JohnTwilley's Posts

Even after setting all of this up, you will still see duplicates.  The Symantec Admin need to run a daily purge of the devices to clear it up.  We have 4,000 non-persistent VMs in a Hospital environment.  Our daily churn uses around 14,000 SEP licenses daily.  It's just a flaw in the SEP license process.   Just want until you see the new Symantec 14.3 RU7 Cloud-based enrollment issues. You now have to run SMC.exe -image instead of Clone prep.   Then you have to create a Schedule Task to ENROLL each VM...or a post-cloning script.  It's just a please to work with Symantec. <SC>

Thanks everyone for providing better support then VMware Support Roller Coaster Ride these past few weeks.    We ran across this exact issue when trying to migrate from our 19.x connector.  VMware Support had us upload the cert by re-running the Installer. Their Installer method failed to fix the issue.  We always got those Sync failures.  Using Keytool.exe and that "special password" got us up and running in a few minutes!   Now THAT is not in Carl's documentation!! (which is what VMware Support sent us to verify our setup!?!  Carl - Are you getting PAID for that?  LOL. Thank You VMTN Community!  

With the ever changing subfolders and rules...stick with an Allow-All & Exclude large folder Plan: Like Pim_van_de_Vis's example here: https://communities.vmware.com/t5/Dynamic-Environment-Manager/Microsoft-Edge-Chromium/ta-p/2857378

These paths have been moved. (Thanks Google/Microsoft) <LocalAppData>\Microsoft\Edge\User Data\Default\Cookies <LocalAppData>\Microsoft\Edge\User Data\Default\Cookies-journal <LocalAppData>\Microsoft\Edge\User Data\Default\Current Session <LocalAppData>\Microsoft\Edge\User Data\Default\Current Tabs Reference: https://www.avanite.com/blog/chromium-cookies-and-network-data   

Is your DEM policy named "Network Printers"?    Skipping disabled config file '\\mydrive\SharedDataDept\VDI\DEMCONFIG\General\Windows Settings\Network Printers.INI   Many Admins Pre-Install the Printer drivers into the Master Image so that step is no longer needed, dramatically increasing the Printer Mapping function.  I install about 20 different drivers.

Our High CPU load issue was due to a bug in ControlUP.   There are two bugs at this time:  (as of Jan 2022) 1) Monitor nVidia API bug with the specific nVidia Drivers we are running in production (Hosts & VMs). 2) LDAP delays for user specific metrics for large AD environments.

You can create/add this to an Outlook Policy to capture the Outlook Signature.   For those of you using FSLogix O365 Containers, you will also need this, as FSLogix O365 containers does not capture these... [IncludeFolderTrees] <AppData>\Microsoft\Signatures <AppData>\Microsoft\Spelling <AppData>\Microsoft\UProof

Just know that if you switch to using port 443 port on your UAG, the clients will no longer be able to use UDP and will have to use TCP for the streams. I know this, because we had to engage VMware Support to determine why our UDP wasn't working properly. UDP has a better "feel" to the desktop. 

Yes, Teams has Outlook integration via add-ins. Disable all Teams addins in Outlook In Outlook, click Options. In the Outlook Options window, click Addins. At the bottom, click Go… (next to Manage: COM Add-ins). Untick Microsoft Teams Meeting Add-in for Microsoft Office and Teamviewer Meeting Add-in. Click OK. Restart Outlook. Automate disabling Microsoft Teams Meeting Add-in in Outlook The load behavior of the Microsoft Teams Meeting Add-In is controlled in the Registry. To set this add-in to Disabled, do the following: In your Registry Editor, go to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\Addins\TeamsAddin.FastConnect Double-click LoadBehavior, set the value data to 2, and click OK. This disables the load at startup. If you want to enable load at startup, change it to 3 This can be added via DEM since it's a HKCU entry.

While not a common bug, it could be the UNC hardening issue "bug" found in the 18xx Windows 10 builds. If you see some 1058 errors in your event logs, give this a shot. Domain-joined Windows 10: “Network access is denied” on SYSVOL and NETLOGON – web-workers.ch (web-workers.ch)​ UNC path hardening MS15-011 and MS15-014.  It looks like Windows 10 has hardening enabled by default which is not the case with previous OS versions.  As a test if you change the Local Computer Policy>Computer Configuration>Administrative Templates>Network>Network Provider>Hardened UNC Paths to Enabled and click into the Show button enter the following Values \\*\SYSVOL RequireMutualAuthentication=0,RequireIntegrity=0,RequirePrivacy=0 \\*\NETLOGON RequireMutualAuthentication=1,RequireIntegrity=1 See if this clears up your group policy errors.I added this into my Master Image and it resolved by random DEM not working issue. Disclaimer: See the article from Microsoft about MS15-011 for more information. It contains a good description of the security implications of changing this setting, as well as detailed steps of how to change the policy. Warning: Note that the settings above disable some or all of the protections against the security issue MS15-011 was created for! Do not just blindly copy/paste them, but take an informed decision based on the risks involved. Also, this issue is likely to be solved sometime in the future. When that happens, don't forget to set this policy to the recommended values as described in MS15-011. If that doesn't solve the problem then it is most likely a network stack timing issue, where GP processing for the computer is kicking off before the network stack is fully initialized. This has been around since Windows 7, Microsoft added a policy under Computer Configuration\Policies\Administrative Templates\System\Group Policy\Startup Policy Processing Wait Time where you can increase the time that GP waits before initiating.   Try setting it to 60 seconds and see if that helps. (default is 30)

Thanks DEMdev​ I'm not sure whether changes to the Idle time until disconnect policy setting are picked up by the Horizon agent once the session has started. I think you are correct here.  I've tried altering the VDIIdleTimeout registry value created here: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\VMware, Inc.\VMware VDM\Agent\Configuration and the Horizon Agent does not seem to pickup the changes... I was hopeful, but it seems that this is not dynamic like some of the Blast variables. Here's my thought process for those following along: We have Thin Client devices that share a pool of Clinical Horizon desktops.  I'd like for some of those endpoints, like Surgery devices, to have a longer Idle Timeout. VMware Horizon has historically made it difficult to manage this Idle Timeout value, and many of use have resorted to 3rd Party screensavers, etc to handle it.  I was hoping DEM was going to help streamline this for us... My issue is that I need a more dynamic method of updating this value, based on the Session's "ViewClient_Machine_Name" value.  Maybe someday... but I'll keep hoping. Thanks for you assistance.

I added Debug Logging via the following Registry variables...but still no logging. I don't really see much discussion in the forums about the new Computer-Based policies. Is anyone using it yet? My Event Log still states that DEM Computer Policies are "disabled via configuration". I'm hoping that in the next release, there will be ADMX files to manage the Computer Policies for DEM...because this is a mess. If I manually run the FlexEngine.exe -UemRefreshHorizonComputerPolicy I still get EventID 24601 -- "Both Horizon Smart Policies computer settings and ADMX-based computer settings are disabled via configuration, so computer environment settings are disabled." UPDATE: The Online Guide states the following: "To configure VMware Dynamic Environment Manager to apply computer environment settings, edit the Windows registry settings in the HKLM\SOFTWARE\VMware, Inc.\VMware UEM\Agent\​Computer Configuration key as necessary until they comply with the descriptions that follow." UPDATE2: Turns out it was some strange hidden character (or something) in my Group Policy that added the Computer Configuration key and values. I deleted them and recreated them locally and it worked fine.   Very odd, as the Reg keys looked perfect.