Implementing VMware Dynamic Environment Manager: Manage, Administer and Control VMware DEM, Dynamic Desktop, User Policies and Complete Troubleshooting

By Peter von Oven

Implementing VMware Dynamic Environment Manager is the definitive guide to installing and managing end-user desktop environments using the VMware Dynamic Environment Manager solution and tools.

To begin with, you will be able to explore what environment management is, and why you need it in your business infrastructure before discussing the VMware solutions. You will quickly get speedy with installing and configuring the DEM in real-time, using screenshots, and step-by-step directions. You will then be able to explore how to manage end-user environments, wherein you can focus on personalization, configuring the end-user environment, and creating condition sets for triggering when certain policies get applied. You will be able to create XML-based config files, configure application migration, and see how to restore and backup user settings. In this book, you will get handy with the best solutions on how to troubleshoot your VMware environment along with how to upgrade FlexEngine, DEM console, and ADMX templates.

Overall, this book gives you an in-depth knowledge of VMware DEM, using real-time examples based on the latest versions of the VMware Manager.

• Language: English
• Publisher: BPB Online LLP
• Release date: Aug 16, 2021
• ISBN: 9789390684724

Book preview

CHAPTER 1

Introduction to User Environment Management

In desktop computing, managing the end user environment is the key to delivering a great end-user experience. The end users need to have their applications and data delivered to them, no matter where they log in from. It is also regardless to whether they use the physical desktops or the virtual desktops. When they login, they expect to see all the correct icons on the desktop for the applications they use – such as, whether their favorite printer (or the most convenient one) is connected to the desk location, and whether they have access to their documents, data, and files. All of this keeps the end users productive, and the number of calls to the helpdesk down for simple issues.

When it comes to the support and the IT admin teams, having a solution that allows them to centrally manage their end user and desktop estate frees them up to work on the more strategic projects. The changes can simply be made centrally that will be propagated to all the end users that are targeted for the changes. The IT can centrally manage the end user settings and access to the applications, which the printer users can access along with any other policy and security-based settings.

Structure

In this chapter, we will look at the following topics:

An overview of the end user environment management

User profiles – a brief history and background

Managing the end user profiles with the end-user environment management (UEM) solutions

How does the UEM management work?

Why do you need UEM?

Delivering the stateless desktops in the virtual desktop infrastructure solutions

The composite desktop model

VMware solutions for the end user environment management

Horizon Persona Manager

VMware Dynamic Environment Manager

Objectives

In this chapter, we will explore what we mean when we talk about user environment management, or user profiles as it was previously more commonly known. As part of this, we will talk about the user profiles and what they are used for.

Once you understand the concept of UEM, we will look at how it works and why you would look to deploy this within your desktop environment, whether it is with the physical desktop machine or the virtual desktop machines. For the virtual desktop machines, we will take a deeper look at the deployment methods and how UEM can help reduce the cost and infrastructure requirements by enabling an organization to deploy a fully stateless virtual desktop environment.

This will enable you to understand the theory, and also help you work alongside the practical elements and start to build your own test environment, whether for a proof of concept, pilot, or production deployment.

Now that you understand the UEM and where and why to use it, we will look at the VMware specific solution – the VMware Dynamic Environment Manager (DEM), and also the VMware Horizon Persona Manager which was used previously as a more basic version for managing the end user profiles.

An overview of end user management

In this section, we will look a little more closely at what the end user management is all about when it comes to creating the end user environment. But before we do that, we will briefly talk about what an end user profile is and how they came about.

What is a user profile?

The purpose of a user profile is to save an individual end user’s configuration information to a secure location, from where it will be available to the end user every time that they login to a desktop machine.

This configuration information, or the user profile, includes the Windows desktop settings and the icon placement, the mapped network drive, the network printer connections, the personal program groups, and the program items within the personal program groups.

It can also store the less important configuration information, such as the screen colors, screen savers, mouse settings, and window size, and position. When an end user logs in to their desktop, Windows loads that end user's profile and configures the Windows environment according to the settings for that user. It basically adds the personalization to the desktop to make it theirs.

Before we get into the more technical details of what exactly an end user profile is, let’s start with a brief history.

