anuary integratingfslogixprofilecontainers ... ·...
TRANSCRIPT
Integrating FSLogix Profile Containerswith VMware Horizon Cloud Serviceon Microsoft AzureVMware Horizon Cloud Service on Microsoft Azure
VMware Dynamic Environment Manager
17 JANUARY 2020
VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001
www.vmware.com
Copyright © 2020 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright
and intellectual property laws. VMware products are covered by one or more patents listed at
http://www.vmware.com/go/patents. VMware is a registered trademark or trademark of VMware, Inc. and its
subsidiaries in the United States and other jurisdictions. All other marks and names mentioned herein may be
trademarks of their respective companies.
Integrating FSLogix Profile Containers with VMware Horizon - 3
ContentsOverview 4Purpose of This Tutorial 4Audience 5
Prerequisites 6VMware Horizon Technologies 6Master Image for Traditional Clone Floating Desktop Assignment 6User Accounts 6Administrator Account 6Microsoft FSLogix 7
Installing FSLogix 8Configuring Network Shares 8Configuring a Group Policy Object for FSLogix 10Installing the FSLogix Agent 12
Creating and Using an FSLogix Profile Container 14Prerequisites 14Provisioning a Floating Desktop Assignment 14Verifying Profile Container Creation 15
Integrations for Dynamic Environment Manager with FSLogix Profile Containers 20Dynamic Environment Manager Self-Support 21Dynamic Environment Manager Predefined Settings 21Recommended Practices for Personalization with FSLogix Profile Container 21
Summary and Additional Resources 23Additional Resources 23Author and Contributors 23
OVERVIEW
Integrating FSLogix Profile Containers with VMware Horizon - 4
OverviewVMware Horizon® Cloud Service™ onMicrosoft Azure accommodates a number of assignment typessuch as session, dedicated, and floating, as well as application models. With a floating VDI desktopassignment, at each login, a user receives a nonpersistent virtual machine (VM) or a different VM witha different machine name. Although floating desktop assignments provide management flexibility,the user data, settings, and profiles are not persisted between sessions.
Microsoft recently acquired FSLogix and has made the software available to many of its customers.FSLogix integrates with VMware technologies to complement Horizon desktop models. FSLogixProfile Container can persist user data and user configuration data between nonpersistent desktopsessions. SeeWhat is FSLogix? for an overview and requirements of the software.
Purpose of This TutorialThis tutorial demonstrates a step-by-step method to integrate Microsoft FSLogix with Horizon CloudService on Microsoft Azure to build a nonpersistent desktop service while providing a persistent userexperience.
Note: Horizon 7 customers should review Integrating FSLogix Profile Containers with the VMwareHorizon Just-in-Time Management Platform (JMP).
Disclaimer
FSLogix is one of many third-party solutions that work with VMware Horizon. While this tutorial showsexample models for integration, VMware assumes no responsibility to provide support for the use ofFSLogix software with VMware products. As with any profile management technology, properdesign, component redundancy, backup, and other management practices are imperative to ensurea good user experience and to prevent loss of user data. VMware provides this tutorial todemonstrate functional compatibility of FSLogix Profile Container with Horizon Cloud Service onMicrosoft Azure components.
For design guidance regardingVMware Horizon, see the VMware Workspace ONE and HorizonReference Architecture. For guidance on sizing, scaling, and maintaining the FSLogix components,consult Microsoft documentation.
Horizon and FSLogix Profile Container
In this tutorial, you will integrate the FSLogix Profile Container with your VMware Horizonimplementation.
l FSLogix Profile Container is used to persist user data and user configuration data between non-persistent desktop sessions.
l Horizon Cloud Service on Microsoft Azure floating desktops deliver a newWindows 10 imagewith each user session.
l VMware Dynamic Environment Manager™ (formerly known as User Environment Manager)provides privilege elevation and other customized user environment settings, along with per-sonalization and predefined settings as needed.
OVERVIEW
Integrating FSLogix Profile Containers with VMware Horizon - 5
Figure 1: Horizon Cloud Service on Microsoft Azure Traditional Clone with FSLogix Profile Container
Each exercise in this tutorial addresses one or more components of the model described in thisfigure. Some exercises include steps that are prerequisites for a later exercise. It is recommendedthat you complete the exercises in this tutorial in the order in which they are presented.
AudienceThis tutorial is intended for IT administrators and product evaluators who are familiar with HorizonCloud Service on Microsoft Azure and Dynamic Environment Manager. You should have a workingHorizon Cloud Service on Microsoft Azure environment available for testing in order to complete thistutorial.
