UEM/DEM is working fine...until I enable Profile Archives in GPO

[h1ghtechredneck]

This has been a head-scratcher for several days.  New setup of UEM 9.8, Horizon 7.8, using Instant Clones and AppVolumes.

UEM is running as a GPO client-side extension.  All works fine, until I add the GPO settings for Profile Archives.  I have checked a dozen times/ways that the file path is good, tested, and virtually the same as the UEM_Profile path - it's fine.  Files even show up in the Archive folder.  But, the logon process just shows a blue welcome screen for about 1h 15m...and then it eventually shows the desktop.  If I disable Profile Archives, my logon time is back to about 45-50seconds.

I've changed the FlexEngine logging level to debug, and I still don't see anything odd in it, yet, but I'm still checking.  The process also seems to lock the FlexEngine.log file during the logon, and it cannot be viewed at the same time.

Has anyone seen something like this?  I do hope the problem is with me. 😉  Then it has a decent chance of being fixable.

Thanks all,

Jeff

[DEMdev]

Hi Jeff,

Can you share that DEBUG FlexEngine log file?

[h1ghtechredneck · Accepted solution]

Hi all,

We might have got this one resolved.  We currently use an endpoint security product, (application whitelisting), called Palo Alto TRAPS.  It is not anti-virus per se, nor does it actively scan files/folders/shares, however, it does perform process inspection.  We tried excluding the C:\Program Files\Immidio\Flex Profiles\* folder and so far, the issue has disappeared.

The TRAPS logs indicate the FlexEngine executables are being allowed to run, no errors discovered, but it seems just examining the FlexEngine executables as they run seems to cause a problem.

So, fixed for now.  Thanks all.  Hopefully this thread is useful for someone else.

J.