UEMResult. At logoff, DEM will put an .xml file in this folder. More information at VMware Docs.

From VMware 2113514 Enabling debug logging for a single user in VMware User Environment Manager: To configure FlexEngine to log at debug level for a single user, create an empty FlexDebug.txt file in the same folder as the standard log file for this user. This triggers FlexEngine to switch to debug logging for this particular user.

DEM Application Profiler

This tool cannot be installed on a machine that has FlexEngine (aka DEM Agent) installed:

  1. .NET Framework 3.5 is required.
  2. In the Dynamic Environment Manager files, in the Optional Components folder, run VMware DEM Application Profiler 10.6 x64.msi. DEM 2303 (10.9) includes version 10.6 of the Profiler.
  3. In the Welcome to the VMware DEM Application Profiler Setup Wizard page, click Next.
  4. In the End-User License Agreement page, check the box next to I accept the terms and click Next.
  5. In the Custom Setup page, click Next.
  6. In the Ready to install VMware DEM Application Profiler page, click Install.
  7. In the Completed the VMware DEM Application Profiler Setup Wizard page, click Finish.

You may now use the tool to determine where applications store their settings and export a default application configuration that can be pushed out using Dynamic Environment Manager.

DEM Support Tool

vDelboy – VMware UEM Helpdesk Support Tool

Do the following to configure the environment for the support tool:

  1. In the Dynamic Environment Manager Console, click the star icon on the top left, and click Configure Helpdesk Support Tool.
  2. Click Add.
  3. In the Profile archive path field, enter the user folder share (the same one configured in Dynamic Environment Manager GPO). At the end of the path, enter \[UserFolder]\Archives.
  4. Check the other two boxes. The paths should be filled in automatically. Make sure they match what you configured in the Dynamic Environment Manager group policy object. Click OK.
  5. Click Save.
  6. VMware recommends creating a new GPO for the Support Tool. This GPO should apply only to the support personnel.

  7. On the Scope tab, change the filtering so it applies to DEM Support and DEM Admins. If this GPO applies to machines with group policy loopback processing enabled, then also add Domain Computers.
  8. Edit the GPO.
  9. Go to User Configuration | Policies | Administrative Templates | VMware UEM | Helpdesk Support Tool.
  10. Double-click the setting DEM configuration share.
  11. Enable the setting, and enter the path to the DEMConfig share. Click OK.
  12. Consider enabling the remaining GPO settings. Read the Explain text or refer to the documentation.

Do the following to install the support tool.

  1. .NET Framework 3.5 is required.
  2. Some support tool functions require the FlexEngine (aka DEM Agent) to be installed on the help desk machine.
  3. In the extracted Dynamic Environment Manager files is an Optional Components folder. From inside that folder run VMware DEM Helpdesk Support Tool 2111 10.4 x64.msi. This tool was not updated for the DEM 2303 (10.9) release.
  4. In the Welcome to the VMware DEM Helpdesk Support Tool Setup Wizard page, click Next.
  5. In the End-User License Agreement page, check the box next to I accept the terms and click Next.
  6. In the Destination Folder page, click Next.
  7. In the Ready to install VMware DEM Helpdesk Support Tool page, click Install.
  8. In the Completed the VMware DEM Helpdesk Support Tool Setup Wizard page, click Finish.

Once the Helpdesk Support Tool is installed, you can launch it from the Start Menu, search for users, and then perform operations on the archives.

Related Pages

267 thoughts on “VMware Dynamic Environment Manager (DEM) 2303”

  1. We are facing issue with windows login time (20-30 mins) for few users in instant clones. Any suggestions? Only DEM is configured.

    Reply

    1. Have you setup exclusions with your AV software? Don’t have the link off hand but you can find it easily.

      Reply

      1. Here the problem is only for 2-4 users and other 300 users don’t have any issue. Issue only for few users. Could you please suggest what need to be check in this situation? Thank you!

