For anyone who has worked with XenApp or XenDesktop you know that user profiles can be one of the things difficult to get right. This was one of the driving forces behind Citrix, including a profile management solution as a standard component of all editions of XenDesktop.
I will not go into details of the various types of profile strategies, nor why a more robust strategy that standard roaming profiles is necessary. The need for a more robust solution than standard roaming profiles is already well understood and documented. What I will cover in this article are some best practices for configuring correctly the Citrix Profile Management solution. The objective of this article will configure Citrix Profile Management for Non-Persistent Windows 7 VDI workloads.
Too often, I went on projects with customers, partners and co-workers where our Citrix Profile Management solution has been installed and activated simply. It seems that many people think that the simple installation and activation Citrix Profile management will correct or improve their user profile. However, this could not be further from the truth. In fact, if you simply install and activate profile management with the default settings, all you have basically done is give you a roaming profile. In fact, many times you'll actually did worse things than standard roaming profile!
Folder Redirection
At the heart of any good strategy profile folder redirection. This is a standard Microsoft functionality that was fully supported via Group Policy since the days of Windows 00 and even something that was done by changes in custom registry since NT 4.0 Terminal Server days. Folder redirection is really the key to any successful profile solution. Whether you use roaming profiles standards, Citrix Profile management or a third party solution such as Flex or AppSense profiles, you must still enable folder redirection.
With Windows 7 Microsoft has significantly improved the Folder Redirection engine to include more files. By default, you can learn to redirect the following folders by using the Group Policy loud engine in Windows:
- AppData (Roaming)
- Contact Us
- Bureau
- material
- Downloads
- Favorites
- links
- music
- pictures
- Saved Games
- research
- Start Menu
- videos
As part of any well-designed profile solution, you must beredirecting all the listed files below -above. The only exceptions that should be made are folders that you not intend to persist for the user. For example, some companies have no desire to allow users to keep the saved games, so in that case you would not redirect the folder Saved Games and you want to add a policy to exclude the saved games folder synchronization or roaming . By doing this, the Saved Games folder exists only on the local virtual machine if the VM is not persistent, it would be blown logoff / reboot.
One thing you want to make sure you activate your folder redirection policy is the parameter to move the content to the new location. Capturing screen below shows the settings I recommend customers to select with folder redirection.
folder Exclusion
Adding a policy to exclude unwanted files or redirected homelessness or the timing is a common thing that is often overlooked. When using Citrix Profile management, there is a GPO that can be specifically configured to block profile folder synchronization. You should be adding all redirected folders to the list of excluded files and you must also add at least the following folders to the exclusion list "AppData Local", "AppData LocalLow" and "Local Settings "[
Why a case should be excluded if it is redirected? It must be excluded because you can still end up with orphaned files that remain in the profile after the redirect. In addition, very often poorly coded applications will always write to the non-redirected path, causing bloating profile. This is seen quite often, when the hard code a programmer to a path using% userprofile% instead of reading the value of the shell folder.
I can not count how many times I have seen a programmer hard code their application data path as
% userprofile% Application Data CrappyApp
If a hard codes developer using the% USERPROFILE% variable, then it does not matter if AppData was redirected, the application will always write to the local profile folder
Qu 'is what to do is the code for their application to use the% AppData% variable as follows :.
% AppData% GoodApp
by adding an exclusion rule for "Application Data" and "AppData Roaming" you will prevent these evil coded applications bloating profile.
a reminder, you must redirect folders in the default Microsoft GPO and you should be out ALL the profile folder synchronization. Doing this will keep your profiles pretty small, thus improving performance and reducing significantly IOPS.
