diff --git a/mdop/TOC.md b/mdop/TOC.md index cbac82ca91..95989340b5 100644 --- a/mdop/TOC.md +++ b/mdop/TOC.md @@ -1 +1,19 @@ -#[MDOP Placeholder](index.md) \ No newline at end of file +# [Microsoft Desktop Optimization Pack](index.md) +## [Advanced Group Policy Management] (agpm/) +## [Application Virtualization]() +### [Application Virtualization 4](appv-v4/) +### [Application Virtualization 5](appv-v5/) +## [Diagnostics and Recovery Toolset]() +### [Diagnostics and Recovery Toolset 10](dart-v10/) +### [Diagnostics and Recovery Toolset 8](dart-v8/) +### [Diagnostics and Recovery Toolset 7](dart-v7/) +## [Microsoft Bitlocker Administration and Monitoring]() +### [Microsoft Bitlocker Administration and Monitoring 2.5](mbam-v25/) +### [Microsoft Bitlocker Administration and Monitoring 2](mbam-v2/) +### [Microsoft Bitlocker Administration and Monitoring 1](mbam-v1/) +## [Microsoft Enterprise Desktop Virtualization]() +### [Microsoft Enterprise Desktop Virtualization 2](mdev-v2/) +## [User Experience Virtualization]() +### [User Experience Virtualization 2](uev-v2/) +### [User Experience Virtualization 2](uev-v1/) +## [MDOP Solutions and Scenarios](solutions/) \ No newline at end of file diff --git a/mdop/agpm/TOC.md b/mdop/agpm/TOC.md new file mode 100644 index 0000000000..17167f82b9 --- /dev/null +++ b/mdop/agpm/TOC.md @@ -0,0 +1,243 @@ +# [Advanced Group Policy Management](index.md) +## [Technical Overview of AGPM](technical-overview-of-agpm.md) +## [Choosing Which Version of AGPM to Install](choosing-which-version-of-agpm-to-install.md) +## [AGPM 4.0 SP3 [NavEngl]](agpm-40-sp3-navengl.md) +### [What's New in AGPM 4.0 SP3](whats-new-in-agpm-40-sp3.md) +#### [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3](release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md) +## [AGPM 4.0 SP2 [NavEngl]](agpm-40-sp2-navengl.md) +### [What's New in AGPM 4.0 SP2](whats-new-in-agpm-40-sp2.md) +#### [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2](release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md) +## [AGPM 4.0 SP1 [NavEngl]](agpm-40-sp1-navengl.md) +### [What's New in AGPM 4.0 SP1](whats-new-in-agpm-40-sp1.md) +### [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1](release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md) +## [AGPM 4 [NavEngl]](agpm-4-navengl.md) +### [What's New in AGPM 4.0](whats-new-in-agpm-40.md) +### [Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0](step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md) +### [Operations Guide for Microsoft Advanced Group Policy Management 4.0](operations-guide-for-microsoft-advanced-group-policy-management-40.md) +#### [Overview of Advanced Group Policy Management [AGPM40]](overview-of-advanced-group-policy-management-agpm40.md) +#### [Best Practices for Version Control [AGPM40]](best-practices-for-version-control-agpm40.md) +#### [Checklist: Administer the AGPM Server and Archive [AGPM40]](checklist-administer-the-agpm-server-and-archive-agpm40.md) +#### [Checklist: Create, Edit, and Deploy a GPO [AGPM40]](checklist-create-edit-and-deploy-a-gpo-agpm40.md) +#### [Search and Filter the List of GPOs](search-and-filter-the-list-of-gpos.md) +#### [Performing AGPM Administrator Tasks [AGPM40]](performing-agpm-administrator-tasks-agpm40.md) +##### [Configuring Advanced Group Policy Management [AGPM40]](configuring-advanced-group-policy-management-agpm40.md) +###### [Configure AGPM Server Connections [AGPM40]](configure-agpm-server-connections-agpm40.md) +###### [Configure E-Mail Notification [AGPM40]](configure-e-mail-notification-agpm40.md) +###### [Configure E-Mail Security for AGPM [AGPM40]](configure-e-mail-security-for-agpm-agpm40.md) +###### [Delegate Access to the Production Environment [AGPM40]](delegate-access-to-the-production-environment-agpm40.md) +###### [Configure Logging and Tracing [AGPM40]](configure-logging-and-tracing-agpm40.md) +##### [Managing the Archive [AGPM40]](managing-the-archive-agpm40.md) +###### [Delegate Domain-Level Access to the Archive [AGPM40]](delegate-domain-level-access-to-the-archive-agpm40.md) +###### [Delegate Access to an Individual GPO in the Archive [AGPM40]](delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md) +###### [Limit the GPO Versions Stored [AGPM40]](limit-the-gpo-versions-stored-agpm40.md) +###### [Import a GPO from a File [AGPMAdmin]](import-a-gpo-from-a-file-agpmadmin.md) +###### [Back Up the Archive [AGPM40]](back-up-the-archive-agpm40.md) +###### [Restore the Archive from a Backup [AGPM40]](restore-the-archive-from-a-backup-agpm40.md) +##### [Managing the AGPM Service [AGPM40]](managing-the-agpm-service-agpm40.md) +###### [Start and Stop the AGPM Service [AGPM40]](start-and-stop-the-agpm-service-agpm40.md) +###### [Modify the AGPM Service [AGPM40]](modify-the-agpm-service-agpm40.md) +##### [Move the AGPM Server and the Archive [AGPM40]](move-the-agpm-server-and-the-archive-agpm40.md) +#### [Performing Editor Tasks [AGPM40]](performing-editor-tasks-agpm40.md) +##### [Creating or Controlling a GPO [AGPM40_Ed]](creating-or-controlling-a-gpo-agpm40-ed.md) +###### [Request Control of an Uncontrolled GPO [AGPM40]](request-control-of-an-uncontrolled-gpo-agpm40.md) +###### [Request the Creation of a New Controlled GPO [AGPM40]](request-the-creation-of-a-new-controlled-gpo-agpm40.md) +###### [Import a GPO from Production [AGPM40_Ed]](import-a-gpo-from-production-agpm40-ed.md) +##### [Editing a GPO [AGPM40]](editing-a-gpo-agpm40.md) +###### [Edit a GPO Offline [AGPM40]](edit-a-gpo-offline-agpm40.md) +###### [Label the Current Version of a GPO [AGPM40]](label-the-current-version-of-a-gpo-agpm40.md) +###### [Rename a GPO or Template [AGPM40]](rename-a-gpo-or-template-agpm40.md) +##### [Using a Test Environment](using-a-test-environment.md) +###### [Export a GPO to a File](export-a-gpo-to-a-file.md) +###### [Import a GPO from a File [Ed]](import-a-gpo-from-a-file-ed.md) +###### [Test a GPO in a Separate Organizational Unit [AGPM40]](test-a-gpo-in-a-separate-organizational-unit-agpm40.md) +##### [Request Deployment of a GPO [AGPM40]](request-deployment-of-a-gpo-agpm40.md) +##### [Creating a Template and Setting a Default Template [AGPM40]](creating-a-template-and-setting-a-default-template-agpm40.md) +###### [Create a Template [AGPM40]](create-a-template-agpm40.md) +###### [Set a Default Template [AGPM40]](set-a-default-template-agpm40.md) +##### [Deleting or Restoring a GPO [AGPM40]](deleting-or-restoring-a-gpo-agpm40.md) +###### [Request Deletion of a GPO [AGPM40]](request-deletion-of-a-gpo-agpm40.md) +###### [Request Restoration of a Deleted GPO [AGPM40]](request-restoration-of-a-deleted-gpo-agpm40.md) +#### [Performing Approver Tasks [AGPM40]](performing-approver-tasks-agpm40.md) +##### [Approve or Reject a Pending Action [AGPM40]](approve-or-reject-a-pending-action-agpm40.md) +##### [Creating or Controlling a GPO [AGPM40_App]](creating-or-controlling-a-gpo-agpm40-app.md) +###### [Control an Uncontrolled GPO [AGPM40]](control-an-uncontrolled-gpo-agpm40.md) +###### [Create a New Controlled GPO [AGPM40]](create-a-new-controlled-gpo-agpm40.md) +###### [Delegate Management of a Controlled GPO [AGPM40]](delegate-management-of-a-controlled-gpo-agpm40.md) +###### [Import a GPO from Production [AGPM40_App]](import-a-gpo-from-production-agpm40-app.md) +##### [Check In a GPO [AGPM40]](check-in-a-gpo-agpm40.md) +##### [Deploy a GPO [AGPM40]](deploy-a-gpo-agpm40.md) +##### [Roll Back to an Earlier Version of a GPO [AGPM40]](roll-back-to-an-earlier-version-of-a-gpo-agpm40.md) +##### [Deleting, Restoring, or Destroying a GPO [AGPM40]](deleting-restoring-or-destroying-a-gpo-agpm40.md) +###### [Delete a Controlled GPO [AGPM40]](delete-a-controlled-gpo-agpm40.md) +###### [Restore a Deleted GPO [AGPM40]](restore-a-deleted-gpo-agpm40.md) +###### [Destroy a GPO [AGPM40]](destroy-a-gpo-agpm40.md) +#### [Performing Reviewer Tasks [AGPM40]](performing-reviewer-tasks-agpm40.md) +##### [Configure an AGPM Server Connection [AGPM40]](configure-an-agpm-server-connection-agpm40.md) +##### [Review GPO Settings [AGPM40]](review-gpo-settings-agpm40.md) +##### [Review GPO Links [AGPM40]](review-gpo-links-agpm40.md) +##### [Identify Differences Between GPOs, GPO Versions, or Templates [AGPM40]](identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md) +#### [Troubleshooting AGPM](troubleshooting-agpm-agpm40.md) +#### [User Interface: Advanced Group Policy Management [AGPM40]](user-interface-advanced-group-policy-management-agpm40.md) +##### [Contents Tab [AGPM40]](contents-tab-agpm40.md) +###### [Contents Tab Features [AGPM40]](contents-tab-features-agpm40.md) +###### [History Window [AGPM40]](history-window-agpm40.md) +###### [Controlled GPO Commands [AGPM40]](controlled-gpo-commands-agpm40.md) +###### [Uncontrolled GPO Commands [AGPM40]](uncontrolled-gpo-commands-agpm40.md) +###### [Pending GPO Commands [AGPM40]](pending-gpo-commands-agpm40.md) +###### [Template Commands [AGPM40]](template-commands-agpm40.md) +###### [Recycle Bin Commands [AGPM40]](recycle-bin-commands-agpm40.md) +##### [Domain Delegation Tab [AGPM40]](domain-delegation-tab-agpm40.md) +##### [AGPM Server Tab [AGPM40]](agpm-server-tab-agpm40.md) +##### [Production Delegation Tab [AGPM40]](production-delegation-tab-agpm40.md) +##### [Administrative Templates Folder [AGPM40]](administrative-templates-folder-agpm40.md) +###### [Logging and Tracing Settings [AGPM40]](logging-and-tracing-settings-agpm40.md) +###### [AGPM Server Connection Settings [AGPM40]](agpm-server-connection-settings-agpm40.md) +###### [Feature Visibility Settings [AGPM40]](feature-visibility-settings-agpm40.md) +### [Release Notes for Microsoft Advanced Group Policy Management 4.0](release-notes-for-microsoft-advanced-group-policy-management-40.md) +## [AGPM 3 [NavEngl]](agpm-3-navengl.md) +### [What's New in AGPM 3.0](whats-new-in-agpm-30.md) +### [Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0](step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md) +### [Operations