World of EUC

yeah it really depends how much conditions and options you enable. lately at a customer they had 500-600+ printers (no follow-me yet). Every printer had a condition set. It took +/- 30 seconds to processed this.

Have a good look in the log files (create a empty text file called "FlexDebug.txt" in the UEM profile --&gt; logs). Your log file will go in debug mode for that user and you can find the section which takes so long to process.

did you run the VMware OSOT fling? + built-in onedrive disabled/removed? Especially onedrive takes a long time (it's in the local profile).

There are zips with 2000 files and a bunch of complete registry hives which are getting imported

And lots of conditions which easily sum up to a few seconds

my average login time at a customer with a clean user profile + a well filled UEM = 25-30 seconds.

most of the time is the "User Shell Load Time".

yeah those zips are the killer here I think

Do you know if I can combine FSLogix with Flex?

never used FSLogix yet. Only Ivanti/RES Workspace.

Playing with the thought to change the Application settings type to "Default Settings" and just loose time in the first login. After this everything is inside my container

Something is wrong there. I setup UEM at one of our Horizon Cloud customers and it works flawlessly. It actually changed my mind about UEM, but nevertheless, the config is probably slimmer than yours.

Are you loading all application settings at login, or are you allowing UEM to load them on-demand when the application is launched?

It is a mix of applying settings at the login and some direct Flex involved. The biggest problem that the customer is synchronizing very big Explorer Registry hives + file system (Example: Internet Explorer - 120MB  .zip) It’s a huge mess :see_no_evil: I already could drop the login duration from  215 seconds to 75 seconds. There is not much more I can do there. They need to redesign the complete flex configuration and say goodbye to the many conditions they are using. The AV solution is taking a big part here as well but the security department is not allowing any exclusions. Drive Mapping, Printer Mapping is already being applied asynchron. It is nice to have the possibility to reset different applications which just killing the .zip but this comes which a huge drawback. Would love to implement FSLogix here but the customer is sticking to UEM. 

Is it just `&lt;LocalAppData&gt;\Microsoft\Credentials` ?

just looked at the documentation, they say to just add IE autofill passwords, and personal certificates... That's not really intuitive at all.

Does UEM/DEM still have the limitation of not being able to self elevate/impersonate to configure/restore HKLM without running as local admin?