Application Data
I know what some of you are already thinking, redirecting AppData can cause problems with some applications. Furthermore, with an exclusion rule to kill data written to% userprofile% could cause personal settings of the users to lose. Face it, if an application is coded correctly or not, users want their personal data applications persist between sessions. There are easy ways around these issues; File / inclusion lists of files and application streaming. Lists Let us first how the inclusion lists can answer some of the issues AppData.
folder and the include file
We'll pretend we have an application called CrappyApp. The application developer has the coding error recruit hard "% userprofile% Application Data CrappyApp" the folder where user application data is stored. By redirecting the AppData folder and adding exclusion rules to prevent "% userprofile% Application Data" of homelessness or synchronization profile, all data that application writes to the "% userprofile% Application Data "directory will be lost when the user logs off. If you do your job as an IT professional, you will identify this issue during testing before deploying to production. If you do not catch it, it will not be long before users call and complain that their CrappyApp settings are not saved between logons. This is actually a good thing, because now you know you have a poorly coded application. This means you can open a ticket with the application vendor or with the programming team if an internally developed application so you can get them to correct. I ran on this issue repeatedly with applications 3 e of the party and with applications developed internally by my clients. After explaining the situation to the programmers, they often recognize their mistake and fix it. If they fix or patch will take too long, simply to conduct an analysis to determine which files are written in "% userprofile% Application Data CrappyApp" and that these files must persist. If the directory is small and does not contain a lot of data, you can create an inclusive strategy to add the file folder CrappyApp Back to profile for synchronization.
If the file is large and has many files in it, then you should take a close look and understand exactly what the demand is currently writing and if it really needs persist or not. Since we already know that it is a poorly coded application, it is often not surprising to see the temporary files and other junk being written in the file that does not really need to persist. Often you will find that there is a small DAT file or some INI files that contain all user customization settings that are important. In this case, you must create file synchronization rules that copy the necessary files back into the profile. This can be accomplished by using wildcard rules to synchronize "Application Data CrappyApp *. Dat, * .ini". Adding only the required files via Back to profile synchronization, we allow poorly coded application settings persist, but we always keep the small profile.
An application that needs this type of synchronization is Google Earth. Google Earth writes its data in the "AppData LocalLow Google GoogleEarth". By default, local folders and AppData AppData LocalLow automatically exclude Microsoft roaming profiles and we should also add these files to be excluded from the Citrix Profile Management policy. Microsoft calls the "local" files for a reason; they should not be the default network! Google Earth it will store the cache files and other temporary data here. The cache file is quite large and contains temporary data that should not persist and no. However, Google Earth also stores user My Places and KML files in this directory. These are small XML files with user personalization settings which should persist. So, if Google Earth is used, we add a file inclusion rule for "AppData LocalLow Google GoogleEarth *. Kml" so that these files remain without synchronizing or roam the entire directory. This allows the user happy and keeps low profile.
In addition to Google Earth, there some key features of Microsoft who need this synchronization as well. These include PKI certificate exchange and toolbars. For more information on the file and the file inclusion rules required for these features refer to the following items CTX:
http://support.citrix.com/article/CTX130665
http: // support.citrix.com/article/CTX124948
streaming app
now that we dealt with applications that do not put their data in a folder redirected by default, what about applications that do not like to have their AppData folder redirected to a network share? Sometimes the application crashes or just does not work properly when the AppData folder is on a UNC path. Older versions of Adobe products are known for this. On a positive note, I can say that over the past two years, this problem occurs less and less. Most major applications providers are now familiar with the AppData folder redirected and they code and test their applications against this scenario. It is now very rare that I encounter this problem. However, there still occurs. I recently met a Java application to a client that fails every time it was executed with a redirected AppData folder. So how do I overcome this problem? Enter Citrix Application Streaming to the rescue!
By virtualizing or application with XenApp, we are able to isolate the application and issue new locations of variables and path when the application is launched. It is import to note that I am referring to the streaming feature of XenApp applications where the application is still running on the Windows 7 virtual desktop. I do not mean to host the application on a XenApp server.
So how application streaming for help in this situation? When Streamed application is launched, we can specify a pre-launch script running first. By changing the AppData isolated location in a pre-launch script, we can change the location AppData for continuous application without affecting other applications.
For example, I profiled the application suite Office 03. Probably not the greatest application to use for this illustration since Office 03 is fully compatible with redirected AppData, but I'll use it when even.
