This message was deleted.
# citrix-wem
s
This message was deleted.
j
I'll let Sharp reply with actual wisdom, But i remember this being asked way back and the feedback was that it would be pretty much the same - I'm interested on if that logic has changed or not
s
You are right. they are pretty much the same. I prefer to assign to AD groups directly. For this case, the agent queries AD first and then retrieves the actions matched with current users/groups to execute. If you assign the action to everyone and use filter/condition, the actions will be retrieved always and the agent will skip or execute it after the filter is evaluated. Assigning the actions to AD groups directly will only reduce the action numbers needed to evaluate the filter.
👍 1
j
The sort of general thing I ran with on bigger deployments was use direct assignment as a general approach, and then user filter rules for the more advanced scenarios or exclusions to that rule (like not member of this group) etc.
r
Thank you both
Coming back to this after having some time to think on it. I have no real data to go with my theory, but looking at it from a processing aspect. It would seem that: 1. "assign to AD groups directly, the agent queries AD first and then retrieves the actions matched with current users/groups to execute" would be able to match faster compared to "assign the action to everyone and use filter/condition, the actions will be retrieved always and the agent will skip or execute it after the filter is evaluated." 2. Just a theory though, but I did see yesterday when a customer has a good bit of filters/Conditions for AD groups ( match this or match that, or match both, it can take up to 20 seconds or longer to go through and apply what it needs to do on each log in for NP machines. Granted that the WEM cache is stored on the C drive, and my mind continues to go back to persistent location and the use case that "Use accelerate for cache" would help here more, vs keeping it on the C drive. 3. I keep going back to this. "_Use Cache to Accelerate Actions Processing_ This option can significantly reduce logon times, as the agents no longer need to connect to infrastructure services to retrieve relevant settings. Instead, agents can use the settings in the local cache, resulting in faster processing of actions and a faster logon time" Well, if you keep it on the C drive for NP device, there is nothing to accelerate action processing, because the cache is being pulled down again each login. The article goes into stating "By specifying a persistent location, the “LocalAgentCache.db” file will not be recovered after restarting the machine, and the WEM agent doesn’t need to perform a full synchronization every time the machine starts up. Additionally, choosing a persistent location ensures that local optimization data and statistical data stored in LocalAgentDatabase.db will not be lost after restarting the agent" I know WEM will still Function if you don't do this, but will it speed up these actions, and the WEM GPO processing that many of us are seeing that is hit and miss on applying at the right time? To clarify, even more and ask in a more direct way will the GPO settings apply faster if the cache persist? This seems to be another area of delays myself and many other have noticed. The article give a PVS example, and it can be taken that hey that only applies to PVS, but I think they just gave an example in the use case. Again I love WEM, But I am trying to really put logic behind how to make it as quick as possible when it's heavy used in environments that pertains to NP machines only. I also understand that I could be really overthinking this. But ideally it's really around the most optimal setup for speed around settings. I had a customer a couple weeks ago, where the GPOs were not applying 100% again from a WEM side compared to the GPMC they were previously using, and they were disgruntle about it and let me know how they felt. For me it's hard to hear this, because in the back of my head, I seen this many times in other environments. So my thought is, well is it they way the Cache disk is being handled here? Or is there a timing issue going on and maybe people are just not using the GPO side because of the native MS GPMC just works for the computer side? IDK, just my thoughts and looking for some tips here. Maybe @Anthony Shi or @Yan Wang https://www.citrix.com/blogs/2023/07/11/improve-environment-stability-and-performance-with-wem-agent-caching/
j
I think you are over thinking the cache bits. It doesn't matter if it's PVS or MCS, you need a healthy and .unique. cache per VM. Unique is important and is what caused a LOT of problems before the new switches were brought in to make sure that the Cache is unique to each VM at the right time. It used to be easy to just say "for PVS, persist the cache" because it was kind of hard to do that in MCS. Additionally, If you stuck the Cache on the MCS base image C drive and then provisioned it out - uh oh, it's no longer unique and the algorithm would not process things properly (you would have stale settings until the next proper refresh when things got made unique again - this could be a 30 minute delay and it was randomised). Now it doesn't matter, the agent itself if configured properly, has the ability to ensure a unique cache regardless of the location. I do suggest that as part of startup though (with BIS-F), that if you have any issues in an environment, then force the refresh to occur on machine startup so it's ready for the user. For point 2, WEM should be processing those filters very very fast, there shouldn't be much difference between filter rules processing and direct assignment, in my experience, the difference is so tiny its barely noticeable. If you have processing delays on either, then there could be other things going on with either config, or Directory Services. You would have to have a ridiculous amount of filters for it to be taking a long time in a healthy environment based on my experience. For point 3 - "_Use Cache to Accelerate Actions Processing"_ This only accelerates actions assigned to the users, it means WEM doesn't need to reach out to the service and get the info in a back and forth fashion. The point around not having a cache is not really a valid one, because if you don't have that cache, there is something wrong already. This setting makes a MONSTER difference, but again, doesn't apply to everything that WEM processes, just action processing For GPO processing, I will leave to the brains trust to comment as I don't have a use case to use it. GPO, if ADMX based and not needing advanced filtering or targeting, is pretty bloody efficient. I don't see the point in moving it all around unless there is a clear need. Sure WEM can do it, but again, if you don't have the advanced GPO targeting requirement that WEM brings in, then why move it at all? You won't see logon differences from ADMX configurations being moved, you will sure as hell see an improvement from CSE based settings being stripped out 🙂 If you have no GPO/AD environment and you need GPO settings applied (AzureAD joined etc), then WEM is the go in that space
👍 1
s
Great summary! WEM's cache significantly boosts performance and ensures agents continue functioning when briefly disconnected from the broker. Regarding GPO handling, both MS GPMC and WEM can manage GPOs. WEM's GPO only requires WEM admin permissions for configuration, and alleviates the load on AD servers. As for the issue you mentioned about improperly configured GPOs, we'll need to review the relevant WEM logs for analysis. If agents fail to communicate with the broker and retrieve the latest GPO settings, it might lead to incorrect application of the updated GPO configurations. This is just my suspicion. We need to check the WEM logs to identify the issue.
j
@Sharp Guo would it be fair to say that GPO processing by WEM does not have anything to do with the cache? Or do you cache the GPO objects the same as you do other actions types? Specifically when dealing with user based GPO?
s
The GPO is just like other actions. It follows the same cache mechanism for both the machine based GPO and user based GPO.
🍻 1
r
@James Kindon yea, you are spot on with me over thinking man. I agree with you . I really value your opinion here, and trust your advice. So thank you for the guidance. @Sharp Guo the same applies to you as well. Okay, that is good to know. So the GPO side is like an action and it's cached. Thank you both for your time and the help here.
🤘 1
s
By the way, the agent AD query cache is added in WEM cloud 2309.2 release. It can accelerate the assignment process by caching the AD query result. Then the assignment to AD group directly may be faster in this case.
r
@Sharp Guo thanks for the info, I will go read up on that more to see if anything is needed to flip on or not.
Found it. Thanks man. I missed this.