Also, keep in mind with the User Layer with Citrix AppLayering. It's literally capturing everything as Andrew said. Every single write whether it's system related or user related. The problem is that if something gets caught in the user layer that shouldn't be there and it causes issues, you may potentially have to delete the entire disk to "fix" the problem. The User Layer is at the top of the stack so no matter what you do beneath it, the user layer always wins.