Guide for Microsoft Advanced Group Policy Management 3.0 [AGPM30Ops]](operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md) +#### [Overview of Advanced Group Policy Management [AGPM30Ops]](overview-of-advanced-group-policy-management-agpm30ops.md) +#### [Best Practices for Version Control](best-practices-for-version-control.md) +#### [Checklist: Administer the AGPM Server and Archive](checklist-administer-the-agpm-server-and-archive.md) +#### [Checklist: Create, Edit, and Deploy a GPO [AGPM30Ops]](checklist-create-edit-and-deploy-a-gpo-agpm30ops.md) +#### [Performing AGPM Administrator Tasks [AGPM30Ops]](performing-agpm-administrator-tasks-agpm30ops.md) +##### [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management.md) +###### [Configure AGPM Server Connections [AGPM30Ops]](configure-agpm-server-connections-agpm30ops.md) +###### [Configure E-Mail Notification [AGPM30Ops]](configure-e-mail-notification-agpm30ops.md) +###### [Configure E-Mail Security for AGPM [AGPM30Ops]](configure-e-mail-security-for-agpm-agpm30ops.md) +###### [Delegate Access to the Production Environment [AGPM30Ops]](delegate-access-to-the-production-environment-agpm30ops.md) +###### [Configure Logging and Tracing [AGPM30Ops]](configure-logging-and-tracing-agpm30ops.md) +##### [Managing the Archive](managing-the-archive.md) +###### [Delegate Domain-Level Access to the Archive [AGPM30Ops]](delegate-domain-level-access-to-the-archive-agpm30ops.md) +###### [Delegate Access to an Individual GPO in the Archive [AGPM30Ops]](delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md) +###### [Limit the GPO Versions Stored [AGPM30Ops]](limit-the-gpo-versions-stored-agpm30ops.md) +###### [Back Up the Archive](back-up-the-archive.md) +###### [Restore the Archive from a Backup](restore-the-archive-from-a-backup.md) +##### [Managing the AGPM Service [AGPM30Ops]](managing-the-agpm-service-agpm30ops.md) +###### [Start and Stop the AGPM Service [AGPM30Ops]](start-and-stop-the-agpm-service-agpm30ops.md) +###### [Modify the AGPM Service [AGPM30Ops]](modify-the-agpm-service-agpm30ops.md) +##### [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md) +#### [Performing Editor Tasks [AGPM30Ops]](performing-editor-tasks-agpm30ops.md) +##### [Creating, Controlling, or Importing a GPO [AGPM30Ops]](creating-controlling-or-importing-a-gpo-agpm30ops.md) +###### [Request Control of an Uncontrolled GPO [AGPM30Ops]](request-control-of-an-uncontrolled-gpo-agpm30ops.md) +###### [Request the Creation of a New Controlled GPO [AGPM30Ops]](request-the-creation-of-a-new-controlled-gpo-agpm30ops.md) +###### [Import a GPO from Production [AGPM30Ops]](import-a-gpo-from-production-agpm30ops.md) +##### [Editing a GPO [AGPM30Ops]](editing-a-gpo-agpm30ops.md) +###### [Edit a GPO Offline [AGPM30Ops]](edit-a-gpo-offline-agpm30ops.md) +###### [Use a Test Environment [AGPM30Ops]](use-a-test-environment-agpm30ops.md) +###### [Request Deployment of a GPO [AGPM30Ops]](request-deployment-of-a-gpo-agpm30ops.md) +###### [Label the Current Version of a GPO [AGPM30Ops]](label-the-current-version-of-a-gpo-agpm30ops.md) +###### [Rename a GPO or Template [AGPM30Ops]](rename-a-gpo-or-template-agpm30ops.md) +##### [Creating a Template and Setting a Default Template [AGPM30Ops]](creating-a-template-and-setting-a-default-template-agpm30ops.md) +###### [Create a Template [AGPM30Ops]](create-a-template-agpm30ops.md) +###### [Set a Default Template [AGPM30Ops]](set-a-default-template-agpm30ops.md) +##### [Deleting or Restoring a GPO [AGPM30Ops]](deleting-or-restoring-a-gpo-agpm30ops.md) +###### [Request Deletion of a GPO [AGPM30Ops]](request-deletion-of-a-gpo-agpm30ops.md) +###### [Request Restoration of a Deleted GPO [AGPM30Ops]](request-restoration-of-a-deleted-gpo-agpm30ops.md) +#### [Performing Approver Tasks [AGPM30Ops]](performing-approver-tasks-agpm30ops.md) +##### [Approve or Reject a Pending Action [AGPM30Ops]](approve-or-reject-a-pending-action-agpm30ops.md) +##### [Creating, Controlling, or Importing a GPO [Editor_AGPM30Ops]](creating-controlling-or-importing-a-gpo-editor-agpm30ops.md) +###### [Control an Uncontrolled GPO [AGPM30Ops]](control-an-uncontrolled-gpo-agpm30ops.md) +###### [Create a New Controlled GPO [AGPM30Ops]](create-a-new-controlled-gpo-agpm30ops.md) +###### [Delegate Management of a Controlled GPO [AGPM30Ops]](delegate-management-of-a-controlled-gpo-agpm30ops.md) +###### [Import a GPO from Production [Editor_AGPM30Ops]](import-a-gpo-from-production-editor-agpm30ops.md) +##### [Check In a GPO [AGPM30Ops]](check-in-a-gpo-agpm30ops.md) +##### [Deploy a GPO [AGPM30Ops]](deploy-a-gpo-agpm30ops.md) +##### [Roll Back to a Previous Version of a GPO [AGPM30Ops]](roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md) +##### [Deleting, Restoring, or Destroying a GPO [AGPM30Ops]](deleting-restoring-or-destroying-a-gpo-agpm30ops.md) +###### [Delete a Controlled GPO [AGPM30Ops]](delete-a-controlled-gpo-agpm30ops.md) +###### [Restore a Deleted GPO [AGPM30Ops]](restore-a-deleted-gpo-agpm30ops.md) +###### [Destroy a GPO [AGPM30Ops]](destroy-a-gpo-agpm30ops.md) +#### [Performing Reviewer Tasks [AGPM30Ops]](performing-reviewer-tasks-agpm30ops.md) +##### [Configure an AGPM Server Connection [Reviewer_AGPM30Ops]](configure-an-agpm-server-connection-reviewer-agpm30ops.md) +##### [Review GPO Settings [AGPM30Ops]](review-gpo-settings-agpm30ops.md) +##### [Review GPO Links [AGPM30Ops]](review-gpo-links-agpm30ops.md) +##### [Identify Differences Between GPOs, GPO Versions, or Templates [AGPM30Ops]](identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md) +#### [Troubleshooting AGPM](troubleshooting-advanced-group-policy-management-agpm30ops.md) +#### [User Interface: Advanced Group Policy Management [AGPM30Ops]](user-interface-advanced-group-policy-management-agpm30ops.md) +##### [Contents Tab [AGPM30Ops]](contents-tab-agpm30ops.md) +###### [Contents Tab Features [AGPM30Ops]](contents-tab-features-agpm30ops.md) +###### [History Window [AGPM30Ops]](history-window-agpm30ops.md) +###### [Controlled GPO Commands [AGPM30Ops]](controlled-gpo-commands-agpm30ops.md) +###### [Uncontrolled GPO Commands [AGPM30Ops]](uncontrolled-gpo-commands-agpm30ops.md) +###### [Pending GPO Commands [AGPM30Ops]](pending-gpo-commands-agpm30ops.md) +###### [Template Commands [AGPM30Ops]](template-commands-agpm30ops.md) +###### [Recycle Bin Commands [AGPM30Ops]](recycle-bin-commands-agpm30ops.md) +##### [Domain Delegation Tab [AGPM30Ops]](domain-delegation-tab-agpm30ops.md) +##### [AGPM Server Tab [AGPM30Ops]](agpm-server-tab-agpm30ops.md) +##### [Production Delegation Tab [AGPM30Ops]](production-delegation-tab-agpm30ops.md) +##### [Administrative Templates Folder [AGPM30Ops]](administrative-templates-folder-agpm30ops.md) +###### [Logging and Tracing Settings [AGPM30Ops]](logging-and-tracing-settings-agpm30ops.md) +###### [AGPM Server Connection Settings [AGPM30Ops]](agpm-server-connection-settings-agpm30ops.md) +###### [Feature Visibility Settings [AGPM30Ops]](feature-visibility-settings-agpm30ops.md) +## [AGPM 2.5 [NavEngl]](agpm-25-navengl.md) +### [Step-by-Step Guide for Microsoft Advanced Group Policy Management 2.5](step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md) +### [Operations Guide for Microsoft Advanced Group Policy Management 2.5](operations-guide-for-microsoft-advanced-group-policy-management-25.md) +#### [Overview of Advanced Group Policy Management](overview-of-advanced-group-policy-management.md) +#### [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo.md) +#### [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) +##### [Configure the AGPM Server Connection](configure-the-agpm-server-connection.md) +##### [Configure E-Mail Notification](configure-e-mail-notification.md) +##### [Delegate Domain-Level Access](delegate-domain-level-access.md) +##### [Delegate Access to an Individual GPO](delegate-access-to-an-individual-gpo.md) +##### [Configure Logging and Tracing](configure-logging-and-tracing.md) +##### [Managing the AGPM Service](managing-the-agpm-service.md) +###### [Start and Stop the AGPM Service](start-and-stop-the-agpm-service.md) +###### [Modify the Archive Path](modify-the-archive-path.md) +###### [Modify the AGPM Service Account](modify-the-agpm-service-account.md) +###### [Modify the Port on Which the AGPM Service Listens](modify-the-port-on-which-the-agpm-service-listens.md) +#### [Performing Editor Tasks](performing-editor-tasks.md) +##### [Creating, Controlling, or Importing a GPO [Editor]](creating-controlling-or-importing-a-gpo-editor.md) +###### [Request Control of a Previously Uncontrolled GPO](request-control-of-a-previously-uncontrolled-gpo.md) +###### [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo.md) +###### [Import a GPO from Production [Editor]](import-a-gpo-from-production-editor.md) +##### [Editing a GPO](editing-a-gpo.md) +###### [Edit a GPO Offline](edit-a-gpo-offline.md) +###### [Use a Test Environment](use-a-test-environment.md) +###### [Request Deployment of a GPO](request-deployment-of-a-gpo.md) +###### [Label the Current Version of a GPO](label-the-current-version-of-a-gpo.md) +###### [Rename a GPO or Template](rename-a-gpo-or-template.md) +##### [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template.md) +###### [Create a Template](create-a-template.md) +###### [Set a Default Template](set-a-default-template.md) +##### [Delete a GPO [Editor]](delete-a-gpo-editor.md) +#### [Performing Approver Tasks](performing-approver-tasks.md) +##### [Approve or Reject a Pending Action](approve-or-reject-a-pending-action.md) +##### [Creating, Controlling, or Importing a GPO [Approver]](creating-controlling-or-importing-a-gpo-approver.md) +###### [Control a Previously Uncontrolled GPO](control-a-previously-uncontrolled-gpo.md) +###### [Create a New Controlled GPO](create-a-new-controlled-gpo.md) +###### [Delegate Access to a GPO](delegate-access-to-a-gpo.md) +###### [Import a GPO from Production [Approver]](import-a-gpo-from-production-approver.md) +##### [Check