Dudley Primary Care Trust (PCT) has worked with Centralis (a key Citrix & AppSense partner) to deliver a virtual desktop environment to over 3,000 staff.

Using Citrix XenServer, Citrix XenDesktop, Citrix XenApp and AppSense, Dudley PCT are able to provision desktops to their staff from just 16 Virtual Servers.

AppSense enables a single standardize image of the OS and Applications to be stored, managed and delivered as fully configured and personalized desktops to thousands of users at minimal operational cost.

A more detailed account of this project can be found here

Other joint Citrix and AppSense Customers can be found here

Further information on the joint Citrix & AppSense Solution can be found on the Citrix website here

Thanks

Gareth

Enviroman (Oliver Sills, Product Manager for AppSense Environment Manager) was in the office the other day, pestering me about signing a petition to change the Environment Manager “colour” from green to Tangerine – something to do with some UK footy club. I told him the Budgie Smugglers don’t look any better in Tangerine, so stop sitting on my desk

Just about then the phone rings, it was a Solution Architect from a large software company. “Tell him about Personalization”, Environman whispers in my ear. I covered the phone, told him to go way, and went back to the call.

Turns out one of his clients was trying to deploy 600+ Virtual Desktops, and it had just dawned on them that Policy, Profiles and the User Personality had become a nightmare to maintain when using a Non Persistent Pooled Desktop environment.

Think about it – each user, every time they log in, has a brand new base model PC.

This Client did a Proof of Concept – easy – P To V a couple of desktops, load a client, connect in using RDP – jobs a good’un – look Mum no hands – I’m doing VDI

So then they ticked all the boxes, app compatibility – tick, ease of use – tick, centrally managed and deployed – tick, user acceptance – tick, user personalization – tick – hey, not so fast.

You CAN have a tick in that box if you are talking One to One, dedicated hosted virtual desktops for a small number of users – otherwise, you need to think again.

It’s like when I started talking to the Aussie market about AppSense back in 2004 “Yes I hear what you say, but I’ve only got 5 servers – it’s not a problem” 6 months later “Yes I hear what you say, but I’ve only got 10 servers – it’s not a problem” 6 months later “Our farm is out of control, now we have 15 Citrix servers we now understand what you guys were on about 6 months ago”

As we always say – we don’t hold a grudge – and we don’t ever say “I told you so”.  After all we’re from AppSense – we’re here to help

Virtual Desktops are starting to ramp up, and unfortunately with some clients projects, the devil will be in the detail.

Like the client we are now helping, they thought the “Profile Stuff” built into the VDI solution would be the easy bit. “There’re tools built into the base product” they say – yes there are, but those built in tools can be compared to other in-built free software like NTBackup – yes it will backup a file, but it’s not granular enough, and it just won’t cut it in an Enterprise environment – that’s why companies invest in a Third Party backup products.

AppSense is exactly the same. Built in “Profile” tools or features are o.k. for a simple small deployment where one size fits all, but the reality is most organisations will need more.  The reason for this is simple, profile management tools are there to solve profile issues such as bloat and logon times.. they are not designed to be cross platform, cross delivery mechanism personalization solutions, not to mention the need for policy action control also.

It’s just not as easy as saying “We use Roaming Profiles and redirected folders” – try reimaging every PC in your business, every morning, and see if it causes a few hassles for users.

So we keep plugging away out there – educating the market in advance, some clients “get it” up front and they’re the ones with the smooth running, no surprises VDI projects.

As for the rest of you – we’ll be here, happy to answer questions, happy to show and tell – all with passion and enthusiasm.

After all – we’re from AppSense – we’re here to help

A few weeks ago AppSense HQ was the center point for our quarterly Systems Engineering / Pre-Sales Conference..

I thought, while I have 30 or so consultants at my disposal, to take this opportunity to catch them off-guard and have them white-board some of the key AppSense messages and overviews.

Videos / Whiteboard Presentations include (amongst others):

• User Environment Management Overview
• Windows 7 and VDI Overview
• Eliminating the need for Roaming Profiles
• Rolling-back User Personalization Settings
• Automatically Blocking Unauthorized Executables
• Controlling Microsoft Application Per Device Licensing
• Client & Cloud Computing

These videos have now been uploaded to YouTube and are available for viewing here – at the AppSense YouTube Channel

I hope these are of use to people, and where possible, I am keen to read your comments, so please do leave a note of your thoughts on there

AppSense on YouTube

Learn the difference between just throwing in a VDI solution, and designing a true Desktop & Application Delivery Architecture. Learn why most VDI projects fail, and the best practices that will show a solid ROI to your CFO/CIO.

Don’t try to bolt-on a Frankenstein solution, – come hear from our team of technical experts. You’ll also experience a great networking opportunity to meet your peers, and learn from their projects as well. Some questions we will help you answer…

• Why is desktop virtualization different than server virtualization
• Is VDI the same thing as Desktop or Application Delivery (hint: it is not)
• What architecture/designs are available
• What are the SAN requirements for Desktop Delivery
• How do you handle user profiles
• How is printing different with virtual desktops or Terminal Services
• When do you use Terminal Server based Application Delivery versus Desktop Delivery (or both)
• What licensing is needed from each manufacturer to implement a solid desktop virtualization architecture

A solid line up of technical presenters; from Microsoft, Citrix, AppSense, and AGSI coming to a city near you…

 10/27/09 – Raleigh, NC

10/28/09 – Charlotte, NC 

10/29/09 – Charleston, SC

 More details: http://www.advantec.us/events-dtv.htm

To register: http://www.advantec.us/eventspdtv-reg.asp

Douglas Brown interviews Martin Ingram, Vice President of Strategy at AppSense. Douglas and Martin discuss the recent release of Citrix XenDesktop 4, what this means for the desktop virtualization, AppSense, and VMware. Martin also talks a bit about their upcoming “user installed applications” technology which will allow end-users to install their own applications and have those apps roam with the user while allowing IT to centrally manage these ‘one off’ applications centrally.

The podcast is hosted on DABCC.com and can be found here

DABCC Podcast

A major challenge in migrating existing users to Windows 7 is user profile data and desktop setup scripts. It’s highly unlikely that anything the user has done to their existing machine to personalize it will be compatible with the new Windows 7 desktop. The result? All upgraded employees have to re-personalize their desktop – not a quick task, especially as the process to make such personalization changes may require changing options and settings in new menu locations.

One of the most important things to consider in your Windows 7 migration project is the retention of all user-specific information (we call it the “user personality”) from the ‘old’ desktop and simply injecting this back into the new Windows 7 desktop following upgrade, ensuring a seamless experience to the user and a de-risked Win 7 migration. 

AppSense Environment Manager has been providing user profile migration solutions for global companies for several years, and fast becoming an essential component in many Win 7 migration projects.  AppSense automatically identify all existing personalization settings on the current OS platform, separate them from the desktop and store them independent of the desktop itself.  These settings can now be re-applied to the new Win7 OS platform, regardless of how the OS is hosted or delivered, either physical, virtual or provisioned..