A brief history of user profiles

If you go back in time, as far as Windows 95 and 98, you will find that they did not have any form of profile management features. This was primarily due to these versions of the Windows operating system not being multi-user enabled. This meant that all the documents and settings were shared regardless of who was using the desktop. So, for example, if one user changed the screensaver, background colors, or any of the desktop icons, then the next user that would use the machine would see those changes too. There was no way of having a personalized desktop for each user. Likewise, if the second user changed anything, it would also remain for whosoever used the machine next. Basically, all the settings were shared. There was however, a feature in the control panel that, when activated, provided the basic profile management, although it was rarely ever used.

It wasn’t until the Windows NT came along that the profiles really came into being. Windows NT had its own profile folder in the form of C:\WINNT\Profiles. This was later updated in Windows 2000 to the Documents and Settings folders, as we have in Windows 10 today, as shown in the following screenshot:

Figure 1.1: Windows 10 profile folders

You will also see another pointer harking back to the past, demonstrating the heritage of profiles and their link back to the days of Windows NT. That link is in the file name that is used to store the settings information. The file is called NTUSER.DAT, as shown in the following screenshot:

Figure 1.2: NTUSER.DAT file in the end users profile folder

The next question is, what exactly is stored as part of the end user’s profile? As mentioned earlier, the NTUSER.DAT file; so let’s start with that? Basically, the NTUSER.DAT file is a log file that contains the settings, configuration, and preferences for all the users of the machine, including the operating system settings, such as the mapped network drives or the printer.

The other parts of the end user profile consist of a registry hive and a group of folders and files that contains the user settings and data. When the end user logs in, Windows loads the registry hive into the HKEY_CURRENT_USER and merges NTUSER.DAT. The hive, and any subtrees to that hive, contain the registry-based settings and preferences for the end user’s environment. The registry then keeps track of the end user and saves any setting changes and maintains the multi-profile structure.

How is the profile created?

At the first login, a folder will typically be created under Documents and Settings which shares the login name of the end user. If a folder already exists for that username, then the profile-creation process will create a new folder. This new folder will be named username.computername. If the machine is part of a domain, then it will use the format username.domainname for the folder name.

Once the end user’s profile folder has been created, Windows will not automatically rename that folder. If you change the username, then the original profile folder will keep the original username.

The new profile is created by making a copy of a special profile called the default user. This default user profile can be modified to deliver a customized and personalized environment for each new user. If you want to modify the default user profile, then you should do this before the end user logs in to their desktop machine. If an end user has already logged into their desktop machine, then the default profile will not work for that end user.

For every end user profile that gets created, an associated NTUSER.DAT file is created for that end user containing their specific user environment configuration.

Once created, another question that often comes up is the size of the profile and how much disk space it takes up. The size of the profile file depends on the amount of personal data and settings that the user adds to their profile.

For example, if they save the files in the Documents folder that are GBs in size, then the profile will equally be as large. You need to bear this in mind when loading the larger profiles over the network, and take note of the time it takes for them to load. The slow login times can be the direct result of larger profiles that are taking time to be delivered, but we will talk about this in a later section with a different type of user profile.

The NTUSER.DAT file

We have mentioned the NTUSER.DAT file a few times now; but let’s see what exactly it is and what makes up the file contents.

When an end user makes any change to their Windows OS, either by changing the system settings, the desktop themes, or installing an app, this information is stored in the registry of the machine.

When they log out from the desktop machine, these configuration changes on how they have configured their desktop environment are saved in the NTUSER.DAT file.

When the end user next logs in to their desktop machine, or another desktop machine on the network, the NTUSER.DAT file is loaded into the memory of that desktop machine. This means that all the preferences and settings related to that end user’s environment are again loaded into the registry.

Deleting the NTUSER.DAT file will result in the loss of all these end user specific settings and it will return to the default profile; the end user will then need to configure their desktop environment from scratch. However, when an end user makes the configuration changes to their desktop environment, Windows creates a log of this and then keeps the previous settings as a backup.

Types of user profiles

Now that we have discussed what an end user profile is, in this section, we will look at the different type of profiles and understand what each one is used for:

Local profiles: The local profiles are created the first time that an end user logs in to a computer. As the name suggests, the profile is stored on the computer's local hard disk. Any changes that are made to a local user profile are specific to that end user and to the computer on which the changes are made.