In a GPO [Approver]](check-in-a-gpo-approver.md) +##### [Deploy a GPO](deploy-a-gpo.md) +##### [Roll Back to a Previous Version of a GPO](roll-back-to-a-previous-version-of-a-gpo.md) +##### [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo.md) +###### [Delete a GPO [Approver]](delete-a-gpo-approver.md) +###### [Restore a Deleted GPO](restore-a-deleted-gpo.md) +###### [Destroy a GPO](destroy-a-gpo.md) +#### [Performing Reviewer Tasks](performing-reviewer-tasks.md) +##### [Configure the AGPM Server Connection [Reviewer]](configure-the-agpm-server-connection-reviewer.md) +##### [Review GPO Settings](review-gpo-settings.md) +##### [Review GPO Links](review-gpo-links.md) +##### [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates.md) +#### [Troubleshooting Advanced Group Policy Management](troubleshooting-advanced-group-policy-management.md) +#### [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) +##### [Contents Tab](contents-tab.md) +###### [Controlled Tab](controlled-tab.md) +###### [Uncontrolled Tab](uncontrolled-tab.md) +###### [Pending Tab](pending-tab.md) +###### [Templates Tab](templates-tab.md) +###### [Recycle Bin Tab](recycle-bin-tab.md) +###### [Common Secondary Tab Features](common-secondary-tab-features.md) +###### [History Window](history-window.md) +##### [Domain Delegation Tab](domain-delegation-tab.md) +##### [AGPM Server Tab](agpm-server-tab.md) +##### [Administrative Template Settings](administrative-template-settings.md) +###### [Logging and Tracing Settings](logging-and-tracing-settings.md) +###### [AGPM Server Connection Settings](agpm-server-connection-settings.md) +###### [Feature Visibility Settings](feature-visibility-settings.md) +##### [Other Enhancements to the GPMC](other-enhancements-to-the-gpmc.md) +## [Resources for AGPM](resources-for-agpm.md) + diff --git a/mdop/agpm/administrative-template-settings.md b/mdop/agpm/administrative-template-settings.md new file mode 100644 index 0000000000..e5aef2ff80 --- /dev/null +++ b/mdop/agpm/administrative-template-settings.md @@ -0,0 +1,32 @@ +--- +title: Administrative Template Settings +description: Administrative Template Settings +ms.assetid: 1abbf0c1-fd32-46a8-a3ba-c005f066523d +author: MaggiePucciEvans +--- + +# Administrative Template Settings + + +The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure logging and tracing options for AGPM clients and servers to which a Group Policy object (GPO) with these settings is applied. Similarly, these settings enable you to centrally configure archive locations and the visibility of the **Change Control** node and **History** tab for Group Policy administrators to whom a GPO with these settings is applied. + +- [Logging and Tracing Settings](logging-and-tracing-settings.md) + +- [AGPM Server Connection Settings](agpm-server-connection-settings.md) + +- [Feature Visibility Settings](feature-visibility-settings.md) + +### Additional references + +- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) + +- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) + + + + + + + + + diff --git a/mdop/agpm/administrative-templates-folder-agpm30ops.md b/mdop/agpm/administrative-templates-folder-agpm30ops.md new file mode 100644 index 0000000000..6d558047b1 --- /dev/null +++ b/mdop/agpm/administrative-templates-folder-agpm30ops.md @@ -0,0 +1,32 @@ +--- +title: Administrative Templates Folder +description: Administrative Templates Folder +ms.assetid: 0cc5b570-b6d3-4841-9646-02521c13519c +author: MaggiePucciEvans +--- + +# Administrative Templates Folder + + +The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure logging and tracing options for AGPM Clients and AGPM Servers to which a Group Policy Object (GPO) with these settings is applied. Similarly, these settings enable you to centrally configure archive locations and the visibility of the **Change Control** folder and **History** tab for Group Policy administrators to whom a GPO with these settings is applied. + +- [Logging and Tracing Settings](logging-and-tracing-settings-agpm30ops.md) + +- [AGPM Server Connection Settings](agpm-server-connection-settings-agpm30ops.md) + +- [Feature Visibility Settings](feature-visibility-settings-agpm30ops.md) + +### Additional references + +- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm30ops.md) + +- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) + + + + + + + + + diff --git a/mdop/agpm/administrative-templates-folder-agpm40.md b/mdop/agpm/administrative-templates-folder-agpm40.md new file mode 100644 index 0000000000..5fcde60a99 --- /dev/null +++ b/mdop/agpm/administrative-templates-folder-agpm40.md @@ -0,0 +1,32 @@ +--- +title: Administrative Templates Folder +description: Administrative Templates Folder +ms.assetid: abc41968-4505-4b09-94f2-67ee0e6c9aaf +author: MaggiePucciEvans +--- + +# Administrative Templates Folder + + +The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure logging and tracing options for AGPM Clients and AGPM Servers to which a Group Policy Object (GPO) with these settings is applied. Similarly, these settings enable you to centrally configure archive locations and the visibility of the **Change Control** folder and **History** tab for Group Policy administrators to whom a GPO with these settings is applied. + +- [Logging and Tracing Settings](logging-and-tracing-settings-agpm40.md) + +- [AGPM Server Connection Settings](agpm-server-connection-settings-agpm40.md) + +- [Feature Visibility Settings](feature-visibility-settings-agpm40.md) + +### Additional references + +- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) + +- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) + + + + + + + + + diff --git a/mdop/agpm/agpm-25-navengl.md b/mdop/agpm/agpm-25-navengl.md new file mode 100644 index 0000000000..83618a4c13 --- /dev/null +++ b/mdop/agpm/agpm-25-navengl.md @@ -0,0 +1,22 @@ +--- +title: AGPM 2.5 +description: AGPM 2.5 +ms.assetid: 6db42f2e-88b2-4305-ab6b-d3cd0c5d686c +author: MaggiePucciEvans +--- + +# AGPM 2.5 + + +- [Step-by-Step Guide for Microsoft Advanced Group Policy Management 2.5](step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md) + +- [Operations Guide for Microsoft Advanced Group Policy Management 2.5](operations-guide-for-microsoft-advanced-group-policy-management-25.md) + + + + + + + + + diff --git a/mdop/agpm/agpm-3-navengl.md b/mdop/agpm/agpm-3-navengl.md new file mode 100644 index 0000000000..d433e98811 --- /dev/null +++ b/mdop/agpm/agpm-3-navengl.md @@ -0,0 +1,24 @@ +--- +title: AGPM 3 +description: AGPM 3 +ms.assetid: b0d0051d-2900-4a0f-8307-552ad26b0e3b +author: MaggiePucciEvans +--- + +# AGPM 3 + + +- [What's New in AGPM 3.0](whats-new-in-agpm-30.md) + +- [Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0](step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md) + +- [Operations Guide for Microsoft Advanced Group Policy Management 3.0](operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md) + + + + + + + + + diff --git a/mdop/agpm/agpm-4-navengl.md b/mdop/agpm/agpm-4-navengl.md new file mode 100644 index 0000000000..a0abc0ed32 --- /dev/null +++ b/mdop/agpm/agpm-4-navengl.md @@ -0,0 +1,26 @@ +--- +title: AGPM 4 +description: AGPM 4 +ms.assetid: 81693f30-1b8e-4e63-b1ac-e6de1bc30cc0 +author: MaggiePucciEvans +--- + +# AGPM 4 + + +- [What's New in AGPM 4.0](whats-new-in-agpm-40.md) + +- [Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0](step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md) + +- [Operations Guide for Microsoft Advanced Group Policy Management 4.0](operations-guide-for-microsoft-advanced-group-policy-management-40.md) + +- [Release Notes for Microsoft Advanced Group Policy Management 4.0](release-notes-for-microsoft-advanced-group-policy-management-40.md) + + + + + + + + + diff --git a/mdop/agpm/agpm-40-sp1-navengl.md b/mdop/agpm/agpm-40-sp1-navengl.md new file mode 100644 index 0000000000..70a6ccd07a --- /dev/null +++ b/mdop/agpm/agpm-40-sp1-navengl.md @@ -0,0 +1,22 @@ +--- +title: AGPM 4.0 SP1 +description: AGPM 4.0 SP1 +ms.assetid: 4e55d9e6-635c-4ba6-acbb-ed1d1b580a5b +author: MaggiePucciEvans +--- + +# AGPM 4.0 SP1 + + +- [What's New in AGPM 4.0 SP1](whats-new-in-agpm-40-sp1.md) + +- [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1](release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md) + + + + + + + + + diff --git a/mdop/agpm/agpm-40-sp2-navengl.md b/mdop/agpm/agpm-40-sp2-navengl.md new file mode 100644 index 0000000000..1844e582d5 --- /dev/null +++ b/mdop/agpm/agpm-40-sp2-navengl.md @@ -0,0 +1,22 @@ +--- +title: AGPM 4.0 SP2 +description: AGPM 4.0 SP2 +ms.assetid: 915c9791-ac07-43db-bd53-957b641c700f +author: MaggiePucciEvans +--- + +# AGPM 4.0 SP2 + + +- [What's New in AGPM 4.0 SP2](whats-new-in-agpm-40-sp2.md) + +- [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2](release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md) + + + + + + + + + diff --git a/mdop/agpm/agpm-40-sp3-navengl.md b/mdop/agpm/agpm-40-sp3-navengl.md new file mode 100644 index 0000000000..c3199057c0 --- /dev/null +++ b/mdop/agpm/agpm-40-sp3-navengl.md @@ -0,0 +1,22 @@ +--- +title: AGPM 4.0 SP3 +description: AGPM 4.0 SP3 +ms.assetid: cd80eea9-601f-4e45-b89e-c3904addee37 +author: MaggiePucciEvans +--- + +# AGPM 4.0 SP3 + + +- [What's New in AGPM 4.0 SP3](whats-new-in-agpm-40-sp3.md) + +- [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3](release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md) + + + + + + + + + diff --git a/mdop/agpm/agpm-server-connection-settings-agpm30ops.md b/mdop/agpm/agpm-server-connection-settings-agpm30ops.md new file mode 100644 index 0000000000..5b6079dd1e --- /dev/null +++ b/mdop/agpm/agpm-server-connection-settings-agpm30ops.md @@ -0,0 +1,53 @@ +--- +title: AGPM Server Connection Settings +description: AGPM Server Connection Settings +ms.assetid: 5f03e397-b868-4c49-9cbf-a5f5d0ddcc39 +author: MaggiePucciEvans +--- + +# AGPM Server Connection Settings + + +You can use Administrative template settings for Advanced Group Policy Management (AGPM) to centrally configure AGPM Server connections for Group Policy administrators to whom a Group Policy Object (GPO) with these settings is applied. + +The following settings are available under User Configuration\\Policies\\Administrative Templates\\Windows Components\\AGPM when editing a GPO. + +