For more information, please download our free Windows 7 Overview  here or visit www.appsense.com/solutions/migration

Win7 Migration

Citrix CTP and owner of www.Ervik.as - Alex ‘Ervik’ Johnsen – is hosting a VDI webinar discussing the challenges faced in rolling out VDI, along with best practices and discussions & demonstrations from Citrix, AppSense and joint VAR Commaxx.

This webinar will include a Citrix XenDesktop overview, along with why AppSense is the only solution recommended by Citrix for Personalization and Policy management to enable the customization of single OS and App images to be tailored for each and every user in an organization.

Join us to understand how Commaxx, AppSense and Citrix can simplify your desktop virtualization plans, reduce cost, simplify management and provide the best user experience.

The webinar takes place on Monday 19th October, you can register your place here: https://www2.gotomeeting.com/register/937376570

Together Citrix and AppSense have over 4,000 joint enterprise customers and have deployed some of the largest VDI environments in the world… attend this webinar to see why..

Click Banner To Register For Webinar

I have just returned from a successful 2 day IPexpo event in London, and was extremely excited to see the many Google Alerts for ‘XenDesktop’, ‘AppSense’, and ‘User Environment Management’ in my inbox.  Upon clicking on the alert I was taken to Daniel Fellers ‘Ask the Architect’ pages within the Citrix Community site.

In this instance, Daniel (a Lead Architect for the WorldWide Consulting Services at Citrix) interviews Sandy Kingdon (a Dynamic Desktop Architect at CSC) on how CSC has designed and is well into the implementation of Citrix XenDesktop, VMware ESX and AppSense User Environment Management to support a 40,000 user environment.

Sandy explains how CSC were able to overcome some notable challenges, including:

• Supporting multiple users across different sites using different language and MUI packs from just 2 vDisks
• Controlling Application Access
• Persisting User Personalization Settings between sessions
• Current and future plans for supporting User Installed Applications in a non-persistent environment

As AppSense are a core component of CSC’s standard offering for Dynamic Desktop, Sandy covers how by virtualizing the user and controlling Policy and Personalization separate from the underlying OS and App components that CSC were able to overcome the above challenges.

The podcast can be found here

Thanks to both Daniel and Sandy for the great podcast and an insight into a real world large scale XenDesktop deployments.

I have recently heard, from several different sources, that it is “best practice” not to share user profiles, or personalization settings, between different operating system platforms. On the surface, this seems a sensible limitation since different operating systems have different user profile structures. 

Vista and Windows Server 2008 (WS08) put most profile data somewhere in “\users\%username%\appdata”, whereas XP and Windows Server 2003 (W2K3) may place it in “\documents and settings\%username%\application data” or “\documents and settings\%username%\local settings” or somewhere else entirely.

We can’t predict where the data will go for a given application which doesn’t help us understand the “splatter” that it makes in the file system. This folder lottery is further compounded by the fact that Vista and WS08 implicitly add the “.v2” extension to any profile path you define for a user. What this results in is that with a roaming profile solution, you are forced to have different profiles, and therefore different settings, between XP/W2K3, which implicitly use a “v1” profile, and Vista/WS08 which explicitly use a “v2” profile (even though the path defined for this profile does not actually include the “.v2” extension).

Applications should get the paths to use within the profile folder hierarchy by using operating system API calls that are the same between the different operating systems but will yield the correct folder for the operating system it is being run on. Unfortunately, not all applications are written this way and some will make assumptions about paths and maybe even hard code them which is likely to cause problems even before operating system migration, particularly in Terminal Server/Citrix XenApp environments.

There is also the class of setting that is actually different between the different operating systems. Take for instance the good old desktop wallpaper which most people, if pushed, will confess is the one item that makes their PC experience “personal” (while this is not an essential productivity related personalization setting, it does however provide a good example as to how even the most basic of settings fail to migrate between OS platforms)  Although users don’t know, and indeed do not need to know, they are actually stored in different file formats between XP/W2K3 and Vista/WS08. Therefore if the setting for this, which is stored in the user’s registry hive, was just unintelligently transplanted between the two operating systems then one of the desktops wouldn’t show the correct wallpaper.

Some implementers may say that it is a good idea to start with clean profiles when moving from one operating system to another system since it is a good opportunity, in their view, for a clean start and to leave all the myriad of settings behind that aren’t apparently used for anything and just clutter the profile. However, against this has to be weighed the cost of the user having to re-personalize their applications and desktop. This costs both in terms of time (both users being interrupted during their workflow as they find a toolbar or application setting they need is missing, and then having to remember where and how to re-make the customization, which could be different to how they would have changed the option on their old OS)  and also can cause a certain amount of resistance when these users tell their yet-to-be-upgraded colleagues is that this great new operating system, which has been months in planning, has lost all of their settings and they are struggling to find the new ways to set things the way “they should be”.

Enter AppSense Environment Manager. All of the technical issues outlined above are addressed by Environment Manager making the migration from one operating system to another, and back again if required, a much less painless experience and instead now becomes an automated, seamless process for both the user and administrator alike. The files used by an application within the locally cached profile folders are stored in a relative, rather than absolute, form in the Environment Manager database which then allows them to be subsequently put back in the correct, operating system specific, folder hierarchies. Because Environment Manager functions on a per-application basis, it can much more accurately target which settings need to be brought over onto the new operating system and it also silently transmogrifies items and their settings, such as desktop wallpapers, to help ensure that seamless migration that administrators dream of. All this, of course, is done with next to no configuration by administrators so they do not need to understand the intricacies of any of the applications and subsequent registry settings and profile structures the user uses. This helps make for quick and easy migrations, although I don’t personally like the term “migration” since it implies a one way movement whereas Environment Manager provides bi-directionality with no extra effort.

So in summary…While it is right to say that it is NOT best practice to share ‘roaming profiles’ across OS platforms, AppSense Environment Manager dispels the myth that sharing ‘personalization settings’ between operating systems is not a recommended best practice –in fact AppSense recommend you embrace it…

I recently read a great article titled ‘Windows 7 May Spur Virtual Desktops, On and Off the iPhone’ on CIO.com by Kevin Fogarty.

It is a great article and brings attention to the options available to us in how we can deliver desktop (sessions) to our users, even when they are not sat in front of a typical PC or Thin Client device – bring on, the mobile/cell phone device.  However, I have recently received a few emails and mentions on my Twitter Account in relation to the write-up regarding how AppSense is represented in the article.

The article goes on the reference how ”VMware, Citrix and a range of other companies are putting clients on smart phones” and as part of this mobile discussion AppSense User Environment Management is rightly referenced as “The User Environment Manager from AppSense, for example, is designed to make a virtual desktop mimic the real thing by allowing end users to make changes, install software add photos, store cookies and do all the other things they’d do on an actual “personal” computer”.