Roaming profiles: The roaming profiles are copies of the local profile that is copied and stored on a centralized shared folder on a file server. The profile is then downloaded to any network-enabled desktop machine that an end user logs in to. If the end user makes any changes to their roaming profile, then these changes get synchronized with the copy that is stored on the server. This synchronization occurs when the end user logs out of their desktop machine. The advantage of deploying the roaming profiles is that the end users do not need to create an individual user profile on each computer that they log in to. As the name implies, their profile roams with them to whichever desktop machine they use.

Mandatory profiles: A mandatory profile is a profile that the administrators use to specify the settings for the end users. These settings are those that every user needs, such as specifying an antivirus scan, or applying a particular security policy to manage that particular end user.

Only the system administrators can make changes to the mandatory profiles, and any changes to the profile made by the end users are discarded when the end user logs off.

Temporary profiles: The temporary profiles are created when an end user’s profile fails to load, so that they can at least log in to their machine. When the end user logs out, the temporary profile gets deleted, and if they had made any changes to their temporary profile, then those changes also get deleted after they log out. The temporary profiles are only available on the computers running Windows 2000 and the later versions.

As there are different types of user profiles, there are also different versions. As the newer OS versions become available, so does the profile versions. The issue here is that some profile versions don’t work with some OSs and therefore the profile will need to be migrated as part of any OS migration. The following table lists the different profile types and the operating system that they refer to:

Figure 1.3: User profile versions for each OS

Why use the user profiles?

By deploying the profiles to manage the end user environments, you can deliver the following advantages:

When an end user logs in to a desktop machine, the same settings that were in use when the user last logged out will be applied.

In the shared environments, each user receives their own customized desktop and user experience.

The settings in the user profile, along with the user’s personal files and data are unique to each individual end user and cannot be accessed by any other end users.

The changes made to one user's profile do not affect the other users or the other users' profiles.

When deploying the virtual desktop solutions, the fully stateless virtual desktop machines can be deployed, cutting the infrastructure costs and requirements.

Now that we have set the scene when it comes to what a user profile is, in the next section, we will look at how to manage these user profiles.

Introducing UEM

The first thing to cover is to clarify the acronym UEM itself. The UEM that we are talking about in this book is the User Environment Manager, that is the ability to manage an end users’ desktop experience. This is not to be confused with the Unified Endpoint Management, which is used to manage the physical end points.

So, how is UEM different from the user profiles? The easy answer is that the user profiles contain all the end user relevant configuration settings and data, whereas UEM is the delivery mechanism for applying these user profiles to the end users.

But, is that not what an Active Directory Group Policy delivers? The answer to that is, in a way, yes it does. But it doesn’t offer such a comprehensive or easy way to manage the policies.

The group policies can often be complex and difficult to manage. They also become bloated over time, as no administrator really wants to delete a policy, just in case it may have an adverse effect on the end users. The result of these bloated profiles could be that the end user’s login time becomes unacceptably long, as it has so many different settings and configurations to process and apply.

With UEM, an IT administrator will have a much easier way to manage the end user profiles as well as the ability to deliver them at a more granular level. For example, you could apply the specific policies to an individual user, rather than a group of users like you would with the standard group policy. The UEM solutions are also managed using a graphical user interface, making it much simpler to apply the policies, and more importantly, understand what they are delivering.

Another feature is the ability to add context to a policy. For example, if an end user is connected to the internal network, then policy A is applied, but if they connect via an external network or the Internet connection, then policy B is applied, where policy B may take them through the additional security steps to reflect the fact that they are coming in via an untrusted connection.

What is UEM?

The User Environment Management is a software-based solution which enables the organizations to deliver the corporate policy to the end users, the user specific data, configuration, and settings for each end user, or the end user’s personality which is abstracted from the operating system and then stored and managed centrally.

Once abstracted, this user personality can be delivered back to the OS, on demand, as the end user logs in to a desktop. This just-in-time on-demand delivery enables an organization to provision and personalize the desktops on demand, allowing them to deploy an environment consisting of the stateless desktops, knowing that each vanilla desktop can be customized on the user log in to provide the end users a personal experience.

Why UEM?

The static desktop model has evolved into a more dynamic model, and as a result, it is now referred to as the modern workspace. The organizations now manage the end user access to the desktops and applications, based on the role that the user has within the organization. So, rather than every user getting every app and every setting and configuration regardless, these settings are now delivered on a more personal level, on a per user basis. This means that you are managing the end user’s profile rather than the devices, and delivering the right end user experience, no matter from where the end user logs in.