I answered my own question.
```Use the Profile Cleanup feature to delete the application-specific profile information at each logout or use the Predefined Settings feature to configure the default settings.```

May also want to check <#CKBVDG48H|microsoft-fslogix> as well.

Yup. First wanted to try my luck here. Lets give it some time 

There's more activity there. VMware does have this - <https://techzone.vmware.com/resource/integrating-fslogix-profile-containers-vmware-horizon#_HZN7_Additional___Integrations_for_Dyna>

Yes official it seems to be working together. Found the same article :+1::skin-tone-4:

do you import/export the Chrome Settings at logon or at application start/end?

I've seen issues at application start/end... Always use for Chrome at logon.

never faced this at a customer. think you need to strip down the logon tasks. does every user has it?

Possibly, I know that at least half do.  Seems like it's deciding not to copy bookmarks files at logon time, so when they logoff next time, if they haven't re-created their bookmarks, there's still no file, so the new Chrome archive Zip file is then missing the bookmarks file.  Contemplating switching Chrome to create that 'roaming profile' all-in-one file.

I redirect the chrome profile to their homedir, works pretty flawlessly...  the caveat is that they can only use it in one session at a time.

Hmmm, <@ULHA2NPPX> interesting.  Lot of cache files over network, but I can see how it would work.

Thanks <@ULHA2NPPX> and apologies for the tardy reply - does that prevent use of bookmark sync with Google account?

has renamed the channel from "vmware-uem" to "vmware-dem"

Clarification: I'm referring to the Engine (not the admin UI) not being compatible.

the only good (VMware) compatibility matrix is:
<https://interopmatrix.vmware.com/#/Interoperability>
but you cannot check the "Engine" vs "Console" vs "FlexFiles". weird though...

Anyone else getting Excel profile bloat?  Many, many subfolders _within_ &lt;AppData&gt;\Microsoft\Excel.  Subfolder name appears to be HTML-encoded version of a regular filename that a user has accessed at some point.  Excel doesn't show any auto-recovery info, and no *.XAR files.  Within each subfolder is typically an XLSB file, and also a shortcut to the real file.

Thanks for question Carl, trying to get back connected, my screen-sharer at the customer is off today

image.png

The new home for the business unit formerly known as VMware EUC is now live.  You can check it out at <https://www.omnissa.com/>

The customer portal, docs site, and Techzone are also live.  You can find these at:
<https://customerconnect.omnissa.com> - note: you will need to reset your password when logging in for the first time
<https://docs.omnissa.com>
<https://techzone.omnissa.com>

has renamed the channel from "vmware-dem" to "omnissa-dem"

set the channel description: Discuss all things Omnissa UEM

Hi all,
We use DEM in combination with Crowdstrike Sensor and see a big impact on windows logon times. I already tried with Crowdstrike Support to find a solution but nothing seems to help. Anybody else who can confirm it?

We have seen the same thing. The response we get from our security team/Crowdstrike support is that "Crowdstrike is a new type of AV, it doesn't NEED exclusions!" which is obviously ridiculous. Our login times have doubled and sometimes tripled since we deployed Crowdstrike. Support has been useless and I've spoken to multiple people at Omnissa who said they are getting hammered with support requests with customers assuming that their products are the cause of the long login times that Crowdstrike is causing. Good luck and god speed!

Thanks a lot for your response. I had the same experience. Crowdstrike also told us that no exlusions are nessecary. We have to be honest no exclusions yet and all works but with an performance impact. Our logon times are not very well at all because of Instant clones and app volumes but with Crowdstrike it get worse as it was with our old AV solution. I already collected multiple log bundles with perfmon but Crowdstrike support couldn't find a way to reduce the impact. We had few weeks ago during a general crowdstrike issue in EU cluster a massive impact on logons. It tooks 10x as usual with Crowdstrike. After Crowdstrike fixing their issue in the datacenter logon times went back as normal.

We are to small (1000 employees) to make pressure to fix it.

The first thing I would do is put in all the recommended exclusions for Horizon and DEM and see if it improves. Ignore what they're saying, they are wrong.

I will give it a try again. I am not an expert in Crowdstrike yet and it seems a little bit difficult to create the exclusions in the right manner. I don't want to risk security if I exclude to much stuff.

besides your CS issues, where I also think exclusions are needed like with any other AV product.
you say that with app volumes and instant clones you login times are high?

Are you using apps on-demand or connecting app stacks to the image? - the latter one does have a negative effect on login, hence why we moved to apps on-demand. Like to understand how you use it.
How is instant clones impacting login times?

Hi Rob,
We are still using app volumes v2 (shame on me) so all appstacks are attached during logon (approx. 4-6 appstacks). I will try to migrate all our instant clones to app volumes v4 in next months. This will ofcause improve logon times. But there is still an higher logon time compared to a dedicated full clone vm, where user profile is already created. Windows will do so many thinks on an initial logon. I already did a lot of optimization with different tools. I know this is not a fair comparison.

no shaming at all, migration, preparation takes time... we all have been there. Good that you know where it is coming from and yeah Windows profiles are a B***.

Did you look at things like FSLogix to dump the profile to? that may help with speeding up the logon. Win profile tuning is a lot of work (I used to to that with RES WM back in the days and it was not healthy how much time it took to get it close enough to okay-ish)

I have no experience with FSLogix yet but read already a lot about it. It will maybe easier and faster to handle all the profile settings of win10/win11. But it will also be a new layer which could make it more complicate for troubleshooting? Especially if a customer uses multiple VDI's and FatClients and they want to roam some user settings!?

I'm not a fan of profile dumping but it does provide with very good login times as it loads instantly

CrowdStrike is correct that traditional exclusions aren't needed... But that doesn't mean you can enable every Falcon Sensor feature without penalty.  I'll check with our team on Monday, but I know they ran into similar with Falcon and our UEM.  

Ironically I'll be as CS Fal.Con tomorrow afternoon through Friday as well, so if you don't hear from me, please @ me and remind me to hit up CS badged people as well.

Found the ticket, this was with Liquidware Profile Unity, with Falcon's Additional User Mode Data - AUMD enabled, our logins were taking upwards of 5-6 minutes.  Disabled and it they returned to normal.

Thanks for the tip - we disabled AUMD and didn't notice any difference. Worth a shot!

Hi guys,
first apologize if this is kinda stupid question but I have literally zero experience with DEM...
At a (Horizon) customer we se high logon durations which are caused by "AppX - Load Packages" (seen with Analyze Logon Duration script by ControlUp).
Is there a chance to include the AppX packages into the DEM "profile" so that those AppX packages wont get initialized every logon?

No.  AppX packages aren't really portable between machines.  They're tied to the local machine profile and get reinitialized whenever a profile is created on the machine.

Hi all, I'm working with an environment which uses DEM, unfortunately there isn't a mechanism in place to delete old user profiles which is bloating storage. Can anyone recommend a script or mechanism to clean up stale profiles? I haven't seen any recommendations on the Omnissa site.

i haven't seen such a beast, but that would be a tricky one because you can't really just do "files older than X days" ..   you'd need to have something that would
• check for disabled accounts in AD and what date
• take ownership of directories in the profile share for said directories
• move or delete after ownership change depending on retention policies and what all's getting stored in there

somethign along the lines of <https://community.spiceworks.com/t/delete-mass-roaming-profiles-folders-of-terminated-users/725034>  but with more controls

really, back pedaling after the fact will be the tricky part because you may not know if those users were flat out deleted/etc too, of it they were just removed from vdi access, it'll be tough to catch that without looking at all those groups, etc..

Thanks Rob, I really appreciate that. I'll have a read. I'll need to follow up if AD is also a reliable source and if I can take into account both deleted and disabled users.

You mean profiles in a central profile folder and not profiles left behind on a Windows desktop, right?

Yeah, don't expect anything on Omnissa site about backend management, and DEM is not meant for that.

I agree with the other Rob that it is tricky, I would look for a file that you know 100% is updated when the profile is saved and match those accounts to the AD to verify their existence.

you can run a script against the AD for inactive user account, the stale once I think you can check by looking at an attribute called "lastlogontimestamp" (Hope I wrote that right)

Combine these things into a script (as the variables) and you can clean up.

I could write a blog about it for Omnissa but it feels that there are tons of those on the real windows server sites..

Hey Rob, yeah that is correct with the central profile folder. Unfortunately in the sector I work in, I don't think AD can be too reliable, I would likely have to look at when an account was last active.
Thanks for your reply though, I really appreciate it!

if you don't have a reliable source of truth for login times, you might consider adding in a logon task or something that writes a simple "last logged in" file into their profile - then going forward you could just key off that file

as Rob says, you may need to create your source of thruth

Has anyone downloaded the new DEM 2412 zip file and get flagged as a Trojan:Win32/Vigorf.A with Windows Defender?  I have scanned it with Cortex XDR and it came up clean.

I haven't seen that yet, but a quick search looks like that's come up as a false positive across a number of vendor installs over the years..