Setting | +Effect | +
---|---|
AGPM: Specify default AGPM Server (all domains) |
+This policy setting allows you to specify a default AGPM Server for all domains. This is used only by AGPM Clients, and restricts Group Policy administrators from connecting to another archive. You can override this default for individual domains using the AGPM: Specify AGPM Servers setting. |
+
AGPM: Specify AGPM Servers |
+This policy setting allows you to specify the AGPM Servers for individual domains. This is used only by AGPM Clients, and restricts Group Policy administrators from connecting to a different archive for the specified domain. To specify a default AGPM Server, use the AGPM: Specify default AGPM Server (all domains) setting and use this policy setting to override the default on a per domain basis. |
+
Setting | +Effect | +
---|---|
AGPM: Specify default AGPM Server (all domains) |
+This policy setting allows you to specify a default AGPM Server for all domains. This is used only by AGPM Clients, and restricts Group Policy administrators from connecting to another archive. You can override this default for individual domains using the AGPM: Specify AGPM Servers setting. |
+
AGPM: Specify AGPM Servers |
+This policy setting allows you to specify the AGPM Servers for individual domains. This is used only by AGPM Clients, and restricts Group Policy administrators from connecting to a different archive for the specified domain. To specify a default AGPM Server, use the AGPM: Specify default AGPM Server (all domains) setting and use this policy setting to override the default on a per domain basis. |
+
Setting | +Effect | +
---|---|
AGPM Server (all domains) |
+If enabled, this setting centrally configures one AGPM Server connection for use by all domains and disables the settings on the AGPM Server tab for Group Policy administrators. For multiple AGPM Servers, configure this setting with a default server and then configure the AGPM Server setting in the Administrative template to override this server for other domains. +If disabled or not configured, each Group Policy administrator must select the AGPM Server to display for each domain on the AGPM Server tab in AGPM. |
+
AGPM Server |
+If enabled, this setting centrally configures multiple domain-specific AGPM Servers, overriding the AGPM Server (all domains) setting in the Administrative template. If your environment requires only a single AGPM Server, use only the AGPM Server (all domains) setting in the Administrative template. +If disabled or not configured, the AGPM Server (all domains) setting in the Administrative template configures the AGPM Server connection. |
+
Frequent Task | +Reference | +
---|---|
Delegate access to Group Policy Objects (GPOs) in the archive. |
+[Delegate Domain-Level Access to the Archive](delegate-domain-level-access-to-the-archive-agpm40.md) +[Delegate Access to an Individual GPO in the Archive](delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md) |
+
Back up the archive to enable disaster recovery. |
+[Back Up the Archive](back-up-the-archive-agpm40.md) |
+
Infrequent Task | +Reference | +
---|---|
Restore the archive from a backup to recover from a disaster. |
+[Restore the Archive from a Backup](restore-the-archive-from-a-backup-agpm40.md) |
+
Move the AGPM Service, the archive, or both to a different server. |
+[Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive-agpm40.md) |
+
Change the archive path, the AGPM Service Account, or the port on which the AGPM Service listens. |
+[Modify the AGPM Service](modify-the-agpm-service-agpm40.md) |
+
Troubleshoot common problems with the AGPM Server. |
+[Troubleshooting AGPM](troubleshooting-agpm-agpm40.md) +[Configure Logging and Tracing](configure-logging-and-tracing-agpm40.md) |
+
Frequent Task | +Reference | +
---|---|
Delegate access to Group Policy Objects (GPOs) in the archive. |
+[Delegate Domain-Level Access to the Archive](delegate-domain-level-access-to-the-archive-agpm30ops.md) +[Delegate Access to an Individual GPO in the Archive](delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md) |
+
Back up the archive to enable disaster recovery. |
+[Back Up the Archive](back-up-the-archive.md) |
+
Infrequent Task | +Reference | +
---|---|
Restore the archive from a backup to recover from a disaster. |
+[Restore the Archive from a Backup](restore-the-archive-from-a-backup.md) |
+
Move the AGPM Service, the archive, or both to a different server. |
+[Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md) |
+
Change the archive path, the AGPM Service Account, or the port on which the AGPM Service listens. |
+[Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md) |
+
Troubleshoot common problems with the AGPM Server. |
+[Troubleshooting Advanced Group Policy Management](troubleshooting-advanced-group-policy-management-agpm30ops.md) +[Configure Logging and Tracing](configure-logging-and-tracing-agpm30ops.md) |
+
Task | +Reference | +
---|---|
Editor requests the creation of a new GPO or an Approver creates a new GPO. |
+[Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm30ops.md) +[Create a New Controlled GPO](create-a-new-controlled-gpo-agpm30ops.md) |
+
Approver approves the creation of the GPO if it was requested by an Editor. |
+[Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm30ops.md) |
+
Editor checks out a copy of the GPO from the archive, so no one else can modify the GPO. Editor makes changes to the GPO, and then checks the modified GPO into the archive. |
+[Edit a GPO Offline](edit-a-gpo-offline-agpm30ops.md) |
+
Editor requests deployment of the GPO to the production environment. |
+[Request Deployment of a GPO](request-deployment-of-a-gpo-agpm30ops.md) |
+
Reviewers, such as Approvers or Editors, analyze the GPO. |
+[Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) |
+
Approver approves and deploys the GPO to the production environment or rejects the GPO. |
+[Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm30ops.md) |
+
Task | +Reference | +
---|---|
Editor requests that a new GPO be created or an Approver creates a new GPO. |
+[Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm40.md) +[Create a New Controlled GPO](create-a-new-controlled-gpo-agpm40.md) |
+
Approver approves the creation of the GPO if it was requested by an Editor. |
+[Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm40.md) |
+
Editor checks out a copy of the GPO from the archive so that no one else can modify the GPO. Editor makes changes to the GPO, and then checks the modified GPO into the archive. |
+[Edit a GPO Offline](edit-a-gpo-offline-agpm40.md) |
+
If developing in a test forest, Editor exports the GPO to a file, transfers the file to the production forest, and imports the file. Additionally, an Editor can link the GPO to an organizational unit that contains test computers and users. |
+[Using a Test Environment](using-a-test-environment.md) |
+
Editor requests deployment of the GPO to the production environment of the domain. |
+[Request Deployment of a GPO](request-deployment-of-a-gpo-agpm40.md) |
+
Reviewers, such as Approvers or Editors, analyze the GPO. |
+[Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) |
+
Approver approves and deploys the GPO to the production environment of the domain or rejects the GPO. |
+[Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm40.md) |
+
Task | +Reference | +
---|---|
Editor requests the creation of a new GPO or an Approver creates a new GPO. |
+[Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo.md) +[Create a New Controlled GPO](create-a-new-controlled-gpo.md) |
+
Approver approves the creation of the GPO if it was requested by an Editor. |
+[Approve or Reject a Pending Action](approve-or-reject-a-pending-action.md) |
+
Editor checks out a copy of the GPO from the archive, so no one else can modify the GPO. Editor makes changes to the GPO, and then checks the modified GPO into the archive. |
+[Edit a GPO Offline](edit-a-gpo-offline.md) |
+
Editor requests deployment of the GPO to the production environment. |
+[Request Deployment of a GPO](request-deployment-of-a-gpo.md) |
+
Reviewers, such as Approvers or Editors, analyze the GPO. |
+[Performing Reviewer Tasks](performing-reviewer-tasks.md) |
+
Approver approves and deploys the GPO to the production environment or rejects the GPO. |
+[Approve or Reject a Pending Action](approve-or-reject-a-pending-action.md) |
+
Supported configurations for the AGPM Server | +Supported configurations for the AGPM Client | +AGPM Support | +
---|---|---|
Windows 10 |
+Windows 10 |
+Supported |
+
Windows Server 2012 R2 or Windows 8.1 |
+Windows Server 2012 R2 or Windows 8.1 |
+Supported |
+
Windows Server 2012 R2, Windows Server 2012, Windows 8.1, or Windows 8 |
+Windows Server 2012 or Windows 8 |
+Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1 |
+
Windows Server 2008 R2 or Windows 7 |
+Windows Server 2008 R2 or Windows 7 |
+Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1 or Windows 8 |
+
Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7 |
+Windows Server 2008 or Windows Vista with Service Pack 1 (SP1) |
+Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7 |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7 |
+Not supported |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2008 or Windows Vista with SP1 |
+Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7 |
+
Supported configurations for the AGPM Server | +Supported configurations for the AGPM Client | +AGPM Support | +
---|---|---|
Windows Server 2012 R2 or Windows 8.1 |
+Windows Server 2012 R2 or Windows 8.1 |
+Supported |
+