        Reply

  2. Why is it that after installing Dynamic Environment Manager, in the management interface, open any tab, and the interface “does not show buttons”

    Reply

    2. One of the (very old) known issues mentioned in the release notes is that on some Asian versions of Windows operating systems, button text cannot be displayed.
      Does it work if you launch the Management Console with the “/NoScale” command-line argument?

      Reply

  3. We are seeing DEM taking forever to load on a users profile, it was fine but now random people get stuck waiting for DEM and can take 4 hours for it to log in. I have seen this in the logs of a user where it fails. Do you know what this means and what the problem would be?
    Error 1788 looking up group domain\group name – falling back to group’s SID
    It hangs for a minute on each one of these and when you have about 400 to check through you can see why its taking 4 hours to log in.
    However, some users log in and it goes straight through and finds the groups no problem.

    Reply

    1. Hi Graham,

      For most common Windows error codes we try to log a friendly message, but I hadn’t come across 1788 before. That’s “The trust relationship between the primary domain and the trusted domain failed.”, which should give you an indication how to troubleshoot.

      I’ll add a friendly message for this error code in a future release – thank you for pointing this out.

      Reply

  4. Carl,
    I am new to using DEM (we are still implementing). I use network locations rather than Mapped Drives. I have been trying to get these to sync but I am having no luck and need to redefine them at each logon. Do you have any suggestions on how to do this? I want the network locations to show up in Folder Explorer under My PC

    Reply

    1. Are you creating shortcuts in %AppData%\Microsoft\Windows\Network Shortcuts? Or are you running a script to create them?

      Reply

      1. I have a script that I manually run. It ends up creating short cuts in %AppData%\Microsoft\Windows\Network Shortcuts. These do not sync. I have also opened a session and just copied the shortcuts into the %AppData%\Microsoft\Windows\Network Shortcuts locations and I get the Network Locations to show up. They again do not sync, so they are not there when I reconnect. I want to also let you know that I am not an IT professional if any of this sounds like an amateur, it is with good reason.

        Reply

        1. Your DEM has Personalization settings configured? Do any of your Personalization configurations include %AppData%\Microsoft\Windows\Network Shortcuts?

          Reply

          1. Yes, I have Personalization settings configured.

            I have a configuration that I was using as a test that has [IncludeFolderTrees] \Microsoft\Windows\Network Shortcuts in Import/Export, but that does not seem to do anything. I have also tried to include %AppData%\Microsoft\Windows\Network Shortcuts in Folder Redirection. That did not work either.

  5. Hi Carl. Thank you for this detailed configuration. Is there a way to get SSO working for internal sites, or sites like O365 using DEM? I’m always getting prompted with login when I try to get to share point and other sites that work fine with my work laptop.

    Reply

      2. We have enabled Seamless SSO and tested to confirm it works on myapps.Microsoft.com, and it works, but I’m still prompted every where else.

        Reply

  6. Hi Carl! Thanks a lot for your work in this!

    I have the following question: How can I hide the local profile folders when I’m using Folder Redirection?

    When I click on the “favourite” shortcut of “documents” it shows me the correct redirected profile I made with DEM. But when I go to C:/users/user01 it shows me all the profile folder and they are local (not redirected to the File server) So when a user put any information there, it’s lost. How can I hide those folders?

    Thanks!

    Reply

  7. Hi Carl,
    We are using DEM on MS terminal servers (Vm’s)
    Currently we are using 10.1 (2009) without any problems on the W2016 vm’s
    When we upgrade to 10.2 (2103) al is working fine
    When we upgrade to 10.3 (2116) al is working fine

    When we upgrade to 10.4 (2111) at logoff nothing is saved to the VMware-UEM folder
    When we upgrade to 10.5 (2203) at logoff nothing is saved to the VMware-UEM folder

    When we remove 10.4/10.5 and install 10.1/10.2/10.3 all is working fine
    (same problem occurs when running the command manual)

    At debugging there is only 1 rule in the log:
    2022-07-14 12:30:12.433 [DEBUG] Skipping legacy path-based export

    Reply

        1. Hi MikeT,

          I got the same issue like you described. Old version 2106 works fine.
          Seems like Flexengine.exe -s is not supported anymore.

