https://worldofeuc.com logo
Join Slack
Powered by
What is everyone using for UPM these days? contai...
# citrix-profilemgmt
c
What is everyone using for UPM these days? containers, file based? Any good best practice documents besides Carl's for UPM?
j
Mix and match as required. I generally still say single containers for non-persistent desktops and file-based for published apps. Persistent I always do local profiles with a UPM file-based backup running at lock and logoff.
💯 2
n
We're running CPM, but with folder mirroring in new builds, it's using a container, so a bit of a hybrid. With Teams requiring us to capture all of AppData\Local\Packages, I'm testing now to see the size difference, because if they're close, I see no point in continuing with file based over container.
j
Still full file based. I was looking at hybrid but the IOPS is moved to the file share, I don't want to lose my nice local SSD perf. You can cache container only with a full one, not accelerate folder mirroring &co. But when caching the logon / logoff was about the same than with file base, no major improvement. I still want to do more tests but so far so still prefer file base for all.
n
Well, my hybrid config was unexpected. We don't have folder acceleration enabled, which is what does that, yet it was happening. I had to select the policy in DaaS and keep it set as Disabled to get mirrored folders to sync as normal CPM files. Weird.
2.44GB for the hybrid and full containerized profile with just launching Teams. Sucks that a blank VHDX container is 196MB right at the start.
m
UPM 2507 has folder acceleration enabled by default. In all previous releases it was disabled as default. Nick, what's this about Teams requiring all of AppData\Local\Packages? I'm struggling with 2507 and Teams and perhaps your comment is related.
n
But MS's docs don't state that.
c
citrix says to ignore MS: If Accelerate folder mirroring policy enabled, configure the exclusion list with the following considerations: • Don’t follow Microsoft’s recommendations to exclude folders.
m
That may be the problem. I have implemented Microsoft's recommendations and they have worked fine through the last 2 LTSRs. As of 2507, Teams authentication goes to hell. I have figured out it isn't UPM 2507 causing the issue either. It's something with the 2507 VDA.
I'm not doing accelerate folding mirroring because we will quickly run out of disk space as it provisions a large container instead of taking what it needs.
n
Also, you're talking about exclusions, but the section right above that is Citrix stating to roam Packages
m
I have all default excluded directories enabled except AppData\Local\Packages. I am mirroring the Packages\MSTeams_8wekyb3d8bbwe folder.
n
That's my next test once this last test finishes. Been watching the profile sync all of Packages for 45 minutes now.
m
I am not syncing any other package folder. But if that's a new requirement, maybe that's my problem.
n
Well, I'll post my results if I ever get a chance to test them.
j
Matt, disable accelerate mirroring to disable the container creation. Brand new working profile is under 100MB. I like it.
m
I disabled accelerate mirroring after discovering Citrix changed the default behavior of the policy. Unfortunately it didn't fix my Teams authentication issues post-2507 upgrade.
UPM 2402 randomly crashes for me and I'm told it's fixed in the yet-to-be released 2402 CU4 and 2507 initial. So this month I'm dabbling with a 2402 CU3 VDA mixed with UPM 2507 because of my Teams issue.
j
How do you authenticate for Teams? What OS? It works for my UPM 2507 and W25. We are not hybrid, just modern authentication with ADFS and we roam the AAD in packages which now contain the cached token.
m
Server 2022 desktops, domain joined, ADFS
n
This new environment is Server 2025, hybrid joined, Okta Silent Activation (no ADFS).
j
I have the setup than you Matt, 2403 CU2 and it works. Same for 2507 and W25.
m
It may be the mirroring of the aad folder that's making it work for you
n
Which would be funny, because MS told us explicitly to never roam that folder with CPM.
j
yes totally without it I had the auth not roaming.
j
Never do anything MS suggest
n
My setup works with acceleration enabled. Teams can roam just fine. Gonna disable that and validate that it works with accel disabled, too. I am not roaming the AAD folder, just a handful of folders in Packages.
👍 1
If it does, I'll post my CPM config
Weird. Removing acceleration no longer captures the items I have in Folders to mirror.