Windows Server 2012 R2, Windows Server 2012, Windows 8.1, or Windows 8 |
+Windows Server 2012 or Windows 8 |
+Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1 |
+
Windows Server 2008 R2 or Windows 7 |
+Windows Server 2008 R2 or Windows 7 |
+Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1 or Windows 8 |
+
Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7 |
+Windows Server 2008 or Windows Vista with Service Pack 1 (SP1) |
+Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7 |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7 |
+Not supported |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2008 or Windows Vista with SP1 |
+Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7 |
+
Supported configurations for the AGPM Server | +Supported configurations for the AGPM Client | +AGPM Support | +
---|---|---|
Windows Server 2012 or Windows 8 |
+Windows Server 2012 or Windows 8 |
+Supported |
+
Windows Server 2008 R2 or Windows 7 |
+Windows Server 2008 R2 or Windows 7 |
+Supported, but cannot edit policy settings or preference items that exist only in Windows 8 |
+
Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7 |
+Windows Server 2008 or Windows Vista with SP1 |
+Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2, Windows 8, or Windows 7 |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7 |
+Supported |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2008 or Windows Vista with SP1 |
+Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2, Windows 8, or Windows 7 |
+
Supported operating systems for the AGPM Server | +Supported operating systems for the AGPM Client | +AGPM Support | +
---|---|---|
Windows Server 2008 R2 or Windows 7 |
+Windows Server 2008 R2 or Windows 7 |
+Supported |
+
Windows Server 2008 R2 or Windows 7 |
+Windows Server 2008 or Windows Vista with SP1 |
+Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7 |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2008 R2 or Windows 7 |
+Not supported |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2008 or Windows Vista with SP1 |
+Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7 |
+
Operating system | +Version of AGPM that can be installed | +
---|---|
Windows Server 2008 |
+3.0 |
+
Windows Vista with SP1 |
+3.0 |
+
Windows Vista with no service pack installed (32-bit) |
+2.5 |
+
Windows Server 2003 (32-bit) |
+2.5 |
+
GPO Characteristic | +Description | +
---|---|
Name |
+Name of the Group Policy object. |
+
Computer (Comp.) |
+Automatically generated version of the Computer Configuration portion of the GPO. |
+
User |
+Automatically generated version of the User Configuration portion of the GPO. |
+
State |
+The state of the selected GPO: +
|
+
GPO Status |
+The Computer Configuration and the User Configuration can be managed separately. The GPO Status indicates which portions of the GPO are enabled. |
+
WMI Filter |
+Display any WMI filters that are applied to this GPO. WMI filters are managed under the WMI Filters node for the domain in the console tree of the GPMC. |
+
Modified |
+For a controlled GPO, the most recent date when it was checked in after being modified or checked out to be modified. For an uncontrolled GPO, the date when it was last modified. |
+
Owner |
+The Editor who checked in or the Approver who deployed the selected GPO. |
+
Button | +Effect | +
---|---|
Add |
+Add a new entry to the security descriptor. Any user or group in Active Directory can be added. |
+
Remove |
+Remove the selected entry from the Access Control List. |
+
Properties |
+Display the properties for the selected object. The properties page is the same one displayed for an object in Active Directory Users and Computers. |
+
Advanced |
+Open the Access Control List Editor. |
+
GPO attribute | +Description | +
---|---|
Name |
+Name of the GPO. |
+
State |
+The state of the selected GPO |
+
Changed By |
+The Editor who checked in or the Approver who deployed the selected GPO. |
+
Change Date |
+For a controlled GPO, the most recent date it was checked in after being modified or checked out to be modified. For an uncontrolled GPO, the date when it was last modified. |
+
Comment |
+A comment entered by the person who checked in or deployed a GPO at the time that it was modified. Useful for identifying the specifics of the version in case of the need to roll back to a previous version. |
+
Computer Version |
+Automatically generated version of the Computer Configuration portion of the GPO. |
+
User Version |
+Automatically generated version of the User Configuration portion of the GPO. |
+
GPO Status |
+The Computer Configuration and the User Configuration can be managed separately. The GPO Status indicates which portions of the GPO are enabled. |
+
WMI Filter |
+Display any WMI filters that are applied to this GPO. WMI filters are managed under the WMI Filters folder for the domain in the console tree of the GPMC. |
+
Button | +Effect | +
---|---|
Add |
+Add a new entry to the security descriptor. Any user or group in Active Directory can be added. |
+
Remove |
+Remove the selected entry from the Access Control List. |
+
Properties |
+Display the properties for the selected object. The properties page is the same one displayed for an object in Active Directory Users and Computers. |
+
Advanced |
+Open the Access Control List Editor. |
+
GPO attribute | +Description | +
---|---|
Name |
+Name of the GPO. |
+
State |
+The state of the selected GPO |
+
Changed By |
+The Editor who checked in or the Approver who deployed the selected GPO. |
+
Change Date |
+For a controlled GPO, the most recent date it was checked in after being modified or checked out to be modified. For an uncontrolled GPO, the date when it was last modified. |
+
Comment |
+A comment entered by the person who checked in or deployed a GPO at the time that it was modified. Useful for identifying the specifics of the version in case of the need to roll back to an earlier version. |
+
Computer Version |
+Automatically generated version of the Computer Configuration part of the GPO. |
+
User Version |
+Automatically generated version of the User Configuration part of the GPO. |
+
GPO Status |
+The Computer Configuration and the User Configuration can be managed separately. The GPO Status indicates which portions of the GPO are enabled. |
+
WMI Filter |
+Display any WMI filters that are applied to this GPO. WMI filters are managed under the WMI Filters folder for the domain in the console tree of the GPMC. |
+
Button | +Effect | +
---|---|
Add |
+Add a new entry to the security descriptor. Any user or group in Active Directory can be added. |
+
Remove |
+Remove the selected entry from the Access Control List. |
+
Properties |
+Display the properties for the selected object. The properties page is the same one displayed for an object in Active Directory Users and Computers. |
+
Advanced |
+Open the Access Control List Editor. |
+
Command | +Effect | +
---|---|
New Controlled GPO |
+Create a new GPO with change control managed through AGPM and deploy it to the production environment. If you do not have permission to create a GPO, you will be prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.) |
+
History |
+Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO. |
+
Command | +Effect | +
---|---|
Settings |
+Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPO(s) from organizational units as of when the GPO(s) was most recently controlled, imported, or checked in. |
+
Differences |
+Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template. |
+
Command | +Effect | +
---|---|
Edit |
+Open the Group Policy Management Editor window to make changes to the selected GPO. |
+
Check Out |
+Obtain a copy of the selected GPO from the archive for offline editing and prohibit anyone else from editing it until it is checked back into the archive. (Check Out can be overridden by an AGPM Administrator (Full Control).) |
+
Check In |
+Check the edited version of the selected GPO into the archive, so other authorized Editors can make changes or an Approver can deploy it to the production environment. |
+
Undo Check Out |
+Return a checked out GPO to the archive without any changes. |
+
Command | +Effect | +
---|---|
Import from Production |
+For the selected GPO, copy the version in the production environment to the archive. |
+
Delete |
+Move the selected GPO to the Recycle Bin and indicate whether to leave the deployed version (if one exists) in production or to delete it as well as the version in the archive. If you do not have permission to delete a GPO, you will be prompted to submit a request. |
+
Deploy |
+Move the selected GPO that is checked into the archive to the production environment. This action makes it active on the network and overwrites the previously active version of the GPO if one existed. If you do not have permission to deploy a GPO, you will be prompted to submit a request. |
+
Label |
+Mark the selected GPO with a descriptive label (such as "Known good") and comment for record keeping. Labels appear in the State column and comments in the Comment column of the History window, enabling you to easily identify previous versions of a GPO identified with a particular label, so you can roll back if a problem occurs. |
+
Rename |
+Change the name of the selected GPO. If the GPO has already been deployed, the name will be updated in the production environment when the GPO is redeployed. |
+
Save as Template |
+Create a new template based on the settings of the selected GPO. |
+
Command | +Effect | +
---|---|
Refresh |
+Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed. |
+
Help |
+Display help for AGPM. |
+
Command | +Effect | +
---|---|
New Controlled GPO |
+Create a new GPO with change control managed through AGPM and deploy it to the production environment of the domain. If you do not have permission to create a GPO, you are prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.) |
+
History |
+Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to an earlier version of a GPO. |