Unfortunately however there appears to be a slight misrepresentation on the relationship between AppSense and the vendors Citrix& VMware, in that it says AppSense code is part of both the VMware and Citrix VDI offerings, “AppSense, whose code is part of both VMware and Citrix’s VDI offerings, stores all that data and code on the server and reloads it all every time that user logs on, no matter through what device the access comes” .

While AppSense enjoy a very close and strong relationship with both vendors, providing some of the strategic requirements for the VDI offerings in many of the largest enterprise deployments, I must at this point highlight that the AppSense capabilities come from a separate solution outside of VMware View and Citrix XenDesktop- in the form of the AppSense Management Suite.

The AppSense Management Suite is a standalone management framework and solution set which completely separates all elements of the user from the underlying desktop session, operating system and application set.  While this platform agnostic technology integrates seamlessly with the VMware and Citrix offerings, AppSense code is NOT part of any VMware or Citrix offering, and must be implemented in addition to the VDI solution from either vendor.

Hope this clears up any confusion, and please do remember I fully support the article and agree with the other points made.. I just wanted to ensure no one is disappointed when they trial or purchase either VMware View or Citrix XenDesktop and find out there is no AppSense software built in J

Look forward to reading more great articles on the possibilities of desktop deliver.. and of course that AppSense is a key part to this personal computing shift…

(the original article can be read here).

Unless you’ve been living on a desert island in the mid-Pacific for the past few months (actually, that sounds pretty good!), you’ve probably heard something about a new Microsoft OS called Windows 7.  By all accounts, this OS looks set to be the next logical upgrade from XP (with many companies skipping Vista for reasons I don’t need to go into right now!).  So not only will companies be looking to upgrade their existing physical PCs to this wonderful new OS, but the availability of Win7 will inevitably bring about a re-assessment of the corporate desktop estate. That re-assessment will of course consider the prospect of lowering management costs by moving from physical machines to a virtual desktop environment; Win7 seems much more ‘VDI friendly’ than any of its predecessors.

So….a company-wide OS upgrade is coming….  A migration from physical to virtual desktops is probably also coming…….

You might be thinking a couple of things about this….
1. “Will I see my family again?”
and
2. “I want to make this upgrade really work.  I’m not going to have any support calls on this and I’m going to use this to reduce my costs….”

Well, I’m not sure what we can do about the family challenge, but I do know how you can answer number 2.

Let’s break the problem down into two parts; 1. upgrading to Win7 on the physical PC, and 2. the migration to a virtual Win7 environment.

Upgrading to Win7 on the physical PC

Win7 is quite different to XP.  You may very well have problems running legacy or homegrown XP apps on Win7.  In order to solve this problem, you might have to consider virtualizing troublesome apps rather than wait for upgrades from multiple app vendors. 

Another problem you’ll have is the user profile data and desktop setup scripts.  It’s highly unlikely that anything the user has done to the XP machine to personalize it (at both the OS and the application level) will be compatible with the new Win7 desktop.  This is because XP uses a completely different User Profile format and structure to that of Win7, meaning it is not as simple as re-using their old profiles on the new OS.  The result?  All your upgraded employees have to re-personalize their desktop.  I don’t know about you, but I’ve done a lot to personalize my desktop and applications over the years.  I have all my apps just the way I want them, my email signature and rules are set just right and there’s probably a hundred other settings I’ve forgotten about and wouldn’t know how to re-do on a new OS.  What a great start to my Win7 experience….a bland, impersonal machine.  By the way, the same thing goes for policy settings, such as printer and file drive access as well as other ‘logon processes’.  So, one of the most important considerations in your Win7 migration is to retain all this user-specific information (we call it the “user personality”) from the XP desktop and simply ‘inject’ this back into the new Win7 desktop following upgrade to ensure a seamless experience to the user.

Migrating from an XP PC to a Win7 virtual desktop

Rather than just upgrading physical PCs, you might want to take this opportunity to move employees over to a virtual environment.  Not only does this provide the user with a nice, new Win7 desktop, it also can provide some huge desktop management cost reduction opportunities;  no need to upgrade the desktop machine with hardware capable of running the new OS (as this can now be re-purposed as a ‘thin client’), centralized management of desktops, monitoring of the environment to reduce support costs etc .  However, the real big opportunity to reduce costs here lies in the use of a single, standardized and leveraged Win7 desktop image across the entire company.  Imagine creating ONE standardized, corporate Win7 desktop (possibly with a selection of baseline corporate apps such as Outlook and IE) and to have this provisioned to each employee as they require it.  When the employee goes home, the desktop is deleted.  No need to store and manage lots of desktops….instead they’re delivered on an ‘as-needed’ basis.

However, this standard Win7 image is by no means personal to the user – not if it’s being used by thousands of employees!  This is where the user personality comes in.  By centrally managing the user personality independent of this standard Win7 desktop, it can then be applied to the desktop when needed.  So you now have a low cost, standard Win7 estate, with employees experiencing the same working environment as when they were using their desktop PC.  Sound like heaven?

Well, it certainly might sound like futuristic, but believe me this is happening today!  I see it in many of our enterprise customers, our VAR partners and our System Integrator partners – and it’s gaining huge momentum (see Sumit Dhawan’s latest blog on this here).

 Win7 will be a game-changing event in the corporate desktop world.  It will essentially be the catalyst to a whole new way of looking at and managing the desktop – and what we know to be true is that the user aspect of the corporate PC must now be treated as a separate entity unto itself – enabling the business tools (apps and OS) to be standardized and their delivery automated, leading to huge reductions in cost (management, storage, licensing) and productive employees.

Here are some of the things we believe you must consider as part of your Win7 migration.  Remember all these things are possible today. There are some vendors who can provide some of the items below…..but there’s only one that can do them all!

Pete Rawlinson
VP WW Marketing, AppSense

• Low cost, low risk migration to Win7 on your physical PCs

      Seamlessly decouple all aspects of the user from the employees existing PC (XP, Vista), and reapply this data into a fresh, standard Win7 PC.  The employee sees no change to the personal settings post-upgrade.

• Eliminate the costs associated with using legacy scripts and bloated user profiles

      Your Win7 migration affords the opportunity to replace outdated and management-intensive methods to manage the user experience on the desktop.  Complex, often large login scripts can be replaced and selectively executed dependent on the user needs.  Maintenance is reduced, as is the user logon time. 

• Low cost, low risk migration to Win7 in a virtual desktop environment

      Decouple the user personality from the existing PC and store this independent of the desktop.  The user can then be redirected to a low cost, standard, virtualized Win7 image, where their personality is applied on-demand.  A low-cost physical-to-“Win7 virtual” migration process, with the employee seeing no change to their PC experience.

• Ensure seamless user experience in multi-OS desktop estate

      Regardless of whether your desktop estate is a mix of XP, Vista or Win7, the same centralized, independent user personality is able to seamlessly ‘roam’ across each OS version.  This enables you to implement Win7 into your desktop estate gradually, without having to create multiple user profiles for each OS version. 