I'm just unable to get the MSTeams folder to mirror with accel turned off. We're excluding AppData\Local, but including AppData\Local\Packages\MSTeams and a few others in both Directories to synchronize and Folders to mirror, as you need to do both per Citrix: https://docs.citrix.com/en-us/profile-management/current-release/how-to/config-folder-to-mirror-and-exclusion-backup.html#priority-or[…]re-writeback If somebody has this config working for CPM file-based only, can you post your settings? I submitted a ticket, but who knows how that'll go.
j
I couldn't get it working without enabling the default exclusion. That's how I got it working and why I am excluding folders from /packages. I have attached an export from my GPO. I hope it helps!
UPM-File-Teams.htm
n
Damn, so you're really syncing the entire AppData\Local\Packages folder? That's a ton of data
j
Not with my exclusion, a /packages folder is around 22MB, 629 files.
n
One thing I see right off the bat is that you don't have the paths added to Directories to synchronize, which Citrix says is required for newer builds
Just so I'm clear, if you look in your Packages folder on one of your profiles right now, you have basically all of the standard folders in there, right? You're not just capturing MSTeams and the one or two others?
j
I sync the /packages via Default exclusion list, I needed this enabled also for O365 authentication to roam then I exclude. What paths should be included?
n
I'm only looking for the MSTeams path, really
j
That's correct, I have all packages in there but most are empty, again it's only 22MB. I couldn't also get it working the way you're trying to. I found this way and it works well for me except a slower logoff due probably to all those Teams exclusions. So if you find a better way, more than happy to use it.
n
I created a new test policy, and now it's syncing everything, even though it shouldn't be. I really fucking hate CPM at times, man.
j
Can be tricky but I prefer it over container hehe
n
AppData\Local in exclusions, and only AppData\Local\Packages\MSTeams_blah in sync and mirror... and it's copying everything in Packages.
I prefer container, honestly. Just comes down to storage. Gonna try and convince everyone to just use folder accel for this.
j
Yep I know I ran into all this crap months ago. Prob with folder acceleration is the Teams IOPS happens on the storage and I found it slower. And also all profile were using an extra 200MB ... so I chose the 22MB :)
n
yeah, I don't think I'd win this war. Too many users, and it would add up quickly.
Flip side, I'm on minute 10 waiting for the 147mb of data to get copied to my profile. I can see this being a disaster if somebody bounces the VDA, or if a user connects to a new session before this completes.
Yesterday, roaming the entire Packages folder... one hour for the full data copy. 2.4gb in content, and all I opened was Teams and Edge.
j
It's slow! UPM bit is 20sec for logon and 1min for log off.
n
Still waiting on the profile sync, lol. This is absolutely not going to fly
@jvitech: Any reason you have a few non-standard exclusions in your list? I'm comparing it to this list: https://learn.microsoft.com/en-us/microsoftteams/teams-client-vdi-requirements-deploy#disk-footprint---key-folders-and-location
j
Yep it's to avoid a large Teams folder. But the one I exclude are not significant one. No impact for the usability. Try my conf it should work...
n
Good deal, that was my plan.
👍 1
Even with the exclusions, sync is taking forever. Going on 38 minutes right now.
our shit ass storage for profile management is likely a big issue
j
Man that's really bad, we use local SSD for our profile servers. It's tricky, lot of files. How was it before Teams?
n
We use Webex right now, and it's not bad.
It's not even the size, it's the sheer amount of files that Teams generates. Such a shit app.
j
Yep nb of files is the killer. Those Appx are also crap ... Very tricky to get right. Still mad that you have such a long sync time. How many files in /packages after a log off?
n
I want to say it was around 1k files in the MSTeams folder post-sync
That's with all of your exclusions
Some of the non-MS provided ones didn't have many files, so it wasn't saving a ton
Going on 53 minutes and still syncing, lol. This is actually amazing.
j
Hm I have 629 on my day to day Teams profile. Still a lot but I can't do better without compromising user xp. Yes my extra folders can grow overtime, I spot them in some profiles, not all.
n
Keep in mind, this is with me launching Teams and then closing it 5 seconds later.
j
This is mad 53 min, I can't see how I can do just 1 min with 2 UPM profile servers even with SSD. Prod is 2402 CU2 / W22 and I tested on W25/2507 and no prob
Was Teams fully loaded?
n
yes
Well, I'm also seeing that the exclusions aren't working for me.
j
OK it would explain it, you must have a setting different than me. As it works 100% for me.
n
Bare minimum configured. Everything else missing in the screenshot are the remaining default exclusions.