+
Command | +Effect | +
---|---|
Settings |
+Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPO(s) from organizational units as of when the GPO(s) was most recently controlled, imported, or checked in. |
+
Differences |
+Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template. |
+
Command | +Effect | +
---|---|
Edit |
+Open the Group Policy Management Editor window to change the selected GPO. |
+
Check Out |
+Obtain a copy of the selected GPO from the archive for offline editing and prohibit anyone else from editing the GPO until it is checked back into the archive. Check Out can be overridden by an AGPM Administrator (Full Control). |
+
Check In |
+Check the edited version of the selected GPO into the archive, so other authorized Editors can make changes or an Approver can deploy the GPO to the production environment of the domain. |
+
Undo Check Out |
+Return a checked out GPO to the archive without any changes. |
+
Command | +Effect | +
---|---|
Import from Production |
+For the selected GPO, copy the version in the production environment of the domain to the archive. |
+
Import from File |
+Replace the policy settings of the selected, checked-out GPO with those from a GPO backup file. |
+
Delete |
+Move the selected GPO to the Recycle Bin and indicate whether to leave the deployed version (if one exists) in production or to delete the deployed version in addition to the version in the archive. If you do not have permission to delete a GPO, you are prompted to submit a request. |
+
Deploy |
+Move the selected GPO that is checked into the archive to the production environment of the domain. This action makes it active on the network and overwrites the previously active version of the GPO if one existed. If you do not have permission to deploy a GPO, you will be prompted to submit a request. |
+
Export to |
+Save the selected GPO to a backup file so that you can copy it to another domain. |
+
Label |
+Mark the selected GPO with a descriptive label (such as "Known good") and comment for record keeping. Labels appear in the State column and comments in the Comment column of the History window. They help you identify earlier versions of a GPO so that you can roll back if a problem occurs. |
+
Rename |
+Change the name of the selected GPO. If the GPO has already been deployed, the name will be updated in the production environment of the domain when the GPO is redeployed. |
+
Save as Template |
+Create a new template based on the settings of the selected GPO. |
+
Command | +Effect | +
---|---|
Refresh |
+Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed. |
+
Help |
+Display help for AGPM. |
+
Command | +Effect | +
---|---|
New Controlled GPO |
+Create a new GPO with change control managed through AGPM and deploy it to the production environment. If you do not have permission to create a GPO, you will be prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.) |
+
History |
+Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO. |
+
Command | +Effect | +
---|---|
Settings |
+Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPO(s) from organizational units as of when the GPO(s) was most recently controlled, imported, or checked in. |
+
Differences |
+Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template. |
+
Command | +Effect | +
---|---|
Edit |
+Open the Group Policy Object Editor to make changes to the selected GPO. |
+
Check Out |
+Obtain a copy of the selected GPO from the archive for offline editing and prohibit anyone else from editing it until it is checked back into the archive. (Check Out can be overridden by an AGPM Administrator (Full Control).) |
+
Check In |
+Check the edited version of the selected GPO into the archive, so other authorized Editors can make changes or an Approver can deploy it to the production environment. |
+
Undo Check Out |
+Return a checked out GPO to the archive without any changes. |
+
Command | +Effect | +
---|---|
Import from Production |
+For the selected GPO, copy the version in the production environment to the archive. |
+
Delete |
+Move the selected GPO to the Recycle Bin and indicate whether to leave the deployed version (if one exists) in production or to delete it as well as the version in the archive. If you do not have permission to delete a GPO, you will be prompted to submit a request. |
+
Deploy |
+Move the selected GPO that is checked into the archive to the production environment. This action makes it active on the network and overwrites the previously active version of the GPO if one existed. If you do not have permission to deploy a GPO, you will be prompted to submit a request. |
+
Label |
+Mark the selected GPO with a descriptive label (such as "Known good") and comment for record keeping. Labels appear in the State column and comments in the Comment column of the History window, enabling you to easily identify previous versions of a GPO identified with a particular label, so you can roll back if a problem occurs. |
+
Rename |
+Change the name of the selected GPO. If the GPO has already been deployed, the name will be updated in the production environment when the GPO is redeployed. |
+
Save as Template |
+Create a new template based on the settings of the selected GPO. |
+
Command | +Effect | +
---|---|
Refresh |
+Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed. |
+
Help |
+Display help for AGPM. |
+
Account | +Default Permissions for GPOs | +
---|---|
<AGPM Service Account> |
+ Edit Settings, Delete, Modify Security |
+
Authenticated Users |
+ Read, Apply |
+
Domain Admins |
+ Edit Settings, Delete, Modify Security |
+
Enterprise Admins |
+ Edit Settings, Delete, Modify Security |
+
Enterprise Domain Controllers |
+ Read |
+
System |
+ Edit Settings, Delete, Modify Security |
+
Account | +Default Permissions for GPOs | +
---|---|
<AGPM Service Account> |
+ Edit Settings, Delete, Modify Security |
+
Authenticated Users |
+ Read, Apply |
+
Domain Admins |
+ Edit Settings, Delete, Modify Security |
+
Enterprise Admins |
+ Edit Settings, Delete, Modify Security |
+
Enterprise Domain Controllers |
+ Read |
+
System |
+ Edit Settings, Delete, Modify Security |
+
Setting | +Description | +
---|---|
From e-mail address |
+The AGPM alias from which notification is sent to Approvers. In an environment with multiple domains, this can be the same alias throughout the environment or a different alias for each domain. |
+
To e-mail address |
+A comma-delimited list of e-mail addresses of Approvers to whom notification is to be sent |
+
SMTP server |
+The name of the e-mail server, such as mail.contoso.com |
+
User name |
+A user with access to the SMTP server |
+
Password |
+User's password for authentication to the SMTP server |
+
Confirm password |
+Confirm user's password |
+
Button | +Effect | +
---|---|
Add |
+Add a new entry to the security descriptor. Any users or groups in Active Directory can be added as Group Policy administrators. |
+
Remove |
+Remove the selected Group Policy administrators from the Access Control List. |
+
Properties |
+Display the properties for the selected Group Policy administrators. |
+
Advanced |
+Open the Access Control List Editor. |
+
Setting | +Description | +
---|---|
From e-mail address |
+The AGPM alias from which notification is sent to Approvers. In an environment with multiple domains, this can be the same alias throughout the environment or a different alias for each domain. |
+
To e-mail address |
+A comma-delimited list of e-mail addresses of Approvers to whom notification is to be sent |
+
SMTP server |
+The name of the e-mail server, such as mail.contoso.com |
+
User name |
+A user with access to the SMTP server |
+
Password |
+User's password for authentication to the SMTP server |
+
Confirm password |
+Confirm user's password |
+
Button | +Effect | +
---|---|
Add |
+Add a new entry to the security descriptor. Any users or groups in Active Directory can be added as Group Policy administrators. |
+
Remove |
+Remove the selected Group Policy administrators from the Access Control List. |
+
Properties |
+Display the properties for the selected Group Policy administrators. |
+
Advanced |
+Open the Access Control List Editor. |
+
Setting | +Description | +
---|---|
From |
+The AGPM alias from which notification is sent to Approvers. In an environment with multiple domains, this can be the same alias throughout the environment or a different alias for each domain. |
+
To |
+A comma-delimited list of e-mail addresses of Approvers to whom notification is to be sent |
+
SMTP server |
+The name of the e-mail server, such as mail.contoso.com |
+
User name |
+A user with access to the SMTP server |
+
Password |
+User's password for authentication to the SMTP server |
+
Confirm password |
+Confirm user's password |
+
Button | +Effect | +
---|---|
Add |
+Add a new entry to the security descriptor. Any users or groups in Active Directory can be added as Group Policy administrators. |
+
Remove |
+Remove the selected Group Policy administrators from the Access Control List. |
+
Properties |
+Display the properties for the selected Group Policy administrators. The properties page is the same one displayed for an object in Active Directory User and Computers. |
+
Advanced |
+Open the Access Control List Editor. |
+
Setting | +Effect | +
---|---|
AGPM: Show Change Control tab |
+This policy setting allows you to control the visibility of the Change Control folder in the Group Policy Management Console (GPMC). |
+
AGPM: Show History tab for linked GPOs |
+This policy setting allows you to control the visibility of the History tab provided by AGPM when you view a linked GPO in the GPMC. |
+
AGPM: Show History tab for GPOs |
+This policy setting allows you to control the visibility of the History tab provided by AGPM when you view a GPO in the GPMC. |
+
Setting | +Effect | +
---|---|
AGPM: Show Change Control tab |
+This policy setting allows you to control the visibility of the Change Control folder in the Group Policy Management Console (GPMC). |
