This message was deleted.

Not in my image. I keep sysinternals on a share / management server and install wireshark over there. I usually always build in an EUC tools server within an environment. If I need something like this on an image, I'll use a test machine.

I've only had to use Wireshark once, and the portable version simply would not detect the ethernet interface on the VM (XenServer). Had to actually install it within the image.

Aaahhh well..... I would be going from the vm for that, I'd be going to the hypervisor.

Have wireshark on one win10 image for a group that has frequent issues. Its appmasked so only 3 or so people can access it.

Yeah, that's the route I was thinking of going. Trying to come up with negatives for having it in the image, and am having trouble.

Only negative for me is that the people also need to be in the admin group on the VM, so that they can flip this on and off to get the nic to show in wireshark. But that may be because we are using Applayering and these are MCS non persistent desktops. Upside is i did not need to build a completely different image.

App Layering/NP PVS here. It would be me running Wireshark, so the admin thing isn't a big deal there.

There is probably a cleaner way setting it up, but it does what it needs to.

You do want to be a little bit careful here I've not done it for a while but I noticed a definate impact on network performance even with wireshark not opened with the npcap driver installed. I wouldn't install it by default in user images unless you've performance tested the image with and without npcap installed.

Network Miner is another light weight tool that acts like a wireshark.