ijdemes's Posts

I know I'm stepping in in the middle of the conversation, but going through the replies I can't seem to find the confirmation that when DEM 2111 including the 2111 ADMX is used, the "FlexEngine.exe -s" logoff command has been disabled or removed. Maybe there is a conflict going there.   Can you please confirm that "FlexEngine.exe -s" logoff command has been disabled/removed when DEM 2111 (incl. ADMX) is being used?

In my opinion there are multiple options, depending on what you want to achieve and which information you want to use for creating the condition.   Within DEM conditions, you can use the registry value condition or the environment variable condition. To go completely custom, you can also go with the Exit Code condition and use your own script/command to achieve want you want.   Like MickeyByte already mentioned, depending on what source of information you use, timing (having the correct/up-to-date source information in place) may be "a thing". So be sure to test thoroughly  .

I would go with mrkasius' solution for when profile loading goes wrong. However, to troubleshoot the actual issue I would recommend enabling FlexEngine debug logging first. And since it can happen for any user, I would recommend enabling debug logging in the DEM GPO. Configuring FlexEngine Logging Settings (vmware.com) I am curious if anything is added to the user's FlexEngine.log when having debug logging enabled and profile loading goes wrong.

Hi, I just wanted to let you know that I ran into the same issue. A description of the issue and how I fixed it can be found in my blog post. VMware Workspace ONE - Fixing the "Unable to find user in Active Directory" issue · ivandemes.com Cheers.

I know it's HKLM. But since it's VDI non-persistent, it doesn't really matter. Imagine the following simple flow.   - user that needs onedrive logs on - elevated task sets the HKLM value that ENABLES onedrive before profile archives are loaded - onedrive is enabled for user, because it's enabled system wide (HKLM), and since it's single user desktop (VDI), this doesn't matter. it is reset after logoff   - user that doesn't need onedrive logs on - elevated task sets the HKLM value that DISABLES onedrive before profile archives are loaded - onedrive is disabled for user, because it's disabled system wide (HKLM), and since it's single user desktop (VDI), this doesn't matter. it is reset after logoff   Like I said, untested and just a brainwave, and maybe there are easier ways that I don't know of. Just trying to think out-of-the-box

AFAIK this is set on computer level (GPO), to ENABLE:   Computer Configuration> Administrative Templates> Windows Components> OneDrive> Prevent the usage of OneDrive for File Storage   or registry:   HKEY_LOCAL_MACHINE> Software> Policies\ Microsoft\Windows\OneDrive DisableFileSyncNGSC = 0 (Dword)   0 = enable 1 = disable   Maybe you can try setting this value using an logon task/elevated task (when using DEM 2006 or later), set it before profile archive import and configure it for the required users (condition). This is a brainwave and I am not sure about timing and the result in general, but maybe worth a try.

Hi @RachelW ,   Sorry for the late response, but as mentioned earlier on, it's about excluding the cache location instead of including it.   As @Lieven mentioned, FSLogix is doing its work for Teams caching and stuff really well. Same goes for Outlook cache (OST) and OneDrive.

Looks like what I have used before.   Maybe it's good to start fresh and create a first baseline and work from there. For instance, start with...   [IncludeFolderTrees] <LocalAppData>\Microsoft\Credentials <LocalAppData>\Microsoft\Teams <LocalAppData>\Microsoft\TeamsMeetingAddin <LocalAppData>\Microsoft\TeamsPresenceAddin <LocalAppData>\SquirrelTemp <AppData>\Microsoft\Teams <AppData>\Microsoft Teams <AppData>\Teams <LocalAppData>\Microsoft\IdentityCache <LocalAppData>\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy   [IncludeRegistryTrees] HKCU\Software\Microsoft\Office\Teams   And add exclusions one by one after that. You must be able to somehow rule out certain file/folder/registry entries.

Hi @RachelW ,   Log is looking good when you expect the following:   If a user is not member of group "MH\Network Analysts" do NOT create the Teams shortcut.   If Teams is still launched for this user, it may be launched from a different place. This is where SysInternals Autoruns may help to determine the location.  

So did you configure the UAG to use port 10443? And for what? Please check this --> https://docs.vmware.com/en/Unified-Access-Gateway/2009/uag-deploy-config/GUID-1B8665A2-485E-4471-954E-56DB9BA540E9.html

Hi RachelW​, Unfortunately the picture didn't seem to come through with you last post. But regarding the Logon Task or Shortcut. What you can do is create a Logon Task with the command to execute Teams (use asynchronous). You can use conditions to have this executed for (for instance) a sub set of users. The other option is to place a shortcut in the Startup folder. This way the shortcut is executed after logon. You can use conditions to have this executed for (for instance) a sub set of users.

Since you want to configure the same time zone for all, depending on the DEM version (version 2006 and higher), you will be able to configure the time zone system based using a Startup Task (Computer Environment tab) and utilizing PowerShell's cmdlet Set-TimeZone (https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-timezone?view=powershell-6). This way you are managing the setting from DEM instead of using a computer-based GPO. By configuring it on a computer level using a Startup Task, you are not bothering the user during or after logon.

Hi RachelW​, Sorry for de delayed response, but normally Teams auto runs after logon using the following registry key/value. Like mrkasius​ mentioned, there is a GPO setting that may prevent Teams from automatically starting. The question is, is this in place in your environment? And for what reason? If this GPO setting is not required you can disable it. What I normally do is remove those items that do not need to auto start for everyone and let those items start for only those users that need it using DEM. This can be done using a Logon Task or a shortcut in the Startup folder. For a full inventory of items that auto start for a user you can use the Autoruns utility from SysInternals --> http://live.sysinternals.com/Autoruns64.exe (x64) I hope this brings you a little bit further...