The UEM solutions have been designed to manage the end user personalization within these new and more dynamic, just-in-time environments, whereas the standard group policy was not. Remember, the group policy was designed back in the day of the static desktops.

To deliver these more dynamic environments, the complexity has increased by having a much larger number of factors and variables that need to be configured as part of an end user’s environment. UEM can solve this complexity, making it much simpler to deliver the end users’ environment.

How does UEM work?

UEM takes the standard policies from the group policy and enhances them by allowing a more granular way of delivering them back to the end users. It will integrate into your current Active Directory and provide a more user-friendly interface, where the IT admins can build an experience at the end user level and appropriate to their working environment. In the same way as the AD group policy, the profiles are stored centrally and essentially become portable and are applied to whichever desktop the end user logs in to.

Building upon the standard group policy, UEM also adds some more advanced features, such as the elevation rights management which can allow the users to install certain apps without needing an admin password to do so.

It also adds a more granular way of managing when policies are applied by using context aware triggers. These triggers mean that a policy will only be applied when certain criteria are met. For example, if you login from a particular building only the printers from within that building are available to use. Or if you login from outside the corporate network, certain applications and features won’t be available.

It was the virtual desktop infrastructure that really drove the organizations into needing a new and better way to deliver the end user profiles to enable them to deliver the stateless virtual desktops, which we will discuss in the next section.

Another useful feature of UEM is its ability to migrate between the profile versions.

The composite desktop model

As discussed earlier in this chapter, the ideal model when it comes to delivering the virtual desktops is to deliver a completely stateless desktop. A stateless desktop is a virtual desktop machine that has no end user ownership. It contains a vanilla build of the operating system that is then delivered to the end user on demand, when they request a virtual desktop machine to connect to. The virtual desktop machine is built on demand, and effectively assembles as the user logs in. This assembling of the desktop brings together several different components that are specific to the end user that is logging in.

The virtual desktop machine can be broken down into three different, specific components – the operating system, applications, and the user's profile. These components come together to make up the end users’ complete desktop environment, as shown in the following figure:

Figure 1.4: Composite desktop model; the component parts

In this book, we will be focusing on the profile components, but in the next sections we will describe all the layers that make up the composite desktop.

OS layer

The first layer to be delivered is the OS layer. As the name suggests, this layer consists of an optimized OS, designed to run in the virtual desktop environments.

Like the OS, this layer will also potentially contain the core apps that every user will need. The apps such as the Microsoft Office suite, for example. You will also want to consider the nature of the application; if the application is unable to be delivered using a layering technology or app virtualization solution, then these applications will also need to be installed in your OS base image. The OS is a completely new and vanilla version of the OS, and is therefore delivered with no user personalization settings, or other apps. These are delivered based on the user profile and, in the case of VMware Instant Clones, built on demand as the users request the desktop resources.

Applications

As part of your project and the deployment of the virtual desktops, you need to have an application delivery strategy to manage the delivery of the apps with the stateless desktops.

Similar to how the user profiles work, the apps are removed or abstracted from the core OS image and stored centrally as the app layers or the virtualized apps. These are then added or delivered to the OS layer on demand, based on the end user entitlement. Only the apps that the user is entitled to will be delivered.

User profiles and environment management

The final part of the composite desktop model, and the focus of this book, is the end user's profile.

The end user’s profile, as discussed earlier, contains everything that makes the desktop personal to that specific end user. For example, the application settings, the contents of their Documents folder, and the icons on the desktop. In this case, the profile is abstracted from the OS layer, stored centrally and delivered on demand as the end user connects to a virtual desktop machine. With the UEM solutions, you can add the context around what elements of the end user’s profile are delivered based on things such as where they are connecting from, or what device they are using.

Using the VMware solutions, there are a couple of ways to achieve this, including the standard Microsoft tools within the Active Directory group policy. The View Persona Management ships as a standard with the VMware Horizon and is a basic extension to the AD group policy, and for the advanced end user environment management, there is the VMware Dynamic Environment Manager.

Wherever possible, it’s a good practice to keep the solution as simple as possible and not combine multiple products to create the desired outcome. However, depending on the levels of customization for your users, you might need to introduce additional solutions to achieve the level of end user customization and personalization that is required.

