Horizon Smart Policies not working

[VirtualRedneck]

Hello Everyone,

I am trying to test out some of the Smart Policies in UEM 9.1 for a new requirement for the users. I am trying to implement the following.

• Printing
• Clipboard
• Client Drive Redirection

I did find an initial issue and have fixed that. (The Horizon Agent has been reinstalled with the mentioned features installed -- previously missing)

Now, when I log in the only item that seems to work is the clipboard. I have turned up the logging to DEBUG so that I can see what is going on. I pulled the following out of the log file where it is saying my condition (IP Based) is passing the check and that it is applying the settings, but when I log in I do not see any of my printers from the local system on the VDI session, nor do I see the drives. I was able to copy something out of the session to my local machine.

2016-12-21 17:41:11.094 [DEBUG] Conditions: Check for endpoint IP address = true

2016-12-21 17:41:11.094 [DEBUG] Collected Horizon Smart Policies settings to apply for printing ('TestingLocalDrive.xml')

2016-12-21 17:41:11.102 [DEBUG] Collected Horizon Smart Policies settings to apply for clipboard ('TestingLocalDrive.xml')

2016-12-21 17:41:11.102 [DEBUG] Collected Horizon Smart Policies settings to apply for client drive redirection ('TestingLocalDrive.xml')

Any help is appreciated on what might be causing the issue.

thanks

VR

[jmatz135]

I was just curious because I originally had the condition actually looking for the registry key and that had the same issue as you are seeing, but when I changed to the horizon smart policy condition using the remote_broker_ip it fixed my issue in all cases.

[DEMdev]

VDINinja311​

I was going to just wait for the fix in a future release as I am not able to do the fix that JonAmadori was provided as I cannot control registry entries on our users' personal computers.

The UemTimeouts workaround is for scenarios where UEM only gets to run quite late during the logon. The most common case for which we've seen this occur, is when AppStacks take a while to attach.

If this delay is more than 20 seconds, the Horizon View components won't pick up any Smart Policies settings applied by UEM. The UemTimeouts setting overrides that 20-second default, but currently must indeed be applied both on the View client and on the View agent side. This will be addressed in a future version of the View agent, so the agent will be in full control and no registry changes need to be made on the client.

Is it indeed the case in your setup that UEM starts to run more than 20 seconds after the logon starts, i.e. do AppStack attachments take that long to complete?

[JonAmadori]

VDINinja311​

SR#: 17439278504

[jmatz135]

This has supposedly been done in Horizon View Agent 7.3.1 and above I believe.  What exactly do we need to do though to make this work?  I've set the registry key:

HKLM\Software\VMware, Inc.\VMware VDM\Agent\USB\UemTimeouts to 120 but it doesn't seem to change anything.  Is there something more we need to do to make the agent override the client settings?

[DEMdev]

Hi jmatz135,

Wow, this is an old thread. What versions of Horizon and UEM are you using, and what issue are you're having exactly?

[jmatz135]

It would appear that in the 7.4.0 Agent they reverted the change made in 7.3.1 and 7.3.2 that delayed the UemTimeout and thus USB redirection fails if you have any amount of slow login i.e. more than the one or two of the simplest app volume appstacks.

[DEMdev]

Hi jmatz135,

Both the 7.3.x agent and the 7.4 agent can have trouble determining whether UEM has provided a USB-related Smart Policies setting. The failure mode has changed from 7.3.x to 7.4: where previously USB redirection would be enabled if the Horizon agent couldn't check for Smart Policies, in 7.4 it will be disabled.

Could you try creating a REG_DWORD UemFlags value under HKLM\Software\VMware, Inc.\VMware VDM\Agent\USB, and set it to 1?

[jmatz135]

If I set this key will UEM smart policies still be able to turn off usb redirectIon?

[DEMdev]

The issue is that in some situations the USB redirection component in the Horizon agent is not able to determine the Smart Policies setting. If that happens, it decides to enable USB (in 7.3.x) or disable USB (in 7.4), regardless of what exactly was configured through UEM.

Effectively, the uemFlags workaround makes the Horizon agent skip its check for the USB Smart Policies setting, so you will not be able to turn off USB redirection through Smart Policies.

[jmatz135]

So I can't use that setting as I need UEM Smart Policies to turn on/off usb redirection based upon where the user is coming from.

The thing is though Horizon Smart Policies work for usb redirection (and everything else) every time in Horizon 7.3.2 for me, but in 7.4.0 they work for everything but USB redirection on login and everything works on reconnect.

[DEMdev]

Hi jmatz135,

I just read your Windows 10 USB Redirection Fails to work on login post in the Horizon forum. As there's no mention of UEM in that post, I just wanted to check: do you see that behavior without UEM as well?

[jmatz135]

I honestly can't say right now.  All of our VDI desktops have UEM installed.  I'll have to set up a desktop pool without UEM and test.

[DEMdev]

No worries, just wanted to check.

[jmatz135]

So I removed UEM and deployed to a test pool.  When I log into that pool the USB devices show up immediately (and I mean immediately, like less than a second).  So this is definitely a UEM and Horizon View Agent issue.  Basically if you have UEM 9.13.0 and Horizon View Agent 7.4.0 the Horizon Smart policies for USB redirection fail at first login if you have any kind of delay in login like appstacks.

[jmatz135]

Oh I also added the HKLM\Software\VMware, Inc.\VMware VDM\Agent\USB\UemFlags set to 1 registry value with Horizon View agent 7.4.0 which it doesn't do anything.  As far as I can tell it is just ignoring those any registry entries for that key.