PREREQUISITES
Integrating FSLogix Profile Containers with VMware Horizon - 6
PrerequisitesBefore beginning the exercises in this guide, verify that you have the following software and useraccounts, and that you have created the necessary master image, which is used in a later exercise.
VMware Horizon TechnologiesThe following components of Horizon are used in the exercises in this guide. Links are included toquick-start guides, should you need to add any of these components to your environment beforecontinuing.
l Horizon Cloud Service on Microsoft Azure: Quick-Start Tutorial for VMware Horizon Cloud Ser-vice on Microsoft Azure
l Dynamic Environment Manager: Quick-Start Tutorial for User Environment Manager
Note: Although the product name has changed, the quick-start tutorial is still applicable.
Master Image for Traditional Clone Floating DesktopAssignmentThe master image described in this operational tutorial was created according to the followinginstructions:
l Import a Windows 10 1903 desktop from the Azure Marketplace, following the guidance inCreating Desktop Images for a Horizon Cloud Pod in Microsoft Azure.Important: This includes installing the agents for Horizon and Dynamic Environment Manager.
l Use theMicrosoft Office Deployment Tool to install Office 365 ProPlus in the base image usingshared computer licensing. Visit the Office 365 Client Configuration Service to create your ownconfigurations.
User AccountsThe following accounts and their associated roles are used throughout this tutorial. Simply substituteyour own accounts from your environment to conduct the exercises in this tutorial.
l Active Directory user account for end-user access: eterple.betavmweuc.com
Note: eterple has standard account privileges to the Windows 10 desktops.
l Office 365 account: [email protected]
Administrator Accountl An account with permissions to create file shares is required.
l An account with the ability to import ADMX templates and configure group policy objects isrecommended, though not required.
PREREQUISITES
Integrating FSLogix Profile Containers with VMware Horizon - 7
Microsoft FSLogixBefore you perform the procedures in the next chapter, obtain the FSLogix download bundle fromDownload and Install FSLogix.
INSTALLING FSLOGIX
Integrating FSLogix Profile Containers with VMware Horizon - 8
Installing FSLogixInstalling FSLogix involves configuring network shares, creating and configuring a group policy object(GPO) or registry settings, and installing the FSLogix agent.
Configuring Network SharesNetwork shares are used to store VHD(X) files and to centralize logging information. For moreinformation, see the Microsoft document Configure storage permissions for use with ProfileContainers and Office Containers.
1. Configure the Containers share, which will store the FSLogix Profile Containers:Note: This share will be referred to as the Containers share throughout this tutorial.
a. Create a folder at the following location \\fs1\FSLogix\Containers
b. Share the folder and configure the following share permissions:Authenticated Users – Change and Read
c. Configure the following NTFS permissions:l Domain Users – Modify - This folder only
l CREATOROWNER – Modify - Subfolders and files only
l Desktop Admins – Full control - This folder, subfolders and files
INSTALLING FSLOGIX
Integrating FSLogix Profile Containers with VMware Horizon - 9
2. Configure the Logs share:Note: This share will be referred to as the Logs share throughout this tutorial.
a. Create a folder at the following location: \\fs1\FSLogix\Logs
b. Share the folder and configure the following share permissions:
Authenticated Users – Change and Read
INSTALLING FSLOGIX
Integrating FSLogix Profile Containers with VMware Horizon - 10
c. Configure the following NTFS permissions:l Domain Computers – Modify - This folder, subfolders and files
l Desktop Admins – Full control - This folder, subfolders and files
Now that the network shares are set up, you can configure a GPO so that all clones in a particularorganizational unit (OU) will store their profile containers and logs in these shares.
Note: If you prefer not to use GPOs to configure FSLogix, you can modify Windows Registry valuesdirectly on the master image. See the Microsoft document Profile Container registry configurationreference and Logging and diagnostics for registry configuration options.
Configuring a Group Policy Object for FSLogixFSLogix can be configured using direct Windows Registry key manipulation or group policy. Thistutorial uses the ADMX template provided with the FSLogix download bundle to configure a GPO andapply it to many computer objects at once.
This environment uses a Central Store. For more information, see the Microsoft document How tocreate and manage the Central Store for Group Policy Administrative Templates inWindows.
1. From an administrator's machine, copy the ADMX and ADML files to the PolicyDefinitionsfolder:
a. Navigate to the FSLogix download bundle.
b. Copy fslogix.admx to\\DomainController\sysvol\domain\policies\policydefinitions
INSTALLING FSLOGIX
Integrating FSLogix Profile Containers with VMware Horizon - 11
c. Copy fslogix.adml to\\DomainController\sysvol\domain\policies\policydefinitions\en-US
2. Create and configure the GPO:a.a. Open the Group Policy Management console from an administrative PC.
b. Navigate to the OU where the cloned VMs will reside.
c. Create and link a GPO: FSLogixHC.