Once all the components come together, the end user will be presented with their own personally customized desktop, as shown in the following screenshot:

Figure 1.5: The composite desktop model; the delivered desktop

As you can see in the preceding screenshot, the entire desktop environment has been built on demand and customized and personalized to the end user’s exact requirements.

Conclusion

In this chapter, we explored what we meant when talking about the User Environment Management, or the user profiles as it was previously more commonly known. As part of this, we covered what an end user profile was. Once you understood the concept of UEM, we went on to look at how it worked and why you would look to deploy this within your desktop environment, whether that was with the physical desktop machines or the virtual desktop machines. We then looked at how UEM can help you to reduce the cost and infrastructure requirements by enabling an organization to deploy a fully stateless virtual desktop environment using the composite desktop model.

Now that we have familiarized you with the concept of the user environment management, in the next chapter, we will focus on the VMware solution for managing the end user environments – VMware Dynamic Environment Manager (DEM).

Points to remember

The User Environment Management solutions allow you to abstract the user-specific data, such as the end user data and personal desktop settings from the operating systems, so that the profile can be managed independently and delivered dynamically to the desktop environment.

The different operating systems have different profile versions which means that they may not be compatible with the different operating systems. The UEM solutions can help with the migration process.

MCQ

What is the name of the file that is a log file containing the settings, configuration, and preferences for all the users of the machine, including the operating system settings?

NTUSER.LOG

NTUSER.DAT

APPDATA.LOG

PROFILE.LOG

What are the three layers that are defined in the composite desktop model?

OS, patches, and apps

Hypervisor, OS, and apps

OS, apps, and user profile

Registry, OS, and apps

Which operating system saw the introduction of the end user profiles?

Windows Server 2003

Windows XP

Windows 2000

Windows NT

Which type of profile is stored centrally but gets copied to the local machine when the end user logs in?

Temporary

Mandatory

Roaming

Local

Answers

B

C

D

C

Questions

Which OS was the first OS to make a proper use of the end user profiles?

What is the name of the file that stores the user profile info?

Which profile version was used with Windows 7?

Name the three key differences that DEM/UEM offer over the standard AD group policy.

What are the three key components in the composite desktop model?

CHAPTER 2

Introducing VMware Dynamic Environment Manager

In the previous chapter, we discussed what an end user profile was and how those can be managed easily and at a more granular level, using an end user environment management solution.

Now that you understand how the solutions are used, and what they deliver, in this chapter, we will get into the specifics of the VMware solution for managing the end user environment – VMware Dynamic Environment Manager.

Structure

In this chapter, we will look at the following topics:

VMware UEM and profile management solutions

Horizon View Persona Management

Dynamic Environment Manager

How to purchase and license DEM

DEM terminology

Architecting a DEM solution

Objectives

In this chapter, we will go into more details around the VMware environment management solutions, including the features, terminology, and how to build and deploy the solution within your environment.

VMware UEM solutions

VMware has two key products that manage the end user profiles and environments – Horizon Persona Manager and VMware Dynamic Environment Manager.

Horizon Persona Manager

The first solution that we will look at is Persona Manager, which is part of the VMware Horizon. To provide some background and history to the View Persona Management, it was originally a product solution known as the Virtual Profiles and was acquired by VMware from a company called RTO Software, back in 2010.

View Persona Management was introduced with View 5.0, allowing the IT admins to configure the end user profiles, so that they would synchronize with a centralized profile repository on a file server. Its goal is to manage the end user profiles when deploying a virtualized desktop machine environment to assist in delivering the stateless virtual desktop machines as per the composite desktop model that was previously discussed.

How does Persona Manager work?

The View Persona Management redirects the end users' profiles using the group policies. The profile is then stored on a file server, as shown in the following diagram:

Figure 2.1: VMware Persona Management

When an end user connects and logs into a virtual desktop machine, randomly selected from a pool of virtual desktop resources, the elements of their profile get downloaded from the file server to the virtual desktop machine. They are downloaded as and when they are required. Once the file has been requested, it remains resident in the cache of the virtual desktop machine. If the end user makes any changes to the profile, settings, or redirected folders, then these are also stored locally on the virtual desktop machine, and then periodically uploaded back to the central profile repository.

