For anyone that’s ever worked on a helpdesk, as a desktop administrator or Terminal Services/Citrix administrator it’s no news that user profile management is, and has been an issue since forever. 

Let’s define the problems with Windows User Profiles:

1.  Profile Corruption - Users logon and their profile does not load, leaving them with a temporary profile without any of their personalizations

2.  Logon speed (or lack thereof) - as profiles age the ntuser.dat file grows and the number of files associated with the user’s profile increases.  These cause the user’s logon time to increase over time, starting at 10-15 seconds when the profile is new, and increasing to minutes as time goes on.

3.  It’s not generally accepted to use the same profile for diffent OS, i.e. XP and Server 2003.  In an environment with Terminal Services this typically leads administrators to using two completely different user profiles, for example one for the client OS and one for Windows Terminal Services.

4.  Support for application silos - In a Terminal Services or VDI environment users may access multiple hosts to get their applications, often without their knowledge.  Administrators have the option of using local profiles for each system, or risking use of roaming profiles getting bloated and corrupted due to the registry, start menu and app data being populated with items that have nothing to do with the system being used.

5.  Local user profile cleanup (or lack thereof) -  These profiles can consume massive amounts of disk space on shared systems, so administrators usually have to account for this space, or write scripts to delete them.

Via acquisition of Provision Networks in 2007, Quest acquired one of the only commercially available User Profile Management solutions.  The problem was that it only supported Windows Terminal Services.

In January of 2009 Quest released vWorkspace 6.0, the successor to Provision Networks Virtual Access Suite.  in vWorkspace 6.0 User Profile Management (also known as Metaprofiles) now fully supports Terminal Services, Virtual Desktops and Physical PCs.

So how does it work?

User Profile Management in vWorkspace is a client-server application, where there is an agent on the Virtual PC/Physical PC/Terminal Server, and one or more storage servers for maintaining the user settings. 

Everything is managed from the vWorkspace Management Console, and the components are:

Quest Metaprofiles Agent - Installed on virtual and/or physical desktops running Windows XP/Vista, or Terminal Servers running 2000/2003/2008.  Responsible for downloading compressed user settings (xml files) from the storage server, applying the settings at logon, exporting the settings deleting the local profile at logoff.

Quest Metaprofiles Storage Service - Installed on a Windows server OS hosting the storage service.  This is typically a dedicated virtual machine but could also be on a physical server.  Since this is a client-server application, there is no Windows File Share associated with the storage service.

Quest Connection Broker Service - responsible for directing the Metaprofiles Agent to the correct Storage Server.

A typical deployment of Quest User Profile Management consists of:

1.  Customized local Default User Profile, containing the minimum base user settings for all users logging on.  Common tweaks include removing desktop icons, favorites and eliminating the “Customizing your user preferences” dialog that appears logon for the first time.

2.  Use Group Policy to redirect My Documents, Desktop, Application Data and Start Menu to network file shares, so theses are not copied back and forth at logon/logoff and so roaming profiles are not configured.

3.  Define the application settings that users may customize, which users may customize the settings and on which desktop groups or terminal servers the settings will be applied.  These may be registry entries, directories or files.  Best practice would be to let GPO Folder Redirection manage the majority of files, and only use Quest User Profile Management for specific individual files or folders that are not handled by GPO.  Settings may be marked as “global”, meaning they will apply on any system, or “silo”, meaning they will only apply on specific desktop groups or terminal servers.

4.  Install the Microsoft User Profile Hive Cleanup service to ensure that user profiles are successfully unloaded at logoff.

What are the benefits of implementing Quest User Profile Management:

1.  Stable User Profiles - reduced administrative overhead and helpdesk calls

2.  Fast user logons - typically about 10 seconds, vs 30-60 seconds with roaming profiles

3.  Reduced storage requirements for profile data, since only compressed deltas are maintained, not the entire user profile

4.  Reduced number of Virtual PCs to maintain, as administrators can deploy non-persistent (temporarily assigned) desktops, where the user settings are dynamically applied at logon.