          I could see this issue in the moment only on our instant clone pool.

          Reply

          2. So if Flexengine.exe -s is not supported anymore what to use at logoff?
            {DEM 2206 (aka 10.6) has the same issues}

            Support Request is openen, but the response is very slow

          3. Look here –> https://docs.vmware.com/en/VMware-Dynamic-Environment-Manager/2206/dynamic-environment-manager2206-install-config.pdf

            –> Any logon and logoff scripts used to launch FlexEngine.exe can be removed.
            –> Run FlexEngine at logon and logoff Group Policy

            This is new. You don’t need a separate logoff script anymore. But this shouldn’t be an issue when still exist.

            I opened also a ticket at vmware why it doesn’t work on our pool. I have a remote session on Thursday.

          4. Hello Eric,
            Where you able to solve the case with het support of VMWare?
            Im sending them a lot of information all the time (logs, eventlog, procmon) but still did not find any solution
            Tested the 10.6 wit the same error results

          5. Hi MikeT,

            yes I could fix it (without VMware). It was my fault. I had a logoff task (in DEM) which never finished because I cleaned up to much in my golden image 🙁 . So after disable this DEM task everything works like before the upgrade.
            I didn’t change my GPO settings but I inserted the newer DEM GPO bundle to my domain.
            If you like we can get in touch.

          6. Hi Eric,

            I think we did all that.
            We never used a script only GPO login/logoff.
            Would like to get in touch. (but how)

          7. Found the solution together with the VMWare team.
            In the past Drive shares (in GPO) where working: Z:\VMWare-UEM
            After 10.4 (2111) release this is not working anymore.
            Now using UNC-paths is mandatory: \\Server\User\VMWare-UEM

  8. Hey Carl!
    Maybe you know this from the top of your head: isn’t a bookmark from Microsoft Edge browser synchronized automatically along with the profile data?

    I have a couple of servers users can connect to (5 in total). If you store a new bookmark, log off, log on again to a different server that bookmark does not exist, only if you come back to the server previously connected to …

    In an earlier reply (https://www.carlstalhood.com/vmware-user-environment-manager/comment-page-2/#comment-14388) you mentioned community provided solutions (= templates). Sorry to ask to bluntly, but where do I find these or how are these implemented? I just realized after more than two years of working with a basic DEM setup I’ve never done this before. Thank you very much for the blog!

    Reply

      2. Hi Carl!
        Not that it would be super interesting, but as this is really a very basic task I created both a log on and a log off task and file copied the “bookmarks” file from Edge to the user share and back – so it’s being synced automatically when logging on or off. This was the nicer approach (for me) as it absolutely doesn’t create any overhead.
        In case anyone is interested the file location is this: %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarks

        Reply

      3. Carl, I followed the instructions from VMware and the only hangup I have with Edge Chromium is getting Extensions to install. Is there something else that needs to be done to allow this?

        Reply

          1. Yes, I went back and tried these instructions once again with the same output. When trying to manually install extensions, I get the error “Could not install package: ‘COULD_NOT_GET_TEMP_DIRECTORY'”

          2. Try running procmon which reproducing the problem to see what is missing.

          3. Are you using profile disks, like FSLogix? By default, %temp% should be located on the C: drive instead of inside the profile disk.

            What does %temp% resolve to?

  9. I have an application called chrome that is rolled out to all users through DEM.
    I want to make changes to chrome to exclude some file paths.
    How do i create a condition that only roll it out to me?

    Reply

    1. Personalization items have a Conditions tab.

      You might have to delete your existing Chrome .zip file so a new file is created with your new exclusions.

      Reply

      1. If i want to make changes to chrome, there must be a better way rather than deleting the existing chrome.zip file and creating a new chrome.zip and rolling that out to production.
        What happens if the new chrome.zip breaks production.How would you roll back to the chrome.zip that worked before?
        what is the best way of testing new changes?