The display properties of the streaming application profile, you can assign a pre-launch scenario. Since we only want to change the location for our AppData streaming application, it is important to run the script isolated. See the screenshot below:
As you can see from the screenshot, I mentioned that setappdata.cmd script appointed will launch in the isolation environment before any application. Profile are launched
Below is my script:
my script actually calls another script that I hosted on a server files. The reason I did it is so it is easy to make updates to the script. Every time you put a script in a streaming application profile, it can be cumbersome to change the scripts. So, as a best practice, your script simply calls a master script from a shared location so that if updates are required, you do not need to open and edit the streaming profile. For more details on this see Joe Nord articles in blog about scripts:
/ blogs / 2011/01/21 / app-streaming initiation to Scripts- /
/ blogs / 2011/02 / 04 / app-streaming global-scripts /
If we look at my script on that file server is called, you will see it launch a VBS file.
Now, look at the VBS file that does the real work
VBS script defines four registry keys in the isolated register the application :.
- It defines two shell buttons AppData folder to point back to AppData% userprofile%
- It defines two variables% AppData% Environmental Return to% userprofile%
what we did with this script is basically fool the streamed application into thinking the AppData folder has never been redirected.
So now we will see in action. Capturing screen below shows my desktop Windows 7 non-persistent with Streamed copy of Word 03 running with my scripts before launch. How to choose Open from the File menu and enter% AppData% as the directory to open.
As you can see from the screenshot, the AppData variable for Word 03 resolved to% userprofile% AppData Roaming, which is on C :. drive
another way to see where the AppData variable Streamed decides the application is to launch a command prompt for Streamed application. With Word, you can make it through the backdoor by creating a hyperlink to cmd.exe. Capturing screen below shows.
I run CMD prompt the instance Streamed Word so that prompt CMD would also isolated. Note how the variables point to AppData user profile path on C :. Player
Now look what happens when I run a CMD prompt local operating system outside the isolation environment:
as you can see from the screenshot above screen, the local operating system is still using a redirected AppData folder. By using our pre-launch scripts, we were able to redirect AppData successfully return to the local C: drive without affecting other applications
Because, by default, we should exclude% userprofile% AppData Roaming profile synchronization, everything Streamed application writes here will be lost at logoff. However, as we discussed in the previous section, if the files or folders that are written that you want to persist for the user, then you can simply add a synchronization rule so that this data is stored for the user.
As well take advantage of application streaming and synchronization rules / file that I have described here, there is absolutely no reason that you should avoid the redirect AppData. Compatibility problems you encounter with redirected AppData can easily be overcome!
Before proceeding, I would take a second to answer some of the concerns that people raise about the performance of the application when the AppData redirect to a network path. First, let us remember that we are talking about virtual desktops running on a hypervisor. In this scenario, the file share that is used for the AppData folder redirection must be located in the same datacenter and must be strongly linked to virtual desktops. If you are a large company, there is no excuse for connecting your file server or NAS to the network within 10 Gig or at least with multiple aggregated links 1 Gig. When you properly design your file services infrastructure, you will not have performance issues. To put things in perspective, we use Provisioning Services to provide the entire C: drive to the desktop of Windows 7 on the network from a Windows server. When properly designed, nobody complains performance issues with the whole C: drive mounted on the network. In fact, I am a customer production hosting the C: drive to 1500+ concurrent Windows 7 VDI VMs from a single Windows Provisioning Server VM, and there are no performance issues. See the following article:
/ blogs / 2011/07/30 / virtual-provisioning-server-% E2% 80% 93-a-success-real-world-as /
so, if you are experiencing performance problems redirecting some files to AppData over the network to a Windows or NAS, you do something wrong
streaming profile and active Write Back
streaming profile is a function where the files that are part of the profile (files and folders redirected PAS) are copied down, either in the background or when actually accessed by the operating system or applications based on the needs. This can speed up the logon process. This can also reduce the total volume of data downloaded because if a file is not actually used, then it is not completely copied to the local profile folder
This has some value. However, I see too often used as a crutch for bad architected profile management policies. As we discussed in the previous sections, you must redirect all available records, including AppData. If you follow the guidelines I Installed, UPM your profile directory will be quite low. In fact, if you have implemented correctly Profile Management, UPM your file will most likely less than 10 MB.
Here's a screenshot of what you should see in a profile folder UPM properly configured.
Note how there are only 14 files, 27 cases and less than 1.2 MB of total data in this folder UPM. Indeed, all the folder redirection and exclusion rules were properly implemented. In this example, the user of the Google Earth KML files and PKI certificates that must be backed up / synchronized and AppData the profile folder is still extremely low!