5.  No need to cleanup local user profiles or configure mandatory or roaming profiles.

6.  Quest User Profile Management is included in all versions of Quest vWorkspace, so it’s another critical feature that won’t require the purchase of another 3rd party user profile management tool.

One of the core design goals in Quest vWorkspace is to supply customers with a agnostic application and desktop delivery platform. We aim to take this design goal as far as our customers ask us to. At Quest we know that just providing users with applications and desktops is only half the proverbial battle. There also is a lot of administrative effort associated with the management of these published applications and desktops. Management of existing user sessions is a perfect example of this. An existing Quest vWorkspace customer that was using Quest Terminal Servers very heavily was slowly but surely also deploying VDI to facilitate certain usage cases (in this case their remote developers). As the VDI environment grew so did the support requirement. They wanted to be able to use the one vWorkspace Management Console to also manage the sessions of their VDI users.

That’s why in this vWorkspace feature spotlight I would like to talk about the enhancements we made to session management in vWorkspace 6.0. What we’ve done is taken the session management tools that were available for Terminal Server and also make them available for desktop sessions (note that we say “desktop” on purpose because VDI for us is just another “desktop”). So this means that you can Remote Control (or Shadow for those Terminal Server lovers out there) any session running in a vWorkspace farm.

So you can still view all the Quest Terminal Server sessions running in your farm and manage them as you were used to. In addition you now can do exactly the same for desktop sessions running in a vWorkspace farm. We even have created a special, unique, option in our management console that provides a single consolidated view of all user sessions, regardless of the delivery method used. Take a look at this example:

The screenshot shows the session differentiated by delivery platform but you can sort by any criteria you , such as user name. I sometimes say that the mere fact that a desktop is going to virtualized does -unfortunately- not mean that they are going to be perfect and self-managing. For example: users will still contact the helpdesk to complain that their “computer has frozen up”. The patient and understanding person and the other of the line will now to terminate (no offense Microsoft) explorer.exe. This can all be done from our console. Take a look at these screenshots that show the querying of the processes running in a certain desktop session:

And the subsequent unfortunate termination of the explorer.exe proces:

This way vWorkspace 6.0 is able to provide a seamless session management experience regardless of the delivery platform used, all from a single console. No need to buy another tool or upgrade your license just to be able to manage all of the users in your environment. Remember that our advanced delegated control capabilities allow you to use this feature even more efficiently.

In vWorkspace 6.0 one of the many features we have released is the virtual machine reconfiguration tool.  This tool allows changes to virtual machine memory and virtual disks.

This introduces the ability to change the virtual machines disk mode.  The available modes are Persistent and Non Persistent. When using non persistent disks changes are not saved during the session and are lost at the end of the session (that is, when the virtual machine is powered off or reset). Non persistent  disks are convenient for people who always want to start with a virtual machine in the exactly the same state. 

Example use cases include providing environments for software testing, technical support users, demonstrations of software, or maybe to provide software installation classes for students.

As with many features in vWorkspace there is great flexibility in how you can leverage the disk non persistence feature. To help you understand how this feature can be used, we have created a small guide. The guide will describe the following:

• Supported Virtualization Platforms
• More detail on disk persistence
• Use cases
• How to configure disks on newly deployed virtual machines
• How to configure disks on existing virtual machines
• The methods to revert to the original virtual machine state
• Other considerations

Download the guide here.

Expanding on the existing integration with hypervisor management tools, we have introduced the ability to reconfigure the memory of a Virtual Machine or a group of Virtual Machines. This is a useful feature should the requirements of a User change and the memory need to be increased or decreased. This feature can also be used to change the memory configuration when provisioning new desktops from a template, should the memory size in the template be insufficient.