        Reply

        1. You can probably rename it and then rename it back to restore it.

          If you are adding exclusions, then I’m not sure how that affects existing profiles that never had the exclusion. If DEM recreates the entire .zip file at logoff, then the new exclusions might apply at next logoff.

          Reply

  10. Hey Carl,
    thanks for all the efforts and time put into your blogs here.

    VMware Horizon Cloud on Azure
    DEM 2111
    Simple ADMX Template to set Desktop Wallpaper

    Things are working well, but there are a handful of DEM policies that are not applying.
    Flex Engine Log states: ADMX-based settings were not (fully) processed successfully

    This leads me to the situation where enterprise User-Based GPOs are already being run using a particular ADMX template.

    My DEM policy
    is trying to set Desktop wallpaper as well but based on particular environment variables. Well, the Conditions are working great, but the Wallpaper is not applied most likely due to a conflict with an existing enterprise User GPO using this same ADMX Template.

    I tried setting loopback to “replace” instead of “Merge” but didn’t seem to help.

    Not sure if I have options, or if I need to try to Re-architect the existing AD enterprise GPOs (which may be difficult).

    Any Way that DEM can overwrite, or take precedence over existing ADMX GPOs in my VDI environment?

    Reply

      1. Wow… Thank you so much for the reply. I can’t believe I did not come across this setting already. I am glad I don’t have to look at any current state active directory re-architecture. Really appreciate the time and quick answer

        Reply

    2. Hi Kevin,

      As of 2111, DEM has an advanced “Override existing user policy settings” configuration setting that does exactly what you’re looking for.

      Reply

  11. Hi Carl, thanks for this blog, enjoyed it for years

    have you ever seen it where DEM is missing certain things, such as i cant find my ‘import templates button ‘ in this new instance i installed
    https://ibb.co/brsvv9D

    I just want to add in some onedrive admx files

    Reply

    1. I think they removed that feature from the latest release. You might be about to go to VMware Communities and search for a DEM configuration file.

      Reply

    2. Hi Paul, the screenshot you showed is for the Standard Edition, which only supports a subset of the features. ADMX-based settings are only available in the Enterprise Edition.

      Reply

  12. quick and possibly dumb question. Where is the DEM install taking place? the connection server, fileshare server, or the golden image

    Reply

    1. The DEM Agent goes on the gold image.

      DEM Agents get their configs from a group policy and a file share.

      The DEM Console can be installed on any administrator machine. The DEM console creates configuration files in the file share. There’s no DEM Server.

      Reply

  13. Hi Carl, i’ve got issues with the Logon Tasks in the User Environment in 2111. I’m able to create a subdirectory on the systemdrive under certain conditions, but not to start a browser application. Is this because it’s not possible to start any “interactive” application within a Logon Task, or am i missing certain settings? If it is not possible to start an application with the Logon Task, are there any alternatives?

    Reply

  14. Hi Carl,

    With DEM 2106, you were able to execute the logoff script while the user was still logged in. This was a seamless way to troubleshoot strange issues with settings not persisting, etc. The previous script was “C:\program files\immidio\flex profiles\flexengine.exe” -s. In 2111, I can not figure out how to invoke this logoff script to be sure DEM writes to archives properly. Have you run into this?

    Thanks

    Reply

  15. Hi Carl,
    thank you for all your valuable work.
    There seems to be a configuration option in DEM 2111 where DEM settings configured using ADMX actually overwrite Group Policy configuration. Based on
    https://docs.vmware.com/en/VMware-Dynamic-Environment-Manager/2111/com.vmware.dynamic.environment.manager-install-config/GUID-9843478C-9B1D-42DA-9966-0EF79D7109D1.html
    we could create reg key AllowAdmxOverride and set it to “1”.
    Did you have a chance to experiment with that?
    i can’t figure out if that can be set by individual DEM setting, or is it global setting where either DEM or AD always “wins” .
    Do you have any thoughts?
    thank you

    Reply

  16. HI Carl
    Can we use DEM to backup Drive as full disk, Is this possabile , or can we did it on App volume, we are in new vdi enviroment and we need to Backup D Drive for all client and we have both app DEM and App voulume?

