topic Allowing DEM to Apply Computer Environment Settings - "disabled via configuration" in Dynamic Environment Manager

Allowing DEM to Apply Computer Environment Settings - "disabled via configuration"

JohnTwilley — Fri, 21 Aug 2020 19:31:57 GMT

I'm trying to leverage the new DEM Computer Smart Policies to apply the new "Idle time until disconnect" value on some VMs used in an Operating Room.

For some reason, I cannot get it to work.

The EventLogs in the VM state: Event ID 24601 -- "Both Horizon Smart Policies computer settings and ADMX-based computer settings are disabled via configuration, so computer environment settings are disabled."

I have already manually applied the registry keys to allow Computer Policies, and recomposed the pool.

the ConfigFilePath attribute is pointing to the DEM Config share. I'm wondering if there are Share Permission changes required for access by the computer object?! Normal DEM accesses via the logged in user, and I'm assuming this is happening BEFORE user login, so maybe the Authenticated Computer needs read access?

The documentation does not mention permissions, so I was wondering if anyone has actually got this working. I'd just add it, but it requires a Change Form, and having a Storage Team process the Change.

John

Re: Allowing DEM to Apply Computer Environment Settings - "disabled via configuration"

DEMdev — Fri, 21 Aug 2020 21:39:20 GMT

Hi JohnTwilley,

The EventLogs in the VM state: Event ID 24601 -- "Both Horizon Smart Policies computer settings and ADMX-based computer settings are disabled via configuration, so computer environment settings are disabled."

Can you show what's configured under HKLM\SOFTWARE\VMware, Inc.\VMware UEM\Agent\Computer Configuration?

I'm wondering if there are Share Permission changes required for access by the computer object?! Normal DEM accesses via the logged in user, and I'm assuming this is happening BEFORE user login, so maybe the Authenticated Computer needs read access?

Indeed, the note at the bottom of that configuration page you linked to, states "Computer accounts rather than user accounts access the file shares that host the configuration folder and the log file." and references the share configuration topics where the additional requirements for computer environment settings are described.

Re: Allowing DEM to Apply Computer Environment Settings - "disabled via configuration"

JohnTwilley — Thu, 01 Oct 2020 12:02:13 GMT

Here are my settings. I've added Domain Computer (Read) to the share, but still cannot get this to work properly.

Where would I find additional logging for the Computer policies?

I guess I'll add a couple more variables to capture the logs as found here: FlexEngine Configuration for Computer Environment Settings (vmware.com)

I was kinda hoping that Computer Logging would be available via Group Policy, as it is for the User Flex Engine Logging...

Re: Allowing DEM to Apply Computer Environment Settings - "disabled via configuration"

JohnTwilley — Thu, 01 Oct 2020 15:35:13 GMT

I added Debug Logging via the following Registry variables...but still no logging.

I don't really see much discussion in the forums about the new Computer-Based policies.

Is anyone using it yet?

My Event Log still states that DEM Computer Policies are "disabled via configuration".

I'm hoping that in the next release, there will be ADMX files to manage the Computer Policies for DEM...because this is a mess.

If I manually run the FlexEngine.exe -UemRefreshHorizonComputerPolicy

I still get EventID 24601 -- "Both Horizon Smart Policies computer settings and ADMX-based computer settings are disabled via configuration, so computer environment settings are disabled."

UPDATE:

The Online Guide states the following:

"To configure VMware Dynamic Environment Manager to apply computer environment settings, edit the Windows registry settings in the HKLM\SOFTWARE\VMware, Inc.\VMware UEM\Agent\Computer Configuration key as necessary until they comply with the descriptions that follow."

UPDATE2:

Turns out it was some strange hidden character (or something) in my Group Policy that added the Computer Configuration key and values.

I deleted them and recreated them locally and it worked fine. Very odd, as the Reg keys looked perfect.

Re: Allowing DEM to Apply Computer Environment Settings - "disabled via configuration"

DEMdev — Sun, 04 Oct 2020 13:46:23 GMT

Hi JohnTwilley,

Turns out it was some strange hidden character (or something) in my Group Policy that added the Computer Configuration key and values.
I deleted them and recreated them locally and it worked fine. Very odd, as the Reg keys looked perfect.