Ignore accelerate folder mirroring. That was not enabled for this session.
I will have to try removing the folder from Directories to synchronize, since you don't have that enabled
j
I know I've spent some serious hours to get this right, a lot of testing like yourself. I could export my GPO if needs be but there is some client data in it so if I could avoid it, I would.
n
Nah, you've already done enough. I use DaaS for CPM policies anyway, and it's not like Citrix provides a way to import this stuff.
I'm going to create another policy using your exact setup to see what I get.
Your settings don't work for me, either. No capture of the MSTeams folder in Packages on the first logon. Rob told me that he had to launch his desktop twice to get that to sync, so trying that now.
wait, nevermind, it's still running. And now I do see it. Weird, the LockFile disappeared for a minute or two and then showed back up.
j
I exclude some folders not related to Teams, I have AppData (it could be the one making it work), Application Data, Local Settings in Exclusion list - Directories. And then it's really app specific. My sync works first logon.
n
It's working for me. I don't think I can roam all of what you're roaming (AppData\Local). First logon took 15 minutes to sync.
j
Exclude AppData directory, that's the missing bit ... if it's not working. I'll send you my conf without any change.
n
Add AppData\Local to Exclusion list - directories?
Second logon took 8 minutes to sync. I guess it's better, but that still won't fly here.
j
No add AppData - In my setup I exclude everything and I include only what I need.
n
Okay, well we aren't that restrictive, so adding AddData\Local should do what we need it to do. Still weird that your config works with basically the same settings. We have a few other options enabled but I don't see how they would affect anything.
j
I'm redoing an export without any change on the folders so you can see how I'm doing it.
n
The only big difference is that you are not synchronizing the MSTeams folders and stuff, whereas we were (per Citrix's docs). Gonna laugh if that's the issue in our config.
j
I am via the mirroring \packages folder
n
We had a ticket open with Citrix that forced them to fix a bug dealing with Logon Exclusion Check. If enabled, which it is in both of our environments, it doesn't honor something unless you add everything you have in Folders to mirror to Directories to sync. Let me ask one of my buddies what that issue was for.
j
There is defo something misbehaving, I had to play with the settings to get it right. I've attached my full working conf.
UPM-File-TeamsWorking-v2.htm
n
Now that's an exclusion list, lol
j
That's for my full w22 profile, 72MB, 1,379 files. \Packages folder is 24MB 636 files.
n
I have tried to get people to consider going lock it all down, include only what you need, but we have so many apps - many shit ones, too - that it's just too much trouble.
j
It's tricky indeed, it took me a lot of work to get it right.
n
@jvitech: FYI, looks like one of your exclusion paths is wrong? LocalCache\Microsoft\MSTeams\*PerfLogs* should be LocalCache\Microsoft\MSTeams\*PerfLog*
j
OK thanks, I don't have this folder locally so I am not sure, it was prob recommended. Did you get this working? I found multiple blog referring to PerfLogs so I think it's correct. Anyhow no big deal on this.
n
With file based CPM, yes. Just doing testing with certain exclusions to see if we can do better. Testing your exclusions now.
👍 1
I'll post everything here once done, but right now it's not looking good for logoff times, lol
j
Logoff is slower than logon prob because the exclusions ... but I can't do better so far. I'm working on W25 and UPM, hopefully I'll be able to do better! Anyhow my log off is 1min because of Teams.
n
1 minute?! My initial test had a 22 minute logoff
second logoff was 6 minutes
I'm testing worst case scenario (VDA in different datacenter than profile storage), but plenty of users will be doing this
16 minute logoff on the first session with your exclusions
j
Mine is a solid 1 min constant with the conf I've shared.
n
I'm going to re-run my tests with your exact config again, in case I missed something.
Gotta be something in our environment, between storage and network. Your exact config is brutal... going on 25 minutes now, which is somehow slower than our older config that didn't exclude half as much as you do.