    Reply

    1. Can you write logoff/logon scripts to backup and restore?

      Another option is to give every user a persistent desktop.

      App Volumes Writable Volumes will save changes to C: drive.

      Reply

        1. Persistent disk is gone from Horizon 8.

          There are other disk-type profiles like FSLogix Profile Container, VMware App Volumes Writable Volumes, etc. Liquidware has Profile Disk. But these save C: drive, not D: drive.

          Reply

  17. Hello Carl,I have a query with regards to DEM and FS logix . Actually both solutions are working in my setup . Fs logix is used as profile container where endusrs files, docs and applicaton setting are contained and DEM is for application Personalization and other features. So can i manage profile container through DEM so that i can discard FS logix in my environment.

    Reply

    1. You usually do DEM Personalization, or FSLogix Profiles, but not both. Pick one or the other. I personally think FSLogix has faster logins and less maintenance than DEM Personalization.

      Reply

  18. Hi, thanks for the article… always useful stuff.
    I’m facing an issue in RunOnce … I configured a logon task which I need it to run once only… I added RunOnceSpecial after RunOnce but still every time the user logs in it runs 🙁

    can you advise

    Reply

  19. Thanks for the document. Request you to help me with document for setting up “Roaming Profile’s” in DEM VMwae Horizon View.

    Reply

    1. I recommend FSLogix instead of DEM Personalization since FSLogix is faster login and easier to configure. Otherwise, you configure DEM Profiles on the Personalization tab.

      Reply

      1. Hey Carl,
        Would you agree that if you are using the FSLogix Profile piece (aside form just the Office piece) that it pretty much negates the need for the “personalization” tab in DEM (Unless some old app writes outside the profile and needs a custom setting)? As the FSLogix Profile keeps everything (unless you also use the office container separately to separate the Profile/Office bits) there is no need for the basics that the Personalization tab offers.

        You can then compliment the FSLogix profile with the User Environment tab to provide customizations to the user’s profile.

        As always, great blog and info!

        Reply

  20. Hi Carl, we’re looking at the option of using DEM (standard) in our environment. Am I missing something or are the “triggered tasks”, “files and folders” (and other) options not there? It has some default settings (e.g. desktop shortcuts and a locked screen triggered tasks) that I wanted to remove but can’t find the option for them.

    For example, I can only see “Drive Mappings”, “Folder Redirection”, “Logon Tasks”, “Logoff Tasks” and “Printer Mappings” in the User Environment menu – which is listed as the options available to standard users here: https://docs.vmware.com/en/VMware-Dynamic-Environment-Manager/2103/com.vmware.dynamic.environment.manager-adminguide/GUID-E6C0325B-5DC8-4CAB-955B-8CD1BD52537F.html but how do I go about removing the default options put there by DEM?

    I’m probably missing something really obvious but if you know that would be great.

    Thanks.

    Reply

  21. Hi Carl

    Can I upgrade from UEM 9.6 to DEM 2103?

    I followed the sequence to first upgrade the Engine followed by Console, after that the Engine won’t run at all.

    I reverted back to snapshot and also, when I run the install wizard the second time to upgrade the Console it won’t give me an option to upgrade, what I get is ‘change’ , ‘repair’ and ‘remove’, I selected ‘change’ and enable to install the Console after which I rebooted and on the login to that machine I don’t see the Engine starting up.

    Any ideas what to do here please?

    Reply

  22. Hi Carl, We are struck while doing the initial stage of config share to the UEM console, can you guide us what was the issue we followed all as per above for DEM,

    I am getting error saving configuration file message,.

