AppStacks per user and application security\isolation

[apehlivan]

Hi,

I would like to know, gain answers to some questions about a design of my environment and if AppVolumes fits in it.

Recently trying out AppVolumes within our newly deployed RDSH environment. To give you a picture of.. it is a hosted RDSH environment from our own Datacenter (VMware as hypervisor) to different customers.

These customers are using the environment as a poule of servers (session hosts) and are not dedicated to them. Meaning users logging in randomly.

We would like to keep our systems clean and uniform as possible. Thats where AppVolumes comes in, great product to detach your application layer from OS, assign applications to users where VMDK's follow them.

As we know every customers has it's own (business)application and rather than assigning an AppStack to VM's we want to assign them to users.

This way it would be able to use shared resources (RDSH servers) over different customers.

Example:

Customer 1 has Application 1

Customer 2 has Application 2

I have 1 RDSH and both customers logging in on the same server with their applications.

This means customer 1 has access to the application of customer 2 and the other way.

More important, think about application conflicts and/or plug-ins that are used for Office per customer. There are ton of examples.

I am not planning to use virtualization technique like ThinApp to isolate for couple of reasons. From what I understand VMware does not develop virtualization with ThinApp anymore and focuses on App Volumes.

Now I am reading different stories about it. Deployment guides and considerations, FAQ's I've read, telling us that this feature is not supported on RDSH.

"RDSH servers receive machine assignments of AppStacks rather than user assignments. AppStacks are attached to the RDSH host."

This means I can not use my environment as we wish to use.

On the other hand, some other documents\whitepapers and articles telling me that it IS possible to use it this way. I am really confused, is there someone who can tell me if I can use App volumes as we want, is it even possible?

If not, are there any other solutions provided?

Thank you in advance!

[Ray_handels · Accepted solution]

Long story short, what you are trying to achieve is not possible.

You can only assign an appstack to an RDSH server and not to a specific user logging in.

The reasoning behind this is that Appvolumes attaches a VDMK to a machine and at this point (future releases will have this option, just google App toggle) cannot isolate the appstacks from eachother meaning that even if you were able to assign it to a user logging into an RDSH host (which you cannot but just trying to make a point here ) it will attach both appstacks and thus show both appstacks to both users logged in.

Why don't you provide users with their own desktop? Is this due to licensing? I think (but just my 2 cents) that using XenApp or RDSH, specially if you are providing them with a full desktop, is no longer a feasible solution as users will interfere with eachtother whilst using the desktop provided to them by RDSH. I think that the only option for his would be to deliver apps using RDSH, then you can assign multiple appstacks to 1 RDSH host as the user will only receive the application published from this host.

[apehlivan]

Hi Ray,

Thank you for your answer. I just read the deep dive article about AppToggle. It would be great feature to have AppStacks isolated from each other. I guess we will have to wait...

Actually I didn't mention the whole concept and design. Other wise it would be too long story to tell

There is a reason why I specifiacally ask for this environment is because we want to deliver a cheap service for small customers with couple of users that don't want to "rent" a full server but take their applications as a service from the "cloud". (RemoteApps). As mentioned no dedicated servers but shared.

I also have environments with RDSH and XenApp with Full Desktop or Published applications, VDI solutions or dedicated servers meant for bigger customers with more users that require couple of servers. Alot of combinations created with their own disciplines which this question about isolating AppStack does not apply.

For the time being I think the only option that I have is using application virtualization like AppV or ThinApp...

I hope the feature to isolate appstacks will come soon.

Thanks again.

[Ray_handels]

Hey apehlivan,

For as far as my information goes (no VMWare employee here ) this will be a feature of the new version to be released anywhere this year. The 2.x version won't have this feature anymore (unfortenately but who nows maybe it might still be there, one can only hope) as it was part of the Appvolumes 3.0 version (which I would highly suggest not to use). This 3 version was a technical preview of the newer version of Appvolumes. The idea and reasoning behind it looked pretty well, integration of UEM and Appvolumes and one appstack per application with the possiblity to put them all together in 1 appstack. Only thing is that it wasn't production ready.

The other option you might be able to try (but I'd suggest hopping onto the UEM forum) is to deliver one appstack with applications in it, don't create the shortcut in the appstack but create it using UEM and you can make a difference in assingment here. Then use UEM to block access to application if you try and browse to them using explorer. It is a new UEM feature but I haven't really worked with it yet. The idea behind it looks pretty promising.