+
AGPM: Show History tab for linked GPOs |
+This policy setting allows you to control the visibility of the History tab provided by AGPM when you view a linked GPO in the GPMC. |
+
AGPM: Show History tab for GPOs |
+This policy setting allows you to control the visibility of the History tab provided by AGPM when you view a GPO in the GPMC. |
+
Setting | +Effect | +
---|---|
AGPM Change Control |
+If enabled or not configured, the Change Control node is visible in the GPMC. +If disabled, the Change Control node is not visible in the GPMC. |
+
AGPM Link Extension |
+If enabled or not configured, a History tab appears in the GPMC for each linked GPO. +If disabled, the History tab is not visible for linked GPOs. |
+
AGPM GPO Extension |
+If enabled or not configured, a History tab appears in the GPMC for each GPO. +If disabled, the History tab is not visible for GPOs. |
+
Tabs | +Filtering | +
---|---|
All States |
+Display all states in the history of the GPO. |
+
Unique Versions |
+Display only unique versions of the GPO checked into the archive. The version deployed to the production environment, shortcuts to unique versions, and informational states are omitted from this list. |
+
GPO attribute | +Description | +
---|---|
Change Date |
+Time stamp of when the action in the State column was performed. |
+
State |
+A state in the history of the GPO. |
+
Changed By |
+The person who checked in or deployed the GPO. |
+
Comment |
+A comment entered by the person who checked in or deployed a GPO at the time that this version was modified. Useful for identifying the specifics of the version in case of the need to roll back to a previous version. |
+
Deletable |
+Whether this version of the GPO can be deleted if the number of unique versions of each GPO retained in the archive is limited. +
+Note
+
+You can modify whether a version of a GPO is deletable by right-clicking it and then clicking Do Not Allow Deletion or Allow Deletion. +
+
+ |
+
Computer Version |
+Automatically generated version of the Computer Configuration portion of the GPO. |
+
User Version |
+Automatically generated version of the User Configuration portion of the GPO. |
+
GPO Status |
+The Computer Configuration and the User Configuration can be managed separately from each other. This status shows which portions of the GPO are enabled. |
+
WMI Filter |
+Display any WMI filters that are applied to this GPO. WMI filters are managed under the WMI Filters folder for the domain in the console tree of the GPMC. |
+
Button | +Effect | +
---|---|
Settings |
+Generate an HTML-based report displaying the settings within the selected version of the GPO. |
+
Differences |
+Generate an HTML-based report comparing the settings within multiple selected versions of the GPO. |
+
Symbol | +Meaning | +Color | +
---|---|---|
None |
+Item exists with identical settings in both GPOs |
+Varies with level |
+
[#] |
+Item exists in both GPOs, but with changed settings |
+Blue |
+
[-] |
+Item exists only in the first GPO |
+Red |
+
[+] |
+Item exists only in the second GPO |
+Green |
+
Tabs | +Filtering | +
---|---|
All States |
+Display all states in the history of the GPO. |
+
Unique Versions |
+Display only unique versions of the GPO checked into the archive. The version deployed to the production environment, shortcuts to unique versions, and informational states are omitted from this list. |
+
GPO attribute | +Description | +
---|---|
Change Date |
+Time stamp of when the action in the State column was performed. |
+
State |
+A state in the history of the GPO. |
+
Changed By |
+The person who checked in or deployed the GPO. |
+
Comment |
+A comment entered by the person who checked in or deployed a GPO at the time that this version was changed, useful for identifying the specifics of the version in case of the need to roll back to an earlier version. |
+
Deletable |
+Whether this version of the GPO can be deleted if the number of unique versions of each GPO retained in the archive is limited. +
+Note
+
+You can change whether a version of a GPO can be deleted by right-clicking the GPO and then clicking Do Not Allow Deletion or Allow Deletion. +
+
+ |
+
Computer Version |
+Automatically generated version of the Computer Configuration part of the GPO. |
+
User Version |
+Automatically generated version of the User Configuration part of the GPO. |
+
GPO Status |
+The Computer Configuration and the User Configuration can be managed separately from each other. This status shows which portions of the GPO are enabled. |
+
Source GPO Information |
+For a GPO that has been imported from another forest, the original GPO name, domain, and user and date associated with the last change. |
+
Button | +Effect | +
---|---|
Settings |
+Generate an HTML-based report displaying the settings within the selected version of the GPO. |
+
Differences |
+Generate an HTML-based report comparing the settings within multiple selected versions of the GPO. |
+
Symbol | +Meaning | +Color | +
---|---|---|
None |
+Item exists with identical settings in both GPOs |
+Varies with level |
+
[#] |
+Item exists in both GPOs, but with changed settings |
+Blue |
+
[-] |
+Item exists only in the first GPO |
+Red |
+
[+] |
+Item exists only in the second GPO |
+Green |
+
Tabs | +Filtering | +
---|---|
Show All |
+Display all versions of the GPO. |
+
Checked In |
+Display only checked-in versions of the GPO. The deployed version is omitted from this list. |
+
Labels Only |
+Display only GPOs that have labels associated with them. |
+
GPO Characteristic | +Description | +
---|---|
Computer |
+Automatically generated version of the Computer Configuration portion of the GPO. |
+
User |
+Automatically generated version of the User Configuration portion of the GPO. |
+
Time |
+Timestamp of the version of the GPO when the action in the status field was performed. |
+
State |
+The state of the selected version of the GPO: +
|
+
GPO Status |
+The Computer Configuration and the User Configuration can be managed separately from each other. This status shows which portions of the GPO are enabled. |
+
Owner |
+The person who checked in or deployed the GPO. |
+
Comment |
+A comment entered by the owner of a GPO at the time that this version was modified. Useful for identifying the specifics of the version in case of the need to roll back to a previous version. |
+
Button | +Effect | +
---|---|
Settings |
+Generate an HTML-based report displaying the settings within the selected version of the GPO. |
+
Differences |
+Generate an HTML-based report comparing the settings within multiple selected versions of the GPO. |
+
Symbol | +Meaning | +Color | +
---|---|---|
None |
+Item exists with identical settings in both GPOs |
+Varies with level |
+
[#] |
+Item exists in both GPOs, but with changed settings |
+Blue |
+
[-] |
+Item exists only in the first GPO |
+Red |
+
[+] |
+Item exists only in the second GPO |
+Green |
+
Symbol | +Meaning | +Color | +
---|---|---|
None |
+Item exists with identical settings in both GPOs |
+Varies with level |
+
[#] |
+Item exists in both GPOs, but with changed settings |
+Blue |
+
[-] |
+Item exists only in the first GPO |
+Red |
+
[+] |
+Item exists only in the second GPO |
+Green |
+
Symbol | +Meaning | +Color | +
---|---|---|
None |
+Item exists with identical settings in both GPOs |
+Varies with level |
+
[#] |
+Item exists in both GPOs, but with changed settings |
+Blue |
+
[-] |
+Item exists only in the first GPO |
+Red |
+
[+] |
+Item exists only in the second GPO |
+Green |
+
Symbol | +Meaning | +Color | +
---|---|---|
None |
+Item exists with identical settings in both GPOs |
+Varies with level |
+
[#] |
+Item exists in both GPOs, but with changed settings |
+Blue |
+
[-] |
+Item exists only in the first GPO |
+Red |
+
[+] |
+Item exists only in the second GPO |
+Green |
+
MDOP Videos |
+For a list of available MDOP videos, go to [Microsoft Desktop Optimization Pack Technologies Videos](http://go.microsoft.com/fwlink/?LinkId=234275) (http://go.microsoft.com/fwlink/?LinkId=234275). |
+
MDOP Virtual Labs |
+For a list of available MDOP virtual labs, go to [Microsoft Desktop Optimization Pack (MDOP) Virtual Labs](http://go.microsoft.com/fwlink/?LinkId=234276) (http://go.microsoft.com/fwlink/?LinkId=234276). |
+
MDOP TechCenter |
+For technical whitepapers, evaluation materials, blogs, and additional MDOP resources, go to [MDOP TechCenter](http://go.microsoft.com/fwlink/?LinkId=225286) (http://go.microsoft.com/fwlink/?LinkId=225286) + |
+
Setting | +Effect | +
---|---|
AGPM: Configure logging |
+This policy setting allows you to turn on and configure logging for AGPM. This setting affects both client and server components of AGPM. |
+
Setting | +Effect | +
---|---|
AGPM: Configure logging |
+This policy setting allows you to turn on and configure logging for AGPM. This setting affects both client and server components of AGPM. |
+
Setting | +Effect | +
---|---|
AGPM Logging |
+If enabled, this setting configures whether tracing is turned on and the level of detail. This setting affects both client and server components of AGPM. +If disabled or not configured, this setting has no effect. |
+
Command | +Effect | +
---|---|
History |
+Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO. |
+
Withdraw |
+Withdraw your pending request to create, control, or delete the selected GPO before the request has been approved. |
+
Approve |
+Complete a pending request from an Editor to create, control, or delete the selected GPO. |
+
Reject |
+Deny a pending request from an Editor to create, control, or delete the selected GPO. |
+
Command | +Effect | +
---|---|
Settings |
+Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs are most recently controlled, imported, or checked in. |
+
Differences |
+Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template. |
+
Command | +Effect | +
---|---|
Refresh |
+Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed. |
