Machine Group Policy reverts when AppStack attaches during logon?

[ARauschenbach]

Hi All,

I have a deployment (running Horizon 7.6.0 and AppVolumes 2.14.2.11) where some AppStacks were provisioned on Domain Joined computers (for various reasons). Everything works fine with the AppStacks and applications themselves, however when attached to a workstation during the logon process the AppStack reverts the workstation's Group Policy settings to those that were in place when the AppStack was originally provisioned. We are using some Loopback\merge policies, and now are noticing that our newer changes are being reverted during the logon cycle for users which are utilizing the older AppStacks. Reading through a couple of the threads here it sounds like maybe some others have had this issue (registry settings reverting when attaching AppStacks) although they haven't attributed it directly to Group Policy application. I imagine that the AppStacks are attaching after Group Policy applies during the logon cycle, and somehow overriding the workstations normal Group Policy files.

I'm looking for some guidance\affirmation on how to defeat this issue -- My plan so far is to Exclude the entire "%systemroot%\system32\grouppolicy\" folder from all the AppStacks and on the Template as well (to hopefully resolve this issue going forwards). I can't imagine an issue occurring as a result of excluding this folder, since Group Policy should be processed during the boot and logon cycle on the workstation. We are using primarily non-persistent pools with Refresh on logoff.

Any guidance, thoughts, concerns on the above would be appreciated.

[ARauschenbach]

The plot thickens:

It looks like snapvol.cfg already has an exclusion listed for local Group Policy objects: "exclude_path=%SystemRoot%\System32\GroupPolicy" -- so where is it pulling in these old registry settings from? Must be missing another exclusion location elsewhere.

[ARauschenbach]

Another update on this:

My problems inherently revolve around USB Redirection issues, and it seems like it's related to a separate set of issues.

I found a different thread which more closely resembles my particular configuration and the issues that I'm facing -- I will attempt the workarounds mentioned in this article next: Appstack and Horizon USB issues when UEM in installed but not configured

[Ray_handels]

The post you are referring to is that USB redirection does not work anymore when UEM is installed but not configured.

Which Appstack template are you using? Policies are not stored in a folder but it's a regsitry key (which also should be excluded in snapvol.cfg) but we have seen policies being added to that reg key (this was waaaaaay back though, even pre Appvolumes).

Policy is HKEY_LOCAL_MACHINE\SOFTWARE\Policies (and off course the WOW6432Node tree).