• Establish lowest cost Win7 desktop environment through standardized, personalized desktop images

      Desktop management and storage costs can be reduced significantly by standardizing on your Win7 corporate image.  By having one standard Win7 desktop provided to employees on-demand, desktop management becomes much easier and less risky.  Including personality management into this scenario enables this standard desktop to be dynamically personalized on-access, providing the employee with their familiar PC-type experience.

• Personalize virtualized applications

      Many legacy, home grown and XP-based applications are unsuitable for use in a Win7 environment, making application virtualization a necessity.  Unless the company is prepared to virtualize each individual employee’s applications, virtualized applications must be standard and therefore non-personal in nature.  Applications must be automatically configured for each specific user and/or connecting device, and automatically personalized to the user based on their personality. You can now accelerate the Win7 roll-out since incompatible applications are virtualized, yet still remain personal to the employee.

• Quickly and easily scale Win7 implementation with no impact to user experience

      The user is provided with a consistent personal experience across multiple client OS versions, multiple delivery technologies, multiple accessing devices and accommodates the employee context (e.g. security level, accessing location etc). 

• Ensure quality user experience as your Win7 implementation scales through visibility and remediation

      Migration to Win7 in your organization is a significant and on-going event.  Adherence to SLAs and reducing support loads are paramount during this process. In addition to ensuring a consistent and personalized user experience during the Win7 migration process, you must also provide desktop optimization and remediation through reporting, monitoring and auditing of the user personality.

Martin Ingram, VP of Strategy at AppSense has been inundated with Press and Analysts wanting to interview him to learn more about the strategic requirement for user personalization within VDI environments. 

Personalization is key to reducing risk and increasing user satisfaction and enabling the adoption of lowest cost, non-persistent VDI environments.

You can read more about this topic along with the views of industry leading Commentators and Analysts at:

IT Business Edge – Putting a Personal Touch on VDI, by Michael Vizard

Virtualization Review – All about the User Personality, by Beth Schultz

These posts come further to Citrix recognizing the need for user environment management solutions in VDI environments, as posted by Sumit Dhawan here

There are times when you need to find out what has changed in a user’s registry hive, either during their session or, more often, when they have logged out. This may be to try and understand why an application isn’t behaving the way it should, or because you are trying to find specific settings to extract and put into a mandatory profile or an environment provisioning mechanism such as that provided by AppSense Environment Manager. Here we reveal how to do you this even if you weren’t actively monitoring the registry in the session.

The SysInternals, now Microsoft, Process Monitor tool is very, very good at this sort of analysis but not if the changes to the registry have already occurred. Check it out here anyway:

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

With traditional local and roaming profiles, you can load the ntuser.dat hive file containing the changes into regedit, but unfortunately regedit does not show the timestamps that are present on every registry key. This is where the free regrecent tool comes in as it allows you to search a registry key for changes made in a given time (and date) range. Note though that only registry keys have timestamps, not values, so a registry analysis performed this way won’t tell you what values have been modified, added or deleted unfortunately but the information can still be incredibly useful. Of course, if you have a copy of the hive file before the user logged in, either from a backup, the base mandatory profile or from the roaming profile location if the user is still logged on (HINT: take a copy of the original ntuser.dat at this point and work with this file) , then you can compare the changed registry key’s values in the two hives. It also does not require administrator privileges so can be used by the (test) user before they log off.

Download it here:

http://www.appsense.com/mstools

As an aside, when doing on-site troubleshooting in my consultancy days, I used to use regrecent to tell me what had changed 5 minutes after I left site to 5 minutes before arriving to see what had actually changed even though the customer would usually swear blind that they had not changed anything at all!

I’ve always been a massive advocate of ‘KISS’ – Not the grease-paint laden 1970s glam rock band (although I do own a few dozen of their albums and sport their band logo on my arm!) – the concept of ‘Keep It Simple, Stupid’.

In my opinion, one of the most important factors in designing and building software is to ensure that the user interface, and the concepts behind the software itself, are kept as simple and intuitive as possible.

There’s no point in implementing a killer feature if that feature is too complex and too difficult to actually configure and maintain as it may result in confused end-users and, inevitably, a redundant piece of functionality.

On the other hand, by reducing the complexity of a particular piece of functionality too much, software vendors run the risk of making that particular feature totally inflexible and to some extent of little to no use to the end-user at all!

Therefore, there has to be a balance between simplicity and flexibility.

A good product needs to be designed well, proven to work and simple to understand. Take the rock group KISS as an example. They started way back in the early 70’s with a lead guitarist, a bass player, lead vocalist and a drummer. Add some make-up and a track list of great songs and a global brand was instantly created. The concept was simple.

Start tampering with a working formula and things start to go wrong.  Change the appearance (i.e. remove the make-up) and the ‘product’ becomes misunderstood. Start making things more complex and consumers become disillusioned.

“If it ain’t broke, don’t fix it!”

AppSense Environment Manager can be seen as a complex product. It can be used in a variety of ways to solve a variety of different environment problems.

So, have AppSense delivered on the concept of ‘KISS’ with Environment Manager? Have we provided a killer product that is simple to understand, yet flexible and compelling? Maybe, maybe not. There is always room for improvement. However, improvement must not come at a cost to the consumer.

Our next product release, currently scheduled for Q1 2010, aims to introduce improvements to the way the software is currently configured and maintained, without adding unecessary complexity or introducing the risk of ‘breaking something that used to work’.

So,  ‘Keeping It Simple, Stupid’ is, ironically, not a simple task. However, by adopting the concept, it may save you many ‘Crazy, Crazy Nights’ trying to put things right in the future.

Airline provider JetStar uses global recession as a springboard to analyse and reduce IT TCO.  JetStar have used VMware to virtualize their Microsoft Servers, Citrix to deliver the application set and AppSense user environment management for managing the user aspect of the desktop.

All in all through this combination of best in breed virtualization technology, JetStar state ‘cost of support at the local airports Jetstar occupies has reduced by 60 percent, maintenance is down by 40 percent, and costs of local systems and servers have reduced by 100 .  Just as importantly, Jetstar’s IT is consuming 85 percent less power due to the virtualised machines, so therefore there’s less CO2.’

Sean Walsh, VP of Sales for Australia & New Zealand, AppSense acknowledges this with  “Aviation is a tough market, JetStar have demonstrated the enablement of best practice IT costs can level out, with AppSense UEM solutions reducing and managing cost is simple”.

To read more on this article, please read at the original source here

Further reading on how AppSense reduces IT costs can be found here- and this is verified by some of our customer accounts here

Live from VMworld 09, AppSense – the world leading User Environment Management solution provider – are extremely pleased to be awarded Gold in the Best Desktop Virtualization award for AppSense Environment Manager 8.0.

AppSense beat off strong competition from Liquidware Labs for their Desktop Virtualization Diagnostics tool, Stratusphere, and Workspace Virtualization vendor Virtual Computer Inc. for their NxTop product.

