Pim_van_de_Vis's Accepted Solutions

The passwords are typically stored in the Windows crypto vault, which can be captured with some default DEM config file templates. Try adding these common settings in DEM and see if that solves the issue: "Internet Explorer 7-11 - Autocomplete passwords" "Personal Certificates"

The license count is not hard forces, so nothing will stop working. Of course you need to buy the correct number of licenses, but if the procurement process takes a while you can keep doing everything you are used to, even when you go over the limit of enrolled devices.

I've done some quick tests. The Canary channel installs Edge in the LocalAppData folder, not what you want. So I switched to the Beta channel, this installs Edge in the Program Files folder. After that I ran the Edge browser through the Profiler and done some quick and dirty 'optimization' to create this Config File: === [IncludeRegistryTrees] HKCU\Software\Microsoft\Edge HKCU\Software\Microsoft\Edge Beta HKCU\Software\Microsoft\Edge SxS HKCU\Software\Microsoft\EdgeUpdate HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [IncludeFolderTrees] <LocalAppData>\Microsoft\Edge Beta <LocalAppData>\MicrosoftEdge === As you can see, settings are stored in a folder called 'Edge Beta', probably because this new Chromium Edge gets installed next to the existing Edge. So we need to wait for the final release to see how this would behave. With the config file content above I was able to roam the start page, theme, favorites, saved passwords, etc. I could not detect any broken or missing settings. The .ZIP file was 35MB in size, but we might be able to optimize this by excluding stuff we don't need. Focus right now for me was to see if we could capture all settings. Please give this a try and let me know your results.

Yeah, task triggers by UEM 'Logon Tasks' will not be elevated because of security and logon processes that run in a different context. The easiest workaround is to let the script be triggered by a shortcut in the 'Startup' folder. This shortcut can be created by UEM. Another workaround is to use the [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] location to trigger the logon task.

The problem is that the Windows 10 Start Menu is stored in a database file which is locked and cannot be exported by UEM. The answer is in this blog: https://blogs.vmware.com/euc/2016/11/managing-windows-10-vmware-user-environment-manager.html In short: you need to run a powershell script to export the StartMenu at logoff and put that exported file in the correct place. UEM will import that file at logon again and Windows will pick it up to rebuild the Start Menu. Let me know if this works for you. This will become easier with Windows 10 1703 and later. And you already mention it, but it's against all recommendations to capture the complete AppData and LocalAppData folders, since that will seriously impact you login and logoff times. https://blogs.vmware.com/euc/2016/11/managing-windows-10-vmware-user-environment-manager.html

With the UEM Management Console you can change and update the UEM configuration. Pushing a new file can be done at logon as a global settings, through the 'User Environment - Files and Folders' option. Or it can be done at application startup if you link the file as a pre-defined setting to a application 'Personalization - Config File'. In both cases the file will be compressed into a ZIP file, so it's correct that you found it there. Be careful though, updating and changing the ZIP files can only be done through the UEM Management Console with the 'Edit' buttons. If you change the ZIP file with another tool the ZIP file will become unreadable for the UEM agent. Let me know if you need more info.

UEM uses a 'last write wins' and therefor you see this behavior. You can work around this by enabling DirectFlex for all applications. That way the settings are written to the UEM profile share at applicaiton close and not at logoff. Only some Windows settings need to be exported at logoff (for instance the wallpaper). If you also want to prevent this from happening on the physical endpoints, you could change the export behavior for those UEM Config Files, see the attached screenshot. Configured like this, the wallpaper will 'import only' when user logs on to a computer with a hostname that start with 'physical'. In any other scenario (logon to the VM), the wallpaper will import at logon AND export at logoff.

This is a know issue with Windows 10 and the 'remove local profile at logoff' option. Windows leaves user SID information behind at this location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore When you manually remove the user SID key there, the issue is gone. We are trying to fix this in the future. Why are you using this 'remove local profile at logoff' feature in the first place? Why not use Linked Clones or Instant Clones that refresh at logoff?

DirectFlex needs to be enabled, otherwise the UM config file for Edge will not work. The settings need to be imported at application start, and not at logon. If you import them at logon, the settings will be overwritten bij Edge again. I have configured DirectFlex as the screenshot below and that works for me. Export will always happen at logoff, because UEM does not see the Edge application close. In order to test you need to logoff first for the export to be succesfull.

Make sure to add these two templates: In the UEM Management Console click - Create Config File Select - Windows Common Setting Add - Internet Explorer Autocomplete passwords repeat steps and also Add - Personal Certificates. This should capture most (if not all) passwords and saved credentials. (including the Credential Manager) I hope that LTSB does not work different, because this is successful on all other Windows releases.

Ok, now I understand the usecase. Pretty specific, but I like that you use UEM as a framework to just perform the specific actions that you want. You can do what you want. Have a look at 'Appendix A - FlexEngine command line arguments' in the UEM 9.0 documentation: https://www.vmware.com/pdf/uem-90-admin-guide.pdf An example is here for an import: "C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe" -i "\\fileserver\UEMConfig\general\Applications\Notepad.ini" -r "\\fileserver\UEMProfiles\%username%\archives\Applications\Notepad.zip" And for export it would be: "C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe" -i "\\fileserver\UEMConfig\general\Applications\Notepad.ini" -s "\\fileserver\UEMProfiles\%username%\archives\Applications\Notepad.zip" -b "\\fileserver\UEMProfiles\%username%\backups\Applications\Notepad.zip" Or, if ThinPrint local printer redirection is not needed, you could also disable ThinPrint: User Environment Management and ThinPrint conflicts when managing printers (2145750) | VMware KB Let me know if this works for you.