By simply right clicking on a computer name and selecting ‘Reconfigure…’ you can access the memory configuration tool, this option is also available when you right click the computer group. Please see the screenshot below:

As well as changing the memory size on the fly you can schedule a task at a computer or computer group level. This is done via the ‘Properties -> Task Automation’ option when right clicking a computer or computer group, please see the screenshot below:

Finally, you can set the date and time as to when you would like the change to occur, you may wish to apply the change out of hours to reduce impact on users:

Example use case:
Company XYZ has a pool of 100 virtual machines that are configured with 512MB RAM. Due to a new release of an application used by this pool of machines, such as Visual Studio, the memory size needs to be increased to 1GB RAM. This tool would allow you to schedule the memory increase to occur outside of working hours, if there was an immediate requirement to apply this change it could be done at a group or individual computer level.

Products such as Quest vWorkspace are often classified as “connection brokers”, for accessing and managing virtual desktops (VDI).  What you might not know is that one can do quite a bit with vWorkspace Desktop Edition, even if one doesn’t have any virtualization infrastructure. 

The following features are well suited for the physical desktops companies currently have today, as well as the virtual desktops they might be planning to deploy:

• Delegated Administration - the vWorkspace Management console can be organized by location/company/department… and administrative control of each object on the console can be delegated to the appropriate IT Personnel. For example, perhaps helpdesk personnel should only be able to remote control users desktops and reboot their PC, whereas 2nd level support may install software, and 3rd level support can use every feature of the vWorkspace Management Console. 
• User Profile Management - Delivers administrator authorized user customizations onto physical or virtual desktops (XP, Vista, 2003 or 2008) without using Roaming Profiles.  This decreases logon times, provides a stable user environment and reduces helpdesk calls.
• MSI Package Deployment - administrators can deploy, update and uninstall MSI packages on desktops from the vWorkspace Management Console.  The Quest vWorkspace Tools for the Managed Desktop (pntools.msi) can even be pushed to individual, multiple or all of the PCs in one’s environment from the vWorkspace Management Console.
• Desktop Management - Administrators can log users off, reboot their PCs, put PCs into sleep mode, wake up PCs that are in sleep mode, shut down or reboot a PC, view and optionally kill processes running on PCs and remote control end users.
• Remote Contol - administrators and helpdesk personnel can remote control user’s desktops to assist them when they require help.  The administrator can share the desktop of the end user, so they can both see what’s happening.
• Secure Remote Access via Quest Web Access and SSL Gateway - This allows for remote access to any corporate desktop, seamless application or even Microsoft App-V virtualized applications from a web browser or thin client and SSL.
• RDP Graphics Acceleration - when users logon remotely, their desktops or seamless applications can be accelerated with the “optional” Experience Optimization Pack - EOP.  Anyone who’s remoted into their corporate desktop via RDP knows that the performance is lackluster.  This accelerates the graphics and reduces the required bandwidth.  Actually all of the EOP features are available for physical PCs, i.e. Multimedia Redirection, Bi-Directional Audio, Local Text Echo and Graphics Acceleration.
• USB Redirection - Full support for USB Devices when connecting remotely to a PC.
• Task Automation - Administrators can schedule automated tasks such as, MSI Package Deployment, Power Management (logon, logoff, shutdown, reboot, sleep, wake-up…), copy files, run scripts…
• Client Settings - Specify via policy which RDP Virtual Channels may be used, for example, clipboard, disk drives, sound, microphone, Multimedia Redirection, Graphics Acceleration…
• Universal Printer Driver - Users logging on via RDP or EOP from a Windows vWorkspace Client can print with full functionality to any printer.  Users accessing a remote PC via non-Windows thin client can even print to network printers via the Universal Printer Driver.
• U3 vWorkspace Client - clients can run a full featured Windows vWorkspace AppPortal Client for remote access to their PC without having to install it, i.e. from a USB Stick.
• Brokering - of course, vWorkspace can broker connections to user’s Physical PCs, just like it can for Virtual Desktops.  Brokering and load balancing of Terminal Services sessions and applications is also available in vWorkspace Enterprise Edition.