Like most that witness the capabilities of AppSense, the VMworld judges said “AppSense rocked our boat… It offers the most complete user environment management system out there.”  This comes as a further endorsement (following the recent announcement from Citrix) on the importance of a true UEM solution to enable enterprise adoption of VDI at lowest possible cost over and above basic in-built profile management technologies.

AppSense Environment Manager enables IT to deliver fully personalized virtual desktops from just a single set of OS and Application images, enabling scalable user adoption.  UEM allows organizations to implement virtual desktops at much lower TCO than using Profile Management alone.  “UEM addresses not just personal settings and profile data, but also the initial configuration of a desktop, including applying user installed applications, providing a ‘follow-me’ personality with cross operating system platform support, as well as enterprise-scalability and end-to-end visibility. Personalization settings can be managed across multiple operating systems, desktop delivery mechanisms and on virtual, physical and offline devices.” explains Pete Rawlinson, VP of Marketing for AppSense.

Oliver Sills, Senior Product Manager for AppSense Environment Manager said, “As you can imagine, we are delighted to win such a coveted award at this prestigious event.  We are continually working with our customers and partners to develop the solution and I would like to dedicate this award to our strong and committed development teams who have worked tirelessly to produce such a great product.”

Looking ahead, AppSense will continue to work with customers to enable some of the largest VDI deployments in the world, along with the development of the UEM solution set… with some extremely exciting product developments in the pipeline…

A list of the winners from the other categories can be found here

Further to my blog post, the official AppSense Press Release on winning this award can be found here

Jon Wallace, Senior Solution Architect and Head of US System Engineers

Live from VMworld 2009 – A press release shows that VMware are to OEM the RTO Virtual Profiles Product into VMware View.

On the recent announcement at VMworld 2009,  VMware are planning to OEM the RTO Virtual Profiles™ technology into VMware View – this is great news, and yet another proof point of the importance of user personalization in the virtual desktop space.   It looks as though VMware have made a similar move Citrix did some months back when they acquired SepagoPROFILES for inclusion into their Xen line, and it makes total sense.

Let’s take a minute to appreciate the basic premise of how to reduce desktop TCO through virtualization.  The only way to deliver cost-effective virtual desktops is to standardize the corporate image.  However, if you standardize, then you also have to provide personalization capabilities in order to get the user adoption needed to make the transition to virtual desktops a success.  In this respect,  providing some level of personalization baked into platform solutions such as View is necessary.

By adding RTO technology, VMware will leverage the Windows User Roaming Profile -  which has been successfully used in Terminal Services environments for many years.  This will certainly ease some of the pains typically associated with Roaming Profiles, such as profile corruption and slow logon times.  However, in more complex, enterprise environments, something more than profile management is required to provide a local PC equivalent experience from a virtualized, standard corporate desktop (as Sumit Dhawan has explained here).   Personalizing a virtual desktop requires the ability to automatically set-up and configure the desktop based on the user’s role and context (e.g. what printers they can use, what drives they can access, use of peripheral devices), support for the installation and persistence of user-installed applications, as well as the application of all user-customized settings across all applications.  All these in combination are known as the ‘user environment’, and the most important characteristic of the user environment is that it is client OS and delivery mechanism agnostic – effectively providing a ‘follow me’ user personality anywhere, using any delivery method and to any device.  This is simply not possible using profile management alone, and why a User Environment Management Solution is required.

The thing is, most companies don’t have homogeneous desktop estates.  This is true in physical PCs today and will also be the case in their virtualized equivalents.  Companies typically use combinations of delivery technologies, applications (corporate and non-corporate), client OS and devices to deliver an optimum, productive working experience to their employees.  Based on extensive experience with many customers rolling out desktop virtualization projects, we know that successful (i.e. low-cost, high adoption) virtual desktops require the ability to automatically deliver non-persisted, leveraged corporate OS and apps on-demand from a centralized source.  To this fresh, clean desktop session must then be added the independently-managed user environment as described above – note this must be added selectively in response to user actions.  We are well beyond profile management now!

Adding RTO Virtual Profiles into the View offering will certainly enable VMware’s customer base to start to roll-out Windows XP based virtual desktops (Windows Vista & Windows 7 will be supported in future releases)  in a controlled way, while providing some personalization capabilities.  As these implementations start to grow, the need for a more comprehensive treatment of the user environment will become essential.

User personalization is an exciting and rapidly-growing space!  We’re working closely with VMware, Citrix, Microsoft and our joint customers to ensure successful and viable virtual desktop roll-outs …..we look forward to seeing this vital part of the new desktop paradigm grow in importance over the coming months and years!

Pete Rawlinson
VP WW Marketing, AppSense

Live from VMworld 2009 – A press release shows that VMware are to OEM the RTO Virtual Profiles Product into VMware View. Press Release can be found here

This is the seventh installment in a series of posts about the new features and options in AppSense Version 8 Service Pack 2.  (If you have not yet downloaded this latest release, you can read more info and download it from here )

AppSense Environment Manager Service Pack 2.0 introduces a new auditing event – Trigger Action Time.

A Trigger is the instigator for both conditions and actions to be processed.   For example:

Please see the screenshot below showing that when the ‘JD Edwards’ application is launched, and the user is running the application on a client within a ’set IP address range’, then a specific printer is automatically mapped as the only printer available for the application.

Click to see full size capture

In the above case, the Trigger is the  launching of  ‘an’ application, the condition is meeting both the application being ‘JDEwards.exe’ and the IP address range criteria and the policy action is the mapping of the specific printer.

Other Trigger actions include Computer Startup, Computer Shutdown, User Logon, User Logoff, Process Started, Process Stopped, Network Connect, Network Disconnect etc…

On selection, this new event is raised for every used Trigger.  This details the start time, end time and duration for the chosen trigger conditions and actions to complete.

P:S
As this is an ever growing blog topic, the previous posts on the other new features we have detailed can be found below:

NEW FEATURE No. 1 – AppSense Environment Manager 8.0 Service Pack 2 – Run As

NEW FEATURE No. 2 – AppSense Environment Manager 8.0 Service Pack 2 – Connect As

NEW FEATURE No. 3 – AppSense Environment Manager 8.0 Service Pack 2 – Improved compression and data handling protocol

NEW FEATURE No. 4 – AppSense Environment Manager 8.0 Service Pack 2 – Manipulation of files in Personalization Analysis

NEW FEATURE No. 5 – AppSense Environment Manager 8.0 Service Pack 2 – Run Once

NEW FEATURE No. 6 – AppSense Environment Manager 8.0 Service Pack 2 – Group SID Refresh

NEW FEATURE No. 7 – AppSense Environment Manager 8.0 Service Pack 2 – Trigger Action Time Audit Event

NEW FEATURE No. 8 – AppSense Environment Manager 8.0 Service Pack 2 – Stop If Fails

NEW FEATURE No. 9 – AppSense Environment Manager 8.0 Service Pack 2 – New Application Categories in the User Interface

NEW FEATURE No. 10 – AppSense Environment Manager 8.0 Service Pack 2 – Refresh

NEW FEATURE No. 11 – AppSense Environment Manager 8.0 Service Pack 2 – Registry Hive Exclusions

This is the sixth installment in a series of posts about the new features and options in AppSense Version 8 Service Pack 2.  (If you have not yet downloaded this latest release, you can read more info and download it from here )

AppSense Environment Manager Service Pack 2 introduces a new option – Group SID Refresh.