Horizon View Persona Management reduces the total cost of ownership when deploying the virtual desktop machines, by enabling the deployment of a stateless environment. The previous deployments meant that the end users were placed in the dedicated desktop pools, just so that they could keep their profile settings. Although this method worked, it added to the cost and complexity of managing those desktop pools.

Persona Management is an integrated part of the Horizon View, and as such, there is no additional costs involved, unless you need to add the advanced features and functionality of the VMware Dynamic Environment Manager.

Since Persona Management is an extension to the Active Directory Group Policy, it scales easily and requires no real infrastructure, other than enough storage space for the profiles stored on a file server.

VMware Dynamic Environment Manager

VMware Dynamic Environment Manager, previously known as the VMware User Environment Manager, was added to the Horizon portfolio of the EUC solutions, when VMware acquired a Dutch company called Immidio in February 2015.

Originally, Immidio was a software company that created products that were designed to assist their consultants working out in the field when it came to managing the end user environments. It soon became productized and a product, rather than an internally developed consultancy tool.

DEM provides advanced features and functionality over and above the Horizon View Persona Management. One of the key differences that is instantly noticeable is that DEM is managed via a central management console, rather than adding to the existing group policy editor and having to create and manage the policies in a manual way. It not only works across the virtual desktop machines, but also the physical PCs, as well as the cloud-based Windows desktop environments or DaaS. It’s all about managing the end users’ environment, rather than where or how the operating system runs. All you need to do is include the DEM agent and it’s components on to the desktop that you want to manage the end user environment on. You can simply include this as part of your standard OS build.

How does DEM work?

The following diagram shows a high-level overview of how DEM works within a virtual desktop machine environment:

Figure 2.2: VMware Dynamic Environment Manager Architecture

There are the following five key use cases that UEM can be used with:

Application Configuration Management: Allows the specific configuration of an app’s initial settings rather than deploying the default settings.

User Environment Settings: Allows you to centrally manage the User Environment settings, such as the following:

Application blocking

Application shortcuts and file type associations

Drive and printer mappings

Environment variables

Files, folders, and registry settings

Folder redirection

Personalization: Abstracts the user-specific desktop and app settings from the underlying OS and then makes these settings available across multiple devices, Windows versions, and apps. It also supports the OS migration.

Application Migration: Allows an end user to roam the app and personalization settings so that they can move between the different OS versions.

Dynamic Desktop Configuration: Uses the condition sets to allow the conditions based on the variables, such as the user, location, and device, to deliver the dynamic delivery of content and appearance.

SmartPolicies

SmartPolicies is a feature of Horizon and uses DEM to deliver a set of policies that are specific to the Horizon View virtual desktop machines.

To use SmartPolicies, you will need to be running the run version 7.2 or later of the View Connection Server, especially if you want to deploy the published apps with the Horizon Apps and RDS. You will also need to install the DEM 9.2 as a recommendation.

With Smart Policies, the IT admins have a much more granular level of control over a virtual desktop machine. The Horizon features can dynamically be enabled, disabled, or controlled based on the end user, as well as the other variables, such as the client device type, IP address, and desktop pool name.

SmartPolicies allow you to configure the following:

USB redirection

Printing

Clipboard behavior

Client drive redirection

HTML Access file transfer

Bandwidth profile

If you deploy DEM v9.1 or later, and the Horizon Agent v 7.0.1 or later, you can use SmartPolices when delivering the virtual desktop with either the Blast Extreme or the PCoIP display protocol.

DEM or Persona Management?

So, which solution should you deploy – DEM or Persona Management? DEM is available as part of the Horizon Enterprise Edition or as a standalone product, so it means a higher cost if you won’t deploy the Enterprise Edition. You may, of course, already be deploying the Enterprise Edition, in which case, there is no extra cost.

DEM delivers a far greater set of configuration variables, features, and functionality. It also is much easier and simpler to manage, having a central management console. However, you may already have an advanced DEM solution in place.

If you are using a different edition of Horizon that does not include DEM, then the Persona Management may well deliver the right level of environment management to your end users.

When it comes to VMware DEM, there are a number of terms that are used for the various components of the solution. In the next section, before we get into the architecture in more details, we will run through these terms and describe what they mean.

DEM terminology and glossary

Before we get into the key