Happy to hear that you got things to work.

I'm hoping that in the next release, there will be ADMX files to manage the Computer Policies for DEM

Applying this configuration through AD computer policy will be too late, unfortunately. We are considering a two-step approach like we have for NoAD, where at least some of the configuration can come from an XML file on the config share.

Re: Allowing DEM to Apply Computer Environment Settings - "disabled via configuration"

Skocza — Fri, 26 Mar 2021 16:07:36 GMT

Hello guys, I am still unable to make this working in our env. , i am getting the same message about

when i do flexengine refresh

I have this deployed by GPO

What I am doing wrong?

Update: When i recreate that key as John, it looks it did something and showed this in log, which seems working

But how can i deliver that change for our VDIs by GPO then? I think most of the settings need to happen on the start of the logging otherwise not applied, so could advise how to fix this?

Update 2

Now I am getting this after I have added that Enabled=1 key into the image instead of ot deploy by GPO

But the problem about to deliver settings still persist ... we also have domain computers added as read and execute as security for the share plus as read permission directly set on the share, how come its still not working and not applying anythin?

Re: Allowing DEM to Apply Computer Environment Settings - "disabled via configuration"

DEMdev — Mon, 29 Mar 2021 18:12:32 GMT

Hi @Skocza,

Per your update 2 you already got this part working, but just to confirm: those Enabled and ConfigFilePath registry values must be configured in the base image. GPO applies too late for those values to be picked up by DEM.

As for the problem that remains: anything in the event log?

Re: Allowing DEM to Apply Computer Environment Settings - "disabled via configuration"

Skocza — Tue, 30 Mar 2021 09:49:14 GMT

Thanks @DEMdev for reply!

Correct after I have added those reg keys into an image instead of deliver by GPO, it started to deliver some settings for computer indeed.

What I am still missing though is that log for computer part created, see my screen about reg keys added into an image, that ComputerFlex.log file isn't created at all, so I can't trace whats wrong with the rest of the settings I want to deliver and those are not applied by DEM

So I would like to make that logging working first to see what happens behind

Re: Allowing DEM to Apply Computer Environment Settings - "disabled via configuration"

DEMdev — Tue, 30 Mar 2021 16:50:57 GMT

Hi @Skocza,

The Windows event log might contain some useful pointers to help troubleshoot why the configured log file is not being created.

Re: Allowing DEM to Apply Computer Environment Settings - "disabled via configuration"

skocatt — Mon, 23 Aug 2021 13:15:44 GMT

Hello @DEMdev ,

My apologize for later response, its me again as re-named @Skocza , trying to resolve the with enabling Computer environment within DEM (version 2006 currently).

I have checked those event logs where I have found this for the issue, see the screenshots:

Then this when refresh flexengine

Could be there some guide with better described "how to" for computer permissions adding for the specific folders? Should it be as domain computers added as follows?:

- for config folders (where also general folder contained) see on screenshot below

+ that for sharing permissions

- for Profile folder

Those above seetings plus all those in registry of course to have comp emv enabled, which flexengine logs says its enabled, but I cant deliver any settings or have that log file (for comp env.) created at all.

Thanks for any advise!

Re: Allowing DEM to Apply Computer Environment Settings - "disabled via configuration"

anil_agarwal — Tue, 24 Aug 2021 08:44:35 GMT

@skocatt Few things to check:

1. Computer environment is configured as per DEM documentation. We simplified this in later DEM releases by not requiring configuration in HKLM but providing install time parameters and optional XML file. https://docs.vmware.com/en/VMware-Dynamic-Environment-Manager/2106/com.vmware.dynamic.environment.manager-install-config/GUID-B2EC9E13-CFE6-46AE-8271-76AF7F6C3411.html

However, old style configuration in "HKLM\SOFTWARE\VMware, Inc.\VMware UEM\Agent\Computer Configuration" in the base image would continue to work as well.

2. Config share is available during user computer startup. Event log indicates it was not available.

3. NTFS permissions are configured for config share and profile archive share (for log file) as per https://docs.vmware.com/en/VMware-Dynamic-Environment-Manager/2106/com.vmware.dynamic.environment.manager-install-config/GUID-3ABE3E08-28DF-4AB8-BCEA-197DFD31DA54.html