User Group Membership (and Primary Group) conditions are evaluated by using a Security Identifier (SID) token look‐up function, which is processed extremely quickly. If the SID is not present in the configuration an Active Directory lookup is performed instead.

SID tokens are added to the conditions during creation and a more time‐costly look‐up is performed at this stage.

If a configuration is copied from one discreet domain to another, for example, ‘Test’ to ‘Live’, both the fully qualified domain names (FQDNs) and the SIDs will be incorrect.

The Group SID Refresh option allows administrators to both search and replace elements of the FQDN and update the SID values to the new FQDNs.

This can also be used to refresh SID values without any replacement.

P:S
As this is an ever growing blog topic, the previous posts on the other new features we have detailed can be found below:

NEW FEATURE No. 1 – AppSense Environment Manager 8.0 Service Pack 2 – Run As

NEW FEATURE No. 2 – AppSense Environment Manager 8.0 Service Pack 2 – Connect As

NEW FEATURE No. 3 – AppSense Environment Manager 8.0 Service Pack 2 – Improved compression and data handling protocol

NEW FEATURE No. 4 – AppSense Environment Manager 8.0 Service Pack 2 – Manipulation of files in Personalization Analysis

NEW FEATURE No. 5 – AppSense Environment Manager 8.0 Service Pack 2 – Run Once

NEW FEATURE No. 6 – AppSense Environment Manager 8.0 Service Pack 2 – Group SID Refresh

NEW FEATURE No. 7 – AppSense Environment Manager 8.0 Service Pack 2 – Trigger Action Time Audit Event

NEW FEATURE No. 8 – AppSense Environment Manager 8.0 Service Pack 2 – Stop If Fails

NEW FEATURE No. 9 – AppSense Environment Manager 8.0 Service Pack 2 – New Application Categories in the User Interface

NEW FEATURE No. 10 – AppSense Environment Manager 8.0 Service Pack 2 – Refresh

NEW FEATURE No. 11 – AppSense Environment Manager 8.0 Service Pack 2 – Registry Hive Exclusions

Sumit Dhawan over in the Citrix XenDeskop group has posted a very interesting article in the run up to VMworld 09.  I’m also hearing some interesting rumors about activity in user personalization space.  Sumit makes some very important points….which are all based on actual customer implementations. 

I’m also over in San Francisco attending VMworld this week and no doubt will hear about lots of upcoming companies and technologies, aiming to address the challenges of virtualized desktop management.  It’s great we have so many brains fixed on these issues now, but remember it’s all about what can actually be implemented in a customer environment.  We have to be pragmatic.  Through working with a substantial stable of customers, we know there is a right way to address the challenges of user personalization in desktop estates, and agree with the points Sumit makes in his blog.  Looking forward to more dialog on this!

Pete Rawlinson
VP WW Marketing, AppSense

Here is a quick excerpt from Sumit’s blog post along with link:

‘On the run up to VMworld 2009, there seems to be an increasing amount of activity on the subject of user personalization in VDI.  Even Gartner has written about dynamic workspace, which has user personalization as a key element of the stack. What does this mean?  What is user personalization all about? And, where does it need to be? Let’s take a closer look…….’

The full post can be found here.

One of the great new feature with Group Policy Preferences is the ability to map printers based on a various number of criteria such as group membership, AD Site or even IP Address range. This allows for some powerful options such as being able to map all the printers physically near a user based on the computer IP address. This of course assumes that the networking team allocates the same subnets to certain computers near each other (e.g. a building or floor) but I have found this is often the case.

One of the problems that occur when you map printers with Group Policy Preferences is that if the user has a roaming profile configured and they then logon to a computer that is located in another area they will automatically get all the printers from the previous area they were in and the new area. These printer mapping can build up over time as users logon to computers in different areas they can soon amass a large number of printer mappings that can make their computer run slow especially during logon.

Normal Group Policies are applied via IP address (AD Site) are not a problem as the new computer they are logging on to has no idea of what the previous setting were or the policy falls out of scope so the setting revert back to their original values. But as the printer mapping (and all preference settings) for a user are stored in their profile then this printer mapping will follow them if they are setup with a roaming profile.

Question? So how do you map all the printers in one location but not have them follow you to another location if you are using a roaming profile?

Answer? Is a two step solution which I will go through below. There is also an optional third step that address the problem maintaining default printer mappings once a user gets back to their normal location.

Step 1. The first part is just to create a simple printer mapping that maps the printer targeted by the IP address of the users current computer.

Figure1. Create New Shared Printer

Figure 2. Target setting to only be mapped for computers between 10.1.1.0 to 10.1.1.255

Figure 3. Resulting printer mapping

The images above shows the printer “\\server\printer1” being mapped for the users that logon to a computer that is in the 10.1.1.0/24 subnet. It is important to note that we are talking about the IP address range of the computer that you want to map the printer on not the IP address range of the printer server or the printer itself.

Step 2. The second step is to delete the printer mapping if the IP address of the printer does not fall within the IP address range that you want the printer to be mapped. To do this we start by copying the existing printer mapping that we made in step 1. This avoids making any typo’s in either the printer queue name of the IP addresses.

Figure 4. Copying the existing printer mapping made in step 1.

Figure 5. Paste the setting into an unused part of the pane

Figure 6. Both printer mapping entries

Now we make the changes to the second printer mapping to change the action type and the targeting so that it will remove the printer mapping if the user logs onto a computer that is not in the subnet that we want the printer to be mapped.

Figure 7. Open the properties of the second printer

Figure 8. Change the Action to “Delete”

Figure 9. Go back to the targeting and change it to an “Is Not” between “10.1.1.0” and “10.1.1.255”

Figure 10. New target rule

Figure 11. Two printer entries to map and then clean up the printer queues for a user based on their location.

Step 3. Maintaining Default Printer Mappings

You have now configured dynamic printer mapping for your user based on location of the user. However this solution does have one problem, user normally like to set a default printer and if a user was to logon to a workstation in another location then return to their normal desk their default printer will have been reset. To get around this problem we have to change the targeting on the Delete printer option so it does NOT delete if the printer is configured as the default printer. To do this we need to look at the registry location that the default printer is saved and test to see if the printer we are deleting is the default printer and if so then do nothing.

So let take a look go back to the targeting setting for the Delete printer action and add another test that will check to see if the printer is the default printer.