INSTALLING FSLOGIX
Integrating FSLogix Profile Containers with VMware Horizon - 12
3. Edit the FSLogixHC GPO:a. Navigate to Computer Configuration > Administrative Templates > FSLogix > Profile
Containers.
b. Configure the following settings:l Enabled – Enabled
l VHD location – Enabled, with the path set to \\Fs1\Containers
Note: See the Microsoft document Profile Container registry configuration reference fora list of default settings to be used for all options left not configured.
Now that the policies have been configured, you can install the agent on the master image from whichyour virtual desktops will be created.
Installing the FSLogix AgentInstalling the agent on the master desktop image is a simple matter of running theFSLogixAppsSetup.exe file.
Note: Administrative privileges are required to install the agent.
1. Log in to the machine you will use as your Windows 10 master image.
2. Copy the installer file to the system where it will run or to a location accessible to the system.
3. Navigate to the FSLogix installer package.
INSTALLING FSLOGIX
Integrating FSLogix Profile Containers with VMware Horizon - 13
4. Run FSLogixAppsSetup.exe to install the FSLogix agent.
5. Verify that Microsoft FSLogix Apps appears in the list of installed applications.
CREATING AND USING AN FSLOGIX PROFILE CONTAINER
Integrating FSLogix Profile Containers with VMware Horizon - 14
Creating and Using an FSLogix ProfileContainerIn this exercise, you will verify an FSLogix Profile Container VHD (virtual hard disk) is created andworking properly.
PrerequisitesBefore you perform the exercises in this chapter, verify that you have performed the following tasks:
l (Required) Create a master image from which you will create a Horizon floating desktopassignment. At a minimum, the image should include Windows 10, agents for VMware Horizonand Dynamic Environment Manager, and the FSLogix agent.
l (Recommended) Install Microsoft Office or other applications in the master image.Note:Microsoft Office is used in this tutorial to demonstrate how files, activation, andcredential data can persist from VM to VM. If Office is not available, you may substitute one ormore other applications.
Provisioning a Floating Desktop Assignment1. Create a Horizon desktop assignment using the following specifications:
l Assignment - Desktop
l Type - Floating
l Display name -HorizonFSL
l AD container - OU=HorizonCloud,OU=Horizon_JS,DC=betavmweuc,DC=com
l Number of machines - 5
Important:This desktop assignment is required for all exercises in this tutorial.
2. Verify the VMs are created in the OU where the FSLogix GPO is applied.
CREATING AND USING AN FSLOGIX PROFILE CONTAINER
Integrating FSLogix Profile Containers with VMware Horizon - 15
Verifying Profile Container CreationUse the VMware Horizon® Client to log in to a Horizon Cloud desktop assignment.
1. On the Horizon Client, authenticate to Horizon Cloud server with user eterple (that is, with theend-user account you have set up for this tutorial).
2. Connect to the desktop assignment with the display name HorizonFSL.
During the logon process, the FSLogix Profile Container is automatically created on theContainers share.
3. Navigate to the Containers share and verify the virtual hard disk (VHD file) was created.
4. Navigate to the Logs share and verify the logs are being written.
CREATING AND USING AN FSLOGIX PROFILE CONTAINER
Integrating FSLogix Profile Containers with VMware Horizon - 16
If the profile container was created, changes to the user profile on the VM will be written to andpersisted in the VHD file.
5. Run CMD.EXE and type hostname. Make note of the VM name you are connected to.
Note: Because you are using a floating desktop assignment, the VM you connect to will berandom and may have a different name than the name displayed in this screenshot.
6. Modify the user profile:a. Open one of the Office 365 applications and sign in to activate Office. In this tutorial
PowerPoint was used to activate Office.
CREATING AND USING AN FSLOGIX PROFILE CONTAINER
Integrating FSLogix Profile Containers with VMware Horizon - 17
b. Sign in to OneDrive using the same Office 365 credentials.
After signing in, you see the application file (for this example, PowerPoint) appear inthe OneDrive folder.
CREATING AND USING AN FSLOGIX PROFILE CONTAINER
Integrating FSLogix Profile Containers with VMware Horizon - 18
c. Use Excel to create and save a spreadsheet to the Desktop.
7. Once you are done modifying the user profile, selectOptions > Disconnect and Log Off to dis-connect and log off of the VM so it will be reset.