So is Quest vWorkspace Desktop Edition a connection broker?  Absolutely, but we also like to think of it as suite for enterprise desktop management and remote access.

Earlier versions of vWorkspace already allowed for delegation of control. This was delegation of the “all or nothing” kind. As our product grew (with more hypervisors and more application and desktop delivery platforms supported ) and our install base grew we learned that we needed to add a more granular way of delegating control in the vWorkspace console. Well, in vWorkspace 6.0 we did we exactly that.

With the enhancements to delegated control in vWorkspace 6.0 you can delegate control to almost every single action that can be performed from the vWorkspace 6.0 Management Console. This allows you to create extremely detailed delegation schemes.

Let’s take a look at an example of how some customers use our delegated control features. Because of the unique nature of vWorkspace we have many customers that choose vWorkspace to deliver applications and desktops from different delivery platforms, all from one product and one console. The support and administration departments relative to these applications and desktop platforms often are (still) separated. Our enhancements to delegated control in vWorkspace 6.0 allows these customer to deal with this and delegate control accordingly.

More specifically, they set up delegation of control in such a way that:

• Members of the TS support department only are allowed to support the vWorkspace Terminal Server users.
• Members of the desktop support department only are allowed to support (virtual) desktop users.
• Members of the TS administration team are only allowed to manage the the vWorkspace Terminal Servers.
• Members of the desktop administration team are only allowed to manage the the vWorkspace managed (virtual) desktops (they actually go even further by delegating control for shadowing but that is a story for another feature spotlight!).

As you can see from this example, the enhancement in delegation of control in Quest vWorkspace 6.0 gives organizations more flexibility in managing their applications and desktop delivery platform(s) while still maintaining a “single pane of glass” administrative experience.

Take a look at how delegation of control look in Quest vWorkspace 6.0 in this short video:

administrative delegation

This blog post will kick off a series a posts that will go through some of the exiting new features of vWorkspace 6.0 in detail. This first “vWorkspace 6.0 feature spotlight” is about our advancements in flexible computer assignments.

One of the edges that vWorkspace has always had on its competitors it the tremendous amount of flexibility that is offered. One of the best examples of this is the fact that almost every resource in the vWorkspace Management Console ( the vMC - one console to rule them all ) can be assigned not just to users or groups but also to:

• IP subnets. This allows you to create your own location based rules (like for printing).
• Client names. Using client names allow you to link a specific client only to a specific resource.
• Active Directory entities. This way you could use an OU as an assignment filter for a resource.

Prior to vWorkspace 6.0, this flexibility was not available for the assignment of managed desktops but now it is! This means that in vWorkspace 6.0 you can assign a managed desktop to Users, Groups, OUs, Client IPs, or Client Names. This is how it looks.

This way of assigning managed desktops was actually based on several customer requests. Since we have been doing VDI for almost 4 years now (which is a very long time in the VDI space) we have had a lot of time and experience to learn and benefit from the knowledge of our customers. The need for more flexible computer assignment is one of the things we learned. For example, one of our customers is using the more flexible computer assignment options to enable the scenario of the “shift-worker” in a hospital, by assigning a particular desktop to a client machine instead of a user.

So, prior to centralizing their applications and desktops, this customer used to have a rich client in a hospital room that locally ran the applications that were used by multiple nurses subsequently, each one continuing the work where the previous shift left of. With the flexible computer assignment options in vWorkspace 6.0 the nurses are able to work in the exact same manner (which is what end users like) while the hospital was reaping the benefits of centralizing their application and desktop workloads.

This hospital is just one of the examples of how this feature can be used. I have seen many more examples ranging from factory personnel to schools. I am sure you can think of other usage cases as well. This small video shows you how to enable this feature:

Flexible Computer Assignment

Of course this is just one of the many new features in Quest vWorkspace 6.0. You can download a fully functional evaluation version of vWorkspace 6.0 here yourself.