UEM Conditional setting based on Username?

[rcscott44]

Is there a reason that UEM does not have a Condition based on a user's Active Directory Logon? 

We currently deploy certain network drive mappings, access permissions and printers to AD security groups.  Several times a week, we need to make a temporary change to these assignments.  Because we cannot add a user as a condition to the UEM config, we can only add the user to the proper security group.  This is less than ideal and kills any benefit of the UEM-Refresh user function.  UEM-refresh keys off the AD user tokens on the local machine, it does not do an LDAP lookup.  To my knowledge the only way to refresh the user's AD information is to process a new logon.

If anyone has a workaround to reference an individual AD user in UEM Conditions or a way to make UEM-refresh look at AD instead of the local machine, I would be eternally grateful.

-Bob

[EricNichols]

Have you tried Environment variable %username% ?

[Ray_handels]

Same discussion here

UEM and User Assignment

And I raised a call with VMWare and received a message that this is indeed not possible and asked for a feature request.

We now just created groups for this and add a user to this group, it is what it is.

Let's hope user assignment will be a new feature...

[DEMdev · Accepted solution]

rcscott44,

To target a single user, you can indeed use the Environment Variable condition as EricNichols suggested:

As for performing a "live" LDAP query rather than asking Windows whether the logged-on user is a member of a particular group: I'm afraid there are too many corner cases to deal with. The "is this user a direct member of this group" query is pretty simple, but nested groups, primary group support, referral chasing, foreign security principals, et cetera make it quite hard to mimic Windows' membership logic.

Ray_handels: Is such a "live" lookup what you were looking for, or did I misunderstand?

[rcscott44]

Using the Environment Variable "username" would be what we are looking for if it works.

The live LDAP lookup isn't necessary provided the above functions.  I will test.  Thanks,

-Bob

[Ray_handels]

UEMdev​. Yes, this indeed did the trick, thank you very much for your reaction.

This opens up a lot of different options for us :smileysilly:...

[lansti]

When i need to set a condition based on a user og two, i'll add a "File or Folder" condition based on userprofile folder:

Works perfectly fine for me.

[Ray_handels]

Does this work in time though? Because it will only create these during logon?

[lansti]

I use this setting when i need to test a configuration in UEM.

I create a setting/policy and when the condition matches it is deployed to the users. It works perfectliy on every logon.

Must say: we use a non-presisten clients, so everytime a user logs on, they will log on to a new client. and when they log off, the client gets deleted and redeployed as a new client.

[DEMdev]

There's no timing issue here – UEM only gets to run after Windows has created the local user profile folder.

The only potential issue I see with this approach is if you're using this in a persistent environment where you do not remove the profile at logoff. In that case it might happen that user abc logs on but folder C:\Users\sgr still exists on disk, causing the condition to match...

Using the environment variable condition to check %username% does not have that (potential) issue.

[lansti]

Yes, but since we are running non-presistant, it works just fine for my testing usage.

[rcscott44]

This is working, but still requires a user logon to be effective.  I still cannot add the user conditional to the UEM setting and just have a user refresh.  I have even tested doing a ...\FlexEngine.exe -r command and it still does not configure the new drive mapping until the user logs off and back in again.

Our environment if Horizon 7.5, instant clones of Win10 v.1803, AppVolumes 2.14.2.  Test user have have Writable UIA - NO profile. UEM v9.4

[DEMdev]

Hi rcscott44,

-UemRefreshDrives should work just fine in this case, so let's see what's going on. Can you provide a FlexEngine log file and a FlexEngine async log file (in case you're mapping drives asynchronously), both at log level DEBUG? Just the log fragments that apply to the (failed) refresh would be sufficient, with a brief description of which drive mapping you tried to add.

[lansti]

When you logs on to windows, are you able to run UNC patch to the shared network drive without user credential prompt?

Are your klient in the domain? (i know, silly question...)

i always map network drives with \\server.domain.com\path-to-share

[rcscott44]

Interesting development...

I attempted to pull logs for our test user and could not access the FlexEngine-async log while the user was logged in.  That has never been an issue before.  I logged the user out and could access the logs, but they showed nothing added for days.  I logged the user back in and the FelxEngine-async log was immediately locked again.  I could not determine what application was locking it.  As a last resort, I deleted the writable volume and created a new one from scratch.  Immediately everything worked as expected. I am now able to assign and remove drive mappings for the user by "username" and the -UEMrefreshDrives argument works without requiring a new user logon. 

It is troubling that some config saved in the writable could affect operations this way.  We don't have the ability to remove writable drives entirely from our environment and it would be problematic if this issue happened for a real user.

-Bob

[DEMdev]

Hi Bob,

Are you mapping printers, by any chance? The async log file being locked is typically a symptom of a printer mapping that is hanging (or just very slow).

[rcscott44]

Yes, we do map network printers as well.  We do see issues with some printers hanging at logon, but they either complete of time-out after 10 minutes or so.  The async-log locking existed for hours.  Is there a way to see if there is printer mapping issue without the async log?  Nothing from UEM was being added to the log, so I had no way to see if a printer was hung up.

[DEMdev]

Yeah, that's a bit of an annoying thing about our log files... To limit our network and disk impact, log lines aren't written to disk immediately, but are buffered in memory first; once that buffer (which is a few kilobytes large, for a handful to a dozen log lines, in general) is full, it's written to disk.

If something causes the FlexEngine.exe instance that is writing to the async log to hang, quite often the last log lines that make it to disk are for one of the actions preceding the culprit...

If you can reproduce the issue during the session (maybe by killing the hanging FlexEngine.exe and performing a UEM refresh), ProcMon might shed some light on the hanging action.