    Reply

  23. Hi Carl – can I upgrade from UEM 9.6.0 to DEM 2103? or has to be staged upgrade?

    is this the order:-

    1. Flex Engine
    2. Management Console
    3. and update ADMX templates

    also, would that work with Horizon 7.7

    Reply

  24. Hi Carl,
    I’m using DEM 2103 and Horizon 7.12. I’m having an issue with a triggered task at session reconnect where the “Horizon Client Property – Client Location = External” is set and a batch file should be ran.
    It looks like this condition is not picked up until later in the reconnect. If my initial logon location was “Internal” and I disconnect and reconnect to my session from “External” the triggered task does not run.

    Do you know of a condition that will pickup the gateway location change at reconnect and run the triggered task?
    Thanks for your time.

    Reply

    1. I saw a similar problem at a customer but I can’t remember how it was fixed. Do you have a Triggered Task to do a User Environment Refresh?

      Reply

      1. I have a triggered task to refresh smart policies, but no other options are configured in that task. The other one I’m trying to run is a custom command at reconnect.

        Reply

  25. I guess that the only thing the support tool for dem are doing is delete the files under the userprofile that are created for the that user?
    Correct?

    Reply

  26. does the FTA configuration let the user choose what the default application be or does the admin assign which application to use? Cause maybe for broswers the user prefer to use firefox instead of chrome.

    Reply

    1. DEM can save the user’s FTA preference.

      If you use SetDefaultBrowser.exe or SetUserFTA.exe, then the administrator is specifying the FTA.

      Reply

      1. Thank you for the reply. So I don’t need to do this configuration to let the user pick their defaults? I was looking into that setuserfta because they were never saved when the default browser was changed by the user.

        And I noticed the dem doesn’t save all the roaming for Microsoft. The folder redirection saved a few things in the appdata\roaming\Microsoft folder but not everything in the folder? Is there something extra thing I have to do in dem to redirect the entire folder? Cause it seem to redirect all other folders in roaming directory.

        Reply

  27. Hey Carl, Wondering if you have any recommendations when deploying Horizon View with DEM Shares on Nutanix HCI. Any experience with Nutanix Files or DSFR on Nutanix for the share? trying to figure out what would work best in a new deployment as we build it out.

    Reply

    1. Nutanix Files has a Distributed Share feature to spread the file activity across multiple file controllers.

      My preference for roaming profiles is Microsoft FSLogix and Nutanix Files handles FSLogix very well.

      Reply

  28. Hello Carl. Can you help me? I enable parameter “Show UEM logon and logoff progress information” in GPO, but when I log on as client, I don’t see any progress information. Maybe you know why?

    Reply

  29. The default templates (Office, Adobe Acrobat, Notepad, etc…) are working without issues but when I try to use config templates downloaded from VMware (Firefox, Chrome, etc…) they are not working at all.

    What could be the issue? Have I to make any extra configuration with these dowloaded templates?

    Thank you!

    Reply

  30. Hello,
    Thank you for your great work, very useful !
    I have a question about DEM, in particular the “Import/export” part in “Personalization”
    A path like…

    [IncludeFolderTrees]
    \AppData\LocalLow\Sun\Java\Deployment

    …doesn’t work !
    i need to roam some data from the LocalLow folder and subfolder.
    but after logoff, this mentionned data isn’t roamed in the same path than the original path ! but it’s present in the archive folder !

    The common windows settings like:
    “Taskbar” or “Start menu” in the “import/export” works very well, i find roaming data in the userprofile.

    In the FlexEngine.log everythings seems to be ok, apparently no error.