Figure 12. Add a new Item of type “Registry Match”

Figure 13. Configured Registry Match Setting

Change the Match Type to “Match value data” and the Value data match type to “Substring match” as the value we are looking for will contain other information as well that we don’t care about. Make sure the Hive is set to “HKEY_CURRENT_USER” and the Key Path is set to “Software\Microsoft\Windows NT\CurrentVersion\Windows”. The Value name “Device” is where in the registry the default printer information is saved". We then set the Substring to “\\server\printer1” which is the UNC path to the printer queue. The substring value should be set to the same value as in the Path for the printer mapping and delete under the main properties for the setting.

There, now you know how to use Group Policy Preferences to map and remove printer queues for users based on their physical location to the printer even if you have user configured with a roaming profile. The default printer mapping will still follow the user no matter where they logon to however as we are limiting this to only one printer this will not have a large affect on the users logon speed nor will it result in the collection of printer mappings from multiple areas.

Citrix TV are joined by AppSense Senior Solution Consultant and newly awarded Microsoft MVP Jon Wallace (who is also the author of www.InsideTheRegistry.com ) who quickly demonstrates AppSense Environment Manager .

This session was filmed at the Citrix Synergy event in Las Vegas and demonstrates how a user environment management solution will log a user onto their Citrix session faster than with traditional user profiles.

I recently blogged about the cost of prolonged user logon times in a previous post – this video goes a great way to giving visual representation as to not only how we improve the user experience, but also ensure a more productive and efficient workforce and Citrix environment…

Did you know that Microsoft has hidden hidden files?  Apparently it’s called “client side caching”. 

Last week I was in the midst of recloning our school lab computers.  Our computer teacher had loaded the additional software onto our “master” pc and it was all ready to go.  I started the upload task on our FOG server and went home.  In the morning I found that our FOG server had crashed.  Upon examing the error log, I found that we had run out of space on the virtual drive.  The drive had 40GB set aside, but I thought that maybe I had cloned too many images.  So, with the help of one of my Linux friends, I manually deleted the corrupted image, along with other images to free up some space.  Then, I uploaded the image again.  Same problem.  Hmmm.  So, I finally checked the size of the used space on my C: drive.  It was up to 53GB!!  What could have taken up so much room?  Last time I cloned the machine it was down around 10GB.  Granted, we loaded more software, but not that much!  I found the Windows folder was the culprit, but I couldn’t find any large or extraneous files.

After googling the problem, I found a forum that mentioned ”client side cached files”.  They don’t show up in windows explorer, so I went through the command prompt and used dir /s/p.  Lo and behold, there was a hidden directory called c:\CSC with 43GB of files.  Voila!

Cause: The school lab uses roaming profiles.  Since I don’t want these profiles to be bogged down with large amounts of data, I’ve redirected the My Documents folder.  Windows XP automatically turns on offline file caching for redirected folders, which wouldn’t be a huge problem if there was only one person logging onto a machine.  But, since we have around 200 roaming profiles with a years worth of data on their My Documents, it can really add up.

Solution: Open windows explorer, click on Tools -> Folder Options -> Offline Files.  First click on Delete Files and then uncheck Enable Offline Folders.

Or…enable the global policy: User configuration -> Administrative Templates -> Network -> Offline Files – “Do not automatically make redirected folders available offline”.

BTW – 49 days and 18 hours – was the time on the microsoft counter to delete my offline files.  But, since these were Microsoft minutes, it really only took a couple hours. 

Umiddelbart skulle man ikke tro, det havde en huende fis med hinanden at gøre, men sandelig om det ikke havde. Jeg brugte en del tid i går på at hitte ud af noget, som egentlig burde være såre simpelt. Hele idéen med at køre med roaming profiles, er at ens brugere kan sidde ved en ny maskine hver dag, uden at de mærker forskel. Dvs. at deres brugerprofil kopieres til den arbejdsstation, hvor de vælger at sidde. Men dette var ikke tilfældet i denne situation. Efter lang fejlsøgning på serverniveau mht. til rettigheder mm., kunne det kun være et lokalt problem relateret til lige præcis den pc brugeren sad ved.

Efter en times selskab med google, var der klare tegn på at diverse programmer kunne lave rod med den lokale brugerprofil og ikke unloade den ved logoff, hvilket gør at profilen ikke kan kopieres til serveren. Disse programmer er ofte af den type, der laver om på Windows’ normale look, såsom Windows Blinds, iColor osv. Men i dette tilfælde fandt jeg til sidst ud af, at det var Nvida driveren. En opdatering af skærmdriveren løste heldigvis problemet. Men det er skræmmende at tænke på at netop denne nye driver blot var 2 måneder gammel, dvs. at problemet havde eksisteret i 1½ år. Efter lidt søgning på google viste det sig rent faktisk at ATis drivere også har haft samme problemer som Nvidias.

Roaming profiles er generelt noget møg, og man burde hellere bruge en group policy extension kaldet folder redirection. Men hvis man kan undgå, at skulle gemme folks profiler på netværket, så gør det for guds skyld.

Group Policy, Profiles, and Intellimirror (third edition)

Author: Jeremy Moskowitz, MCSE, MCSA, MVP

Publisher: Sybex

Suggested Publisher Price: $49.99 US / $69.95 CDN / £34.99 UK

ISBN: 0-7821-4298-2 Softcover, 536 pages (+TOC / index)

Buy the book direct from the Author (and get it signed!) (Update: this link now goes to a page for the replacement fourth edition of this book)

Everything you need to know about Group Policy in one useful reference…and loads more besides

The Group Policy Management Console (GPMC) is a dramatic step forward in the way Group Policy is administered. This book provides all the instruction and insight you need to take full control of your Active Directory with GPMC and other Group Policy tools. You’ll also learn techniques for implementing Intellimirror, making it possible for users to work securely from any location; and you’ll find intensive troubleshooting advice, insider tips on keeping your network secure, and hundreds of clear examples that will help you accomplish all your administration goals.

Topics covered:

• Create and manage all Group Policy functions within Active Directory
• Understand Group Policy differences in Windows 2000, Windows XP, and Windows 2003 systems
• Troubleshoot Group Policy using Support tools, Resource Kit utilities, log files, registry hacks, and third-party tools
• Create and deploy custom settings for managing client systems
• Manage, secure, and audit client and server systems
• Script complex operations, including linking, back-up, restore, permissions changes, and migrating
• Set up Local, Roaming, and Mandatory profiles
• Set up and manage Intellimirror components with Group Policy
• Use Group Policy Software Installation to perform hands-off installations
• Use Remote Installation Services to automate the installation of new Windows systems
• Ensure the safety of your users’ data with Redirected Folders and Shadow Copies

Review

Introduction

This book contains everything you ever needed to know about Group Policy and related topics, including loads of things you probably didn’t even know you should have been asking!

Jeremy Moskowitz covers in great depth the whole subject of group policy, as well as profiles (including roaming and mandatory), redirected folders, offline files, Shadow Copies, Remote Installation Services (RIS) and even finds time to take a preliminary look at scripting. I thought I already had a good grasp of most of these things, but this book still provided a wealth of little details, tips and tricks, up to date information and proper explanations of how all this really works. It was also an easy way to get up to date on many of the changes made with the introduction of XP and 2003, since these are highlighted.