+
Help |
+Display help for AGPM. |
+
Command | +Effect | +
---|---|
History |
+Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to an earlier version of a GPO. |
+
Withdraw |
+Withdraw your pending request to create, control, or delete the selected GPO before the request has been approved. |
+
Approve |
+Complete a pending request from an Editor to create, control, or delete the selected GPO. |
+
Reject |
+Deny a pending request from an Editor to create, control, or delete the selected GPO. |
+
Command | +Effect | +
---|---|
Settings |
+Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs are most recently controlled, imported, or checked in. |
+
Differences |
+Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template. |
+
Command | +Effect | +
---|---|
Refresh |
+Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed. |
+
Help |
+Display help for AGPM. |
+
Command | +Effect | +
---|---|
History |
+Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO. |
+
Withdraw |
+Withdraw your pending request to create, control, or delete the selected GPO before the request has been approved. |
+
Approve |
+Complete a pending request from an Editor to create, control, or delete the selected GPO. |
+
Reject |
+Deny a pending request from an Editor to create, control, or delete the selected GPO. |
+
Command | +Effect | +
---|---|
Settings |
+Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs are most recently controlled, imported, or checked in. |
+
Differences |
+Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template. |
+
Command | +Effect | +
---|---|
Refresh |
+Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed. |
+
Help |
+Display help for AGPM. |
+
Button | +Effect | +
---|---|
Add |
+Add a new entry to the security descriptor. |
+
Remove |
+Remove the selected users or groups from the Access Control List. |
+
Properties |
+Display the properties for the selected user or group. The properties page is the same one displayed for an object in Active Directory User and Computers. |
+
Button | +Effect | +
---|---|
Add |
+Add a new entry to the security descriptor. |
+
Remove |
+Remove the selected users or groups from the Access Control List. |
+
Properties |
+Display the properties for the selected user or group. The properties page is the same one displayed for an object in Active Directory User and Computers. |
+
Command | +Effect | +
---|---|
Settings |
+Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs were most recently controlled, imported, or checked in. |
+
Differences |
+Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template. |
+
Command | +Effect | +
---|---|
Destroy |
+Remove the selected GPO from the Recycle Bin, so it can no longer be restored. |
+
Restore |
+Move the selected GPO from the Recycle Bin to the Controlled tab. This does not restore the GPO to the production environment. |
+
Command | +Effect | +
---|---|
Refresh |
+Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed. |
+
Help |
+Display help for Advanced Group Policy Management (AGPM). |
+
Command | +Effect | +
---|---|
Settings |
+Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs were most recently controlled, imported, or checked in. |
+
Differences |
+Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template. |
+
Command | +Effect | +
---|---|
Destroy |
+Remove the selected GPO from the Recycle Bin, so it can no longer be restored. |
+
Restore |
+Move the selected GPO from the Recycle Bin to the Controlled tab. This does not restore the GPO to the production environment. |
+
Command | +Effect | +
---|---|
Refresh |
+Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed. |
+
Help |
+Display help for Advanced Group Policy Management (AGPM). |
+
Command | +Effect | +
---|---|
Settings |
+Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs were most recently controlled, imported, or checked in. |
+
Differences |
+Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template. |
+
Command | +Effect | +
---|---|
Destroy |
+Remove the selected GPO from the Recycle Bin, so it can no longer be restored. |
+
Restore |
+Move the selected GPO from the Recycle Bin to the Controlled tab. This does not restore the GPO to the production environment. |
+
Command | +Effect | +
---|---|
Refresh |
+Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed. |
+
Help |
+Display help for AGPM. |
+
Description of search result | +Search query | +
---|---|
All GPOs with names that include the text security and North America. |
+name: security name: "North America" |
+
All checked out GPOs. |
+state: "checked out" |
+
All GPOs most recently changed by the user named Administrator and most recently changed within the previous month. |
+changed by: Administrator change date: lastmonth |
+
All GPOs in which the word firewall is included in the most recent comment and in which the word security appears in any column. |
+comment: firewall security |
+
All GPOs that have a status of All Settings Disabled. |
+gpo status: all |
+
All GPOs that have a WMI filter named My WMI Filter applied and that have a status of User Configuration Settings Disabled. |
+wmi filter: "My WMI Filter" gpo status: user |
+
Operating system on which AGPM Server 4.0 runs | +Operating system on which AGPM Client 4.0 runs | +Status of AGPM 4.0 support | +
---|---|---|
Windows Server 2008 R2 or Windows 7 |
+Windows Server 2008 R2 or Windows 7 |
+Supported |
+
Windows Server 2008 R2 or Windows 7 |
+Windows Server 2008 or Windows Vista with SP1 |
+Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7 |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2008 R2 or Windows 7 |
+Unsupported |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2008 or Windows Vista with SP1 |
+Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7 |
+
Item | +Description | +
---|---|
AGPM Service |
+The AGPM Service runs on the AGPM Server. The service manages the archive, which contains offline GPOs, and controlled GPOs in the production environment. The default configuration of the AGPM Service is as follows: +
|
+
AGPM archive |
+By default, AGPM creates the archive in %ProgramData%\Microsoft\AGPM on the AGPM Server. The archive provides storage for offline GPOs, and it can store multiple versions of each GPO. Changes that AGPM makes to GPOs in the archive do not affect the production environment until an AGPM Administrator or Approver deploys the GPO to the production environment and links the GPO to an organizational unit (OU). |
+
Windows Firewall |
+During installation, AGPM enables an inbound Windows Firewall rule that allows the AGPM Client to communicate with the AGPM Server. The default Windows Firewall rule is the following: +
|
+
E-mail server |
+AGPM uses Simple Mail Transfer Protocol (SMTP) to send e-mail requests to the addresses configured on the Domain Delegation tab. For example, when an Editor requests that a new GPO be created, AGPM notifies each e-mail address specified on the Domain Delegation tab. |
+
AGPM snap-in |
+The AGPM snap-in for the GPMC runs on AGPM Clients and is used by Group Policy administrators to manage GPOs. The snap-in appears in the GPMC as a Change Control folder in each domain. |
+
Permission | +Description | +AGPM Administrator | +Approver | +Editor | +Reviewer | +
---|---|---|---|---|---|
Full Control |
+Have all permissions. |
+Yes |
++ | + | + |
Create GPO |
+Create GPOs in a domain. |
+Yes |
+Yes |
++ | + |
List Contents |
+List the GPOs in a domain. |
+Yes |
+Yes |
+Yes |
+Yes |
+
Read Settings |
+Read the policy settings within a GPO. |
+Yes |
+Yes |
+Yes |
+Yes |
+
Edit Settings |
+Change the policy settings in a GPO. |
+Yes |
++ | Yes |
++ |
Delete GPO |
+Delete a GPO. |
+Yes |
+Yes |
++ | + |
Modify Security |
+Delegate domain-level access, delegate access to a single GPO, and delegate access to the production environment. |
+Yes |
++ | + | + |
Deploy GPO |
+Deploy a GPO from the archive to the production environment. |
+Yes |
+Yes |
++ | + |
Create Template |
+Create a GPO template in AGPM. |
+Yes |
++ | Yes |
++ |
Modify Options |
+Configure AGPM e-mail notification and limit the GPO versions stored in the archive. |
+Yes |
++ | + | + |
Export GPO |
+Export a GPO to a file. |
+Yes |
++ | Yes |
++ |
Import GPO |
+Import a GPO from a file. |
+Yes |
++ | Yes |
++ |
Command | +Effect | +
---|---|
New Controlled GPO |
+Create a new GPO based on the selected template. The option to deploy the new GPO to the production environment is provided. If you do not have permission to create a GPO, you will be prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.) |
+
Command | +Effect | +
---|---|
Settings |
+Generate an HTML-based or XML-based report displaying the settings within the selected GPO. |
+
Differences |
+Generate an HTML-based or XML-based report comparing the settings within two selected GPO templates. |
+
Command | +Effect | +
---|---|
Set as Default |
+Set the selected template as the default to be used automatically when creating a new GPO. |
+
Delete |
+Move the selected template to the Recycle Bin. If you do not have permission to delete a GPO, you will be prompted to submit a request. |
+
Rename |
+Change the name of the selected template. |
+
Command | +Effect | +
---|---|
Refresh |
+Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed. |
+
Help |
+Display help for Advanced Group Policy Management (AGPM). |
+
Command | +Effect | +
---|---|
New Controlled GPO |
+Create a new GPO based on the selected template. The option to deploy the new GPO to the production environment of the domain is provided. If you do not have permission to create a GPO, you will be prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.) |
+
Command | +Effect | +
---|---|
Settings |
+Generate an HTML-based or XML-based report displaying the settings within the selected GPO. |
+
Differences |
+Generate an HTML-based or XML-based report comparing the settings within two selected GPO templates. |
+
Command | +Effect | +