    Import status flag indicates success, so performing export
    2021-01-07 12:07:15.563 [DEBUG] Clearing import status flag for next import
    2021-01-07 12:07:15.586 [INFO ] Exporting profile using config file ‘EDV-roamAppdata.INI’ (\\LesRP.ch\vdi\UEM-config-EDV\general\EDV-roamAppdata.INI)
    2021-01-07 12:07:15.589 [INFO ] Exporting file information
    2021-01-07 12:07:15.589 [DEBUG] ExportFiles: Recursively processing folder ‘\AppData\LocalLow\Sun\Java\Deployment’
    2021-01-07 12:07:33.771 [DEBUG] ExportFiles: Processing file ‘\AppData\LocalLow\Sun\Java\Deployment\deployment.properties’
    2021-01-07 12:07:33.771 [INFO ] Exported file information successfully

    I open a case to Vmware, but no idea for this moment

    Any idea

    Thank you

    Daniel

    Reply

      1. Hello,
        Yes i already tried, but doesn’t work
        Sorry in my first post i write “\AppData\LocalLow\Sun\Java\Deployment” it’s a mistake

        but i meant…

        [IncludeFolderTrees]
        \AppData\LocalLow\Sun\Java\Deployment

        [IncludeFiles]
        \AppData\LocalLow\Sun\Java\Deployment\deployment.properties

        These two paths doesn’t work !

        and for example, below these paths works !

        [IncludeFolderTrees]
        \Microsoft\Internet Explorer\Quick Launch

        Reply

          1. I think WordPress treats the < and > as HTML tags. You can change the < to & lt; (without the space) to preserve them.

  31. Hi Carl,

    I have configured a DFS-N share for DEM Profile and Config files (Mesh Topology). I am not using DFS-R, since it only be used for the configuration share, and – if used – must be configured in hub and spoke topology.

    The storage for DFS-N is being replicated using the storage array at the backend on hourly basis (NetApp). I have two Windows files servers one at each site.

    Do you think I am missing anything? thanks for all the help

    Reply

    1. Do you have two active sites? Or is this just for DR?

      For DEM Config, you can simply robocopy the files between file servers in each site.

      For DEM profiles, I prefer to pin users to specific sites and have their data only in that one site. If that site dies, then have a VM backup/restore method to restore that site’s file servers in a different site. No DFS needed.

      Reply

        1. Are you doing “home sites”, which is recommended? If so, then configure the Horizon Agent machines in each site to use a file server in the local site. Then backup/replicate/restore the individual file servers instead of using DFS Replication.

          Reply

          1. Wow, the plan was to have configurations done on one site replicated to the other site as active/Active.
            In this case, it looks like we have to go the HUB and Spoke model, but am new to this so still try to figure things out, and confused as DFS-R is not supported in certain DEM configurations.

          2. For DEM configurations, just use robocopy to copy them to a file server in each site. This lets you avoid DFS Replication.

            For DEM user settings, it’s important that you never allow the files to be updateable on two file servers at the same time and expect them to merge the settings. Only one file server should be writable. An easy way to ensure this is to only have one file server and rely on VM backup/replication/restore instead of DFS merge replication.

  32. Hi Carl,

    how can we prevent that DEM is working on Administrator account? In the NO-AD Mode you can configure it in the .xml file. Is there a way to do it in GPO mode?

    Reply

      1. Or just target your DEM GPO in such a way that it does not apply to admins? In my understanding (but I’m a developer and not an IT pro 🙂 that’s pretty common, no?

        Reply

  33. Hi Carl,

    We are using VMware Horizon 7.12 and DEM 9.11 with dedicated linked clones. We also have Microsoft FSLogix. We are seeing a strange issue where DEM does not apply any settings after a desktop is restarted. It does not create any logs as well. After a login, if we logoff from the desktop (not a reboot), it start working from the next logon onwards (it also starts creating logs). Again if we reboot, it worn’t work just after the reboot until we logoff again.

    This is the exact issue mentioned in the comments of the thread Let’s troubleshoot User Environment Manager (#UEM) 9.X: How to avoid errors during the installation – vLenzker by TJ Derrick. He resolved it by setting the GPO “System\Logon\Wait for network” but we have installed DEM in NoAD mode, so I don’t this this setting will make any difference.

    Any thoughts on why this strange behaviour?