Overview

When I first started reading this book I was not sure it would suit me. It is written in a very conversational, colloquial style more suited to a Tarantino script than a technical manual, and normally I find this irritating when I want precise answers from a reference work. However, I soon changed this first impression. Through this chatty style the author drew me in, got me intrigued by his passion for the subject and seemed to metaphorically drag me in and say “I just want to show you this other really cool thing you can do…”. I found I could read fluidly through huge chunks of the book and actually take in the information presented along the way as well – quite unusual for a book of this depth.

About 70% of the book is concerned solely with group policy – what policies are, how to create, apply and troubleshoot them, and some tips for more complex scenarios such as multiple-forest environments. It is a little difficult to split it in this way since topics like folder redirection depend on a policy for delivery but involve so much more than a mere setting and are dealt with in a section of their own.

I would guess that many people using group policy have probably dived right in without a thorough knowledge of many of the aspects the author deals with, such as exactly when and how policies are applied “under the hood”, what to do about updating templates (.adm files) for newer settings, and consideration of policies being applied across multiple operating systems. There is a great deal to be gained from the author’s experience here, such as sensible shortcuts to and best practice, as well as common pitfalls to avoid.

One area which does not get much coverage in older books on Windows network administration is the use of software restriction policies. In many cases this is because they were written before XP and 2003 made software restriction available through group policy (rather than older NT-style policies or using appsec.exe). This is one of those complex areas which are not just about ticking a box and everything works automagically, but requires proper attention to planning, design and testing before wholesale rollout. This book devotes a whole chapter to the topic to give it the attention it deserves, and recognises the importance for 2003 Terminal Services / Citrix environments as well as desktop administrators.

The remainder of the book deals with what at first appear to be only a loosely related collection of Windows tools for automating and controlling the user experience. A closer look reveals some deeper insights into things such as user profiles which are often skimmed over and taken for granted. It would be tempting for experienced administrators to skim these chapters on the assumption that they already know what they contain, but to do so would miss much of genuine use. I was pleasantly surprised to find many nuggets of new information as well as proper explanations of when to use these tools as well as how to configure and optimise them. Once more the author’s intimate style and obvious real-world experience came together and it is at times like being shown how to do things by a wiser colleague who can say “I’ve been here before, this is how I would approach it…”

The topics covered in the latter parts of the book include tools for automating installation – Remote Installation Services (RIS) and Group Policy Software Installation (GPSI). Again there is plenty of information here for both first-timers and old hands, and should be read particularly by anyone that has tried and given up on these powerful but troublesome subjects. Coverage is also given to features which were not available in Windows 2000 such as using advanced WMI filters on policies (particularly valuable for GPSI) and this may be enough to justify revisiting this. There is also a brief discussion of how all this fits with more complex tools such as Microsoft Systems Management Server (SMS).

Style, Coverage and Detail

As I said at the start, I was impressed by how well Jeremy Moskowitz has managed to take a potentially dry subject and get across many important details in a relaxed style. This is really important in the many chapters where there is a temptation to skip over things that you “already know”. By keeping the reader engaged it is almost easier to keep reading than to miss sections out.
The author makes good use of screenshots, boxed-off text for extra notes and details and plenty of cross references to other parts of the book and web-based resources. These all help the flow, keeping the important things in the body of the text and leaving you to read the extras which you find particularly relevant. Each chapter has a useful conclusion, bringing together the areas covered, rather like a lesson summary.

The amount of information in the book is a double-edged sword – I expect I will refer back to it frequently as a reference, but I found it occasionally frustrating not being able to get straight to something I knew I had read before, and skim reading large sections was quite hard. The index could have been a little more comprehensive – sometimes you have to know what heading something is under before you can find it. It is easy to get used to being handed things on a plate by search engines these days, so maybe I am being a bit harsh, but at the risk of too much duplication it could be useful if the index were expanded a little. The front and back panels of the book go some way to help using the book as a reference when you first pick it up – one highlights which parts of the book cover different group policy topics and the other lists the areas which are new, which is ideal for people using this as a means to bring old skills up to date.

As an example of the level of detail in this book, it even discusses the subtle differences between the way XP and 2003 handle software restrictions in reality and discusses how XP sp2 may change that (the edition reviewed was published when sp2 was still in Beta; the third edition expected soon will bring this properly up to date). It is this kind of attention to little details which makes this book stand out as a really useful practical reference work for the real-world administrator, especially when it comes to troubleshooting.

When I first saw the book I thought it would be a bit like a “three-in-one” – basically separate topics lumped together with a solid group policy book for padding or publishing convenience. I was not convinced there was enough to be said about profiles, folder redirection and software installation to contribute any real benefit to my bookshelf. This partly highlights how little I thought was involved in some of these topics, but this was largely brought about by many other books giving only a surface-level treatment of such things. Too often I had read other sources which I now realise only described how things appear to work, only with the latest OS in a simple environment, and assuming everything behaves as it should. The real world is a little more complicated than that, a fact which this book easily takes in its stride.

There are a few things which the author acknowledges might be considered missing from this otherwise comprehensive book such as IPSec, PKI and EFS. Clearly there is a limit to fitting in a discussion of every possible policy, and the author does attempt to mitigate these omissions by some useful URLs for relevant MS references. Hopefully some of these might get some space in the third edition as more organisations start to adopt these built-in security features.

Overall, this book covers just about every aspect of delivering, managing and controlling the user environment across your enterprise. It is not intended to cover all aspects of systems security, nor provide a comprehensive manual for writing scripts to automate non-policy events, but it does give both of these a suitable level of attention in the wider context of the whole subject of systems management.

Target Audience

I have read many MS Press, Sybex and other publishers’ titles about Windows servers, active directory design and management and been an administrator and systems architect for several years. I was pleasantly surprised to find so much information that I had not come across before in a single book. Whether you want to consolidate your knowledge for your personal training plan, update your skills from Windows 2000, or have a real issue you are trying to resolve, this is the book for you.

Conclusion

Even if you don’t feel you or your organisation are ready for using group policy extensively (although after reading this you may not be able to resist!), the rest of the book is probably justification for adding a copy of this book to your library.

This is a sound collection of tutorials for anyone who wants to give users a better experience, tighten control of their systems, increase security and do it all without leaving their desk. Rather than being seen solely as a technical reference on a few specific topics, this possibly deserves the broader title of “Managing Windows Systems (using Group Policy and Intellimirror)”.

I would say without hesitation that “Group Policy, Profiles, and Intellimirror” is an essential handbook for any administrator wanting to improve their systems for their users, the business and themselves. This book receives a hard-earned rating of 10/10, and I look forward to the third edition with great anticipation.

This review is © Copyright Adam Vero 2005 and was first published on Security-Forums Dot Com.
It may not be reproduced in any form in any media without the express permission of the author, or Security-Forums Dot Com.