8. On Horizon Client, authenticate to the Horizon server with the end-user account; for ourexample, eterple.
CREATING AND USING AN FSLOGIX PROFILE CONTAINER
Integrating FSLogix Profile Containers with VMware Horizon - 19
9. Connect again to the desktop pool with the display name HorizonFSL.
10. Run CMD.EXE and type hostname.Note: You are connected to a different VM than the last time you used this command.
11. Verify that the changes you made have been persisted to the new desktop.l PowerPoint is activated and authenticated.
l OneDrive is activated and authenticated.
l The Excel spreadsheet remains on the Desktop.
12. Disconnect and log off the VM.
INTEGRATIONS FOR DYNAMIC ENVIRONMENT MANAGER WITH FSLOGIX PROFILE
Integrating FSLogix Profile Containers with VMware Horizon - 20
Integrations for Dynamic EnvironmentManager with FSLogix Profile ContainersDynamic Environment Manager provides a variety of capabilities for Windows-based virtual, physical,and cloud-hosted computers. The features provided by the User Environment tab are recommendedto simplify desktop administration and provide added functionality when using FSLogix ProfileContainers with VMware Horizon Cloud Service on Microsoft Azure.
Figure 2: Features Listed on the User Environment Tab of the Dynamic Environment Manager Console
As you have seen in this tutorial, FSLogix Profile Containers persist the entire user profile betweennonpersistent desktop sessions, ensuring custom application settings are always available to the enduser. Dynamic Environment Manager provides this capability through a feature calledpersonalization. Although there is an overlap in capabilities here, enabling personalization for anapplication with Dynamic Environment Manager introduces additional functionality.
INTEGRATIONS FOR DYNAMIC ENVIRONMENT MANAGER WITH FSLOGIX PROFILE
Integrating FSLogix Profile Containers with VMware Horizon - 21
Figure 3: Predefined Settings for Notepad++ on the Personalization Tab of the Console
Dynamic Environment Manager Self-SupportSelf-support enables end users to restore application settings from a backup, or reset them todefaults, without having to contact IT for assistance. See Using VMware Dynamic EnvironmentManager Self-Support for more information.
Dynamic Environment Manager Predefined SettingsPredefined settings provide IT administrators with the ability to distribute custom application settingsbased on a variety of conditions. With a single application configuration in the base image,predefined settings dynamically evaluate dozens of conditions and apply custom settings for endusers. Whether setting app defaults and allowing end users to make changes or enforcing settings sothe application works consistently with every use, the predefined settings feature adds a level ofcontrol not possible with FSLogix Profile Container alone.
Recommended Practices for Personalization with FSLogixProfile ContainerEnable personalization for those applications that would benefit from predefined settings or self-support. Leverage the DirectFlex option so custom settings are read from and written to the networkshare at application start and stop. Any remaining application customizations will be persisted by theProfile Container.
INTEGRATIONS FOR DYNAMIC ENVIRONMENT MANAGER WITH FSLOGIX PROFILE
Integrating FSLogix Profile Containers with VMware Horizon - 22
Figure 4: DirectFlex Settings for Notepad++ on the Personalization Tab of the Console
SUMMARY AND ADDITIONAL RESOURCES
Integrating FSLogix Profile Containers with VMware Horizon - 23
Summary and Additional ResourcesThis tutorial demonstrated just how quickly and easily you can integrate Microsoft FSLogix ProfileContainer with VMware Horizon Cloud Service on Microsoft Azure.
l TheFSLogix Profile Container persists user data and user configuration data for applications.
l Dynamic Environment Manager personalization features can be used in conjunction with FSLo-gix Profile Container. Use Dynamic Environment Manager when you want to offer self-supportto users, or when you need to enforce predefined settings for certain applications, which canbe applied either at login or at application launch. Use Profile Container for any remainingapplication customizations you want to persist.
Additional ResourcesBesides the documents previously referenced in this tutorial, be sure to check out these learningpaths, available on Digital Workspace Tech Zone:
l Become a Horizon Cloud Service on Microsoft Azure Hero
l Become a Dynamic Environment Manager Hero
Author and Contributors
Author
Josh Spencer is an EUC Staff Architect in End-User-Computing Technical Marketing, VMware
Contributors
l Jim Yanik, Senior Manager in End-User-Computing Technical Marketing, VMware
l Chris Halstead, EUC Staff Architect, End-User-Computing Technical Marketing, VMware
Reviewers
l Jerrid Cunniff, Product Line Manager, Horizon Infrastructure, End-User Computing, VMware
l Rick Terlep, Senior Technical Marketing Architect, End-User-Computing Technical Marketing,VMware
To comment on this paper, contact VMware End-User-Computing Technical Marketing at [email protected].