    Reply

  34. Hi Carl,
    Thank you for your great article !

    I have a little problem with DEM 2006, in the DEM console i can’t see the “ADMX-based setings” feature in the USER ENVIRONNEMENT tab
    Any idea
    Thank you

    Daniel

    Reply

      1. Hi Carl!
        Great Job!

        Is it possible that only the enterprise edition had this featuers?
        We got the the Sandard Editon and dont have the ADMX-based settings, also the Flex Config Path Option is called “VMWare DEM Agent Configuration” ?
        Is that the difference between standard and advanced?

        regards

        Reply

  35. Hi Carl,
    Vmware techzone article removed the mandatory profile recommendation that they had earlier so do you have any recommendation on how profiles should be configured now ? Also, since we started using local profiles login times became went from 40 seconds to 3 minutes when login through horizon client but the weird part is when I tried to login using vsphere client it was still around 40 seconds. Not sure why such a huge difference. I couldn’t find anything like that on online blogs so I am wondering if you ever encountered something like this. Thanks.

    Reply

        1. First time login seems to always takes a few minutes. Your faster login might be because the profile was already created on the machine and it didn’t revert (go away) at reboot.

          Reply

    1. They’re just files. You can copy the folders/files to the other data center, share it, and point DEM console to the new path.

      In DEM Console, click the star icon to configure environments and switch environments. Many screens have an Import button where you can import a config from a different environment.

      Reply

  37. Hi Carl
    thanks for the post ,
    I run into situation in our VDI environment , where user save settings on Office 2016 application , part of the setting are saved on the DEM-USER share appdata folder and some of them are saved on the local hard drive of the VDI machine (therefor erased upon logout since it an instant clone pool)
    where in the DEM manager can it be fixed

    Reply

  38. Hi Carl,

    I am new to DEM. I using VDI environment. I log into my VDI and map my network printer. But when I log out and log back in the printer disappeared. I have to remap the printer again everytime. I am using Horizon 7.12.

    Reply

    1. In DEM > Personalization ribbon, did you add a configuration file that saves Network Printers? If you Create a Config File, select Windows Common Setting, and Printers is an option.

      Reply

  39. Hi Carl,

    Great articles, we have recently implemented Horizon 7 in our environment, most things seem to be working fine but I find that users appdata or profile for Chrome and Outlook does not save after users log out and log back in. It keeps on resetting the profile data (i.e. Outlook and Chrome would need to run initial setup / welcome page and never saves anything including bookmarks created each time you log back in). Is there a way to fix this in DEM or fslogix will need to be setup?

    Thanks!

    Reply

    1. DEM requires per-app configurations of what to save at logout. It takes time to configure it, test it and fix it. There are templates in the VMware Communities for common applications.

      If you think it’s configured correctly, then enable debug logging using the FlexDebug.txt file to see if DEM is properly saving and restoring the .zip files.

      FSLogix is “set and forget” since it captures the entire profile. There’s no need to configure it for each application like you do in DEM. However, FSLogix has difficulty with concurrent access to a single profile.

      Reply

  40. Hi Carl,
    We are trying to implement office 365 on windows 10 1909 with DEM. Can you help us with the sample DEM configuration by which we can activate Office 365 and also able to persist outlook profile. Thanks.

    Reply

      1. Thanks Carl, But is it the recommended way to provision Office 365 to Horizon instant clones ?We are trying to install office 365 base components on the master image and appstack Viso and Project so we can assign them only to the users who need them. Thanks.

        Reply

        1. I usually put all Office components on the base image to avoid licensing issues. You can use NTFS permissions to control access. Or FSLogix App Masking can hide applications.

          Reply

  41. Hi Carl,I have a legacy application which requires details of VDI client session hostname to function.The application requires an ini file updated in VDI session with vdi client host machine hostname every-time I switch host machines. For example if open vdi session on “thinclient01”, C:\app.ini is updated with {hostname = thinclient01}, if I move to another office on “thinclient99”, c:\app.ini is updated with {hostname=thinclient99}. The user does not logout. Can this be archieved using DEM.

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *