This message was deleted.

You can definitely install multiple apps into a single app layer. I would do that for digital communication layers - BlueJeans and Webex in the same layer, for instance.

So you have the Core apps that everyone uses in your layered image eg OS/Platform/Core app layers then use the Elastic layering for the App layers that should not be used for all users and need to be restricted to a subset of users via AD group

Yep, that's exactly what we're doing.

you might find this useful https://www.citrix.com/blogs/2021/02/22/how-to-approach-designing-your-app-layering-strategy/

Thanks @Rob Zylowski will give it a read

We do the same as Nick. One suggestion I would make that has made life much easier for me and my team: put your security apps (AV, Crowdstrike, etc) in a separate layer. That way you can easily publish an image without them for troubleshooting.

I second that. I ran Trend Micro Apex One in its own App layer. The only exception to this is Windows Defender, which you should absolutely run in your OS layer. Also, uninstall CrowdStrike.

We have Crowdstrike windows falcon sensor which layer you got that in ? You also using the VDI=1 switch during install and removing the tenant CID details via registry?

Yes, that's exactly what we are using, along with Trellix in a separate layer. I believe that is all that is require for sealing, Let me dig my script out...

I don't do AL at this new place, so I really don't know. I assume they build it in an app layer, and are using the VDI switch.

You got it. Just looked at our install/seal scripts. Install with VDI=1 Our seal script removes the following reg keys: HKLM:\SYSTEM\CrowdStrike\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\{16e0423f-7058-48c9-a204-725362b67639}\Default\AG HKLM:\SYSTEM\CurrentControlSet\services\CSAgent\Sim\AG

Cheers @Bill Pennie got it installed in App or platform layer?

always use an App Layer. Very few things need to go in a platform alyer and those need to be recreated alot so much better not to use them

From memory Platform layer will just be domain join , move to target OU, VDA, CWA, Wem agent , PVS target device software, GPP for group membership correct ? It's been a while since I last used app layering so may of missed something

Personally, I never apply any policies in my master images. Tattooing always seems to come back to bite you eventually.

We have a separate App Layer for all security products, including Crowdstrike