As discussed, when you have bad applications or applications that are coded does not work properly redirected AppData, folder and file inclusion rules will cause the AppData folder in the profile to become UPM larger. I'm actually a production user on one of my client systems where I spend a lot of time helping locally with their implementation. Needless to say, I have correctly implemented the management profiles and application streaming in the XenDesktop environment. As part of my normal job functions, I use Internet Explorer, Adobe Reader, Outlook, Word, Excel, Lync, and many other applications. I have PKI certificates for email and the website identification and many other things in my profile. For my profile, what is almost a year and used on an almost weekly basis, my UPM directory contains 67 files, 71 cases for a total of 5 MB of data. 5 MB for a profile that is used regularly and almost a year is excellent! In the most well-designed environments, the UPM profile should rarely exceed 10 - 15MB. This is such a small amount that it should be of no interest from the perspective of opening / closing.
So using me as an example, do you think I should activate the profile streaming? The answer is no! Why should I care about 5MB Loading file data to login? This will not cause performance issues whatsoever. So if you have designed and implemented a management profile, the streaming function will be of little value and is not necessary.
That being said, there are certain limited situations where even with a well-designed management environment profile, you can still get some value from the function of a streaming profile. As discussed, if you have an application that is badly coded or incompatible with AppData redirect, you need to add file rules / sync folder to allow some specific AppData folders to synchronize the logon. If you end up with an application that writes a lot of data that needs to be synchronized, the function of a streaming profile may reduce the logon time and can reduce the total amount of data downloaded from the data will only be downloaded on request when the application actually tries to use the files.
If you run into this situation, so feel free to activate and use the function of a streaming profile. One of the cool things about this feature is that it can be enabled for only specific groups of users. So rather than unnecessarily light for everyone, when you have an application that can benefit from it, you have to put users in a group and only enable the feature for them.
Enable Write Back functionality should be seen in the same light as the characteristic profile streaming. If profiles are large, it can add value. However, if you have implemented a management profile correctly, then your profile should rarely more than about 10 MB of data to be transferred to the session closing, Write Back actively is usually not necessary.
Political Base Line
now that we've covered the basics of what you should redirect and profile management configuration, I thought I would give you GPO sample with the basic policy settings I configure with regard to the management profile and folder Redirection. For simplicity, I rolled all in one GPO. Of course, they would need to be adjusted and modified to be specific for a given production environment, but it will give you a good idea of what you need to set as a baseline.
You can download the report GPO HTM from the following link:
https://citrix.sharefile.com/d/sd561c6331d24ff9b~~number=plural
additional references
Make sure you rename the INI file defaults after installing Citrix Profile Management. You should be controlled by UPM Group Policy and not let the unknown parameters to be applied via the INI file. You will find the INI file at:
"% ProgramFiles% Citrix User Profile Manager UPMPolicyDefaults_V2Profile_all.ini"
Do not forget to activate and add the Cookies folder to files Mirror for policy and allow the processing of cookies to log off. See the following for more information:
/ blogs / 2011/01/25 / management letters-of-sync-Internet-Explorer-cookies-using-profile /
http: // support.citrix.com/proddocs/topic/user-profile-manager-sou/upm-manage-cookies.html
If your users with Outlook PST files, make sure you create policies that force the PST go to the redirected AppData folder. This keeps the PST on the profile and eliminates the need to try to synchronize PST file when connecting or disconnecting. You should not use synchronization Citrix Profile management or feature streaming profiles with PST files. With the release of Outlook 2010, Microsoft fully supports placing the PST on a CIFS share highly connected. And even if it is not "officially" supported, I have clients who have been successfully placing the PST files on CIFS shares strongly connected from the perspectives XP / 03 days without problem.
I hope you find this article useful and it helps you make the most of Citrix Profile Management
Update - August 5, 2012 :! I have had many requests to go more in depth on how to architect and large-scale file services for Citrix Management Profile and Folder Redirection, so I decided to take a three-part series. You can find part 2 on the link below:
/ blogs / 2012/08/05 / citrix-profile-management-and-vdi-do-it-right-hand-2 /
Cheers,
Dan Allen
0 Komentar