Genuinely wondering what we'd lose by simply not roaming Teams at this point.
j
Just a slower launch, good bit of bandwidth required, not ideal. That's mad that you are at 25 min, even with a better storage that's too much of a difference. I'll try to do more tests but I'm up to my eyes so it may have to wait next year ...
n
I checked the logoff time for that last test using your exact config... 79 minutes, lol.
j
That's mad! Something doesn't make sense. Also I was working on W25 and I figured out something. Even if you add a folder in "Folders to mirror" it's not enough, you also need it in "Directory to synchronise" specifically if you exclude the the parent folder like I do with excluding AppData. My AppData\Local\Packages were not roamed and I had this Teams error "We can't open this msteams link" until I added AppData\Local\Packages to Directory to sync. I don't know if you tried that but that's what I did to figure out this one, just create a brand new policy with only Teams stuff. Anyhow I'm working on this new UPM policy and will try to keep this packages folder tiny.
n
Yes, gotta add to both Sync and Mirror in newer CPM.
j
This 2507 totally misbehave with the exclusions compared to 2402 CU3! I'm trying now 2507 CU1 and I hope it will work better.
n
Here's my working config in 2507 (sorry, we're so locked down that this is the best I can do): https://imgur.com/a/M3xhQCM On my last test run, the initial logoff was just under 11 minutes. Around 3 minutes for subsequent logoffs. This is worst case scenario in our environment as my home drive storage is in a different datacenter than where these VDAs live, and the data is not replicated. A coworker ran through the same tests and was getting sub-1 minute logoffs on his profile that is replicated between sites. So that's gonna wind up being our requirement/recommendation.
j
Thanks Nick! Your logoff time is not bad now! this \packages folder is killing it, it's hard to do better. Did you manage to only have the packages you want? One main diff and it seems to be the prob now with 2507, I can't exclude all and only include what I want. I need to exclude what I don't want and that's it. That's not as good, it needs more management ... still a big change IMO
n
Excluding individual folders in Packages does work when doing file-based, but the second you go container (folder accel), that stops working. Kinda wild. We will likely exclude more folders in Packages, but for now things look good. My current profile is 451mb/1224 files, and the vast majority of that is Edge, so I know I have more to exclude there.
and that was in AppData\Local\Microsoft
j
Thanks Nick! It's file based for me, the mirror folders doesn't work as expected with my test when I exclude AppData, something is weird. I am doing more tests! 450MB is large, my Edge inclusion are good but I exclude all and capture only what I need, I know it's different for you. Treesize has been invaluable to manage UPM.
n
lol, using WinDirStat right now to whittle it down. Excluding ProvenanceData and component_crx_cache alone removes 350mb, and neither appear to be needed (Ivanti has an article on it).
😂 1
Got it down to 100mb/1290 files (more files? lol) after the new exclusions.
FWIW, these are my Edge exclusions:
j
100mb is not bad, each browser take 20Mb ish then Teams. Still fighting with Teams, excluding entirely AppData seems to cause the issue.
n
Exclusion functionality in CPM is shit, and I wish it would change. If you exclude a root folder, you basically can't sync directories underneath it if specified.
Dir to sync should override exclusions.
j
That's the way it used to work, it's even in their documentation! An inclusion takes precedence over an exclusion higher up in the folder hierarchy. An exclusion takes precedence over an inclusion higher up in the folder hierarchy. https://docs.citrix.com/en-us/profile-management/2507-ltsr/configure/include-and-exclude-items
n
Ha - this is hilarious. It was previously a bug in CPM, and was fixed thanks to one of our tickets. So I guess we're sorry?
At any rate, with updated exclusions, we're at 62mb/1080 files. I think this will work for us.
Do you see 'Getting Teams ready for you' or something like that each launch? I swear that's normal, but now cannot tell.
j
Yes probably the bug is back ... I'm trying 2402. No I don't because I roam the IndexedDB, it's probably too many exclusions.
n
We're not excluding IndexedDB
and I do see it in my saved profile
Gotta be one of the other exclusions. I can play around with it more.
I'll play around with it to see if I can figure out which one, because I'm basically using the same exclusions that you have listed.
j
OK prob something else !
n
Okay, so I see "we're setting things up for you" at every start, even on my persistent VMs, so I think this is 100% normal
Even logging into this NP VM, launch teams, exit, relaunch... I see the message. Doesn't affect timing, so I'm going to roll with the current CPM config.
j
Great stuff Nick
7 Views
Open in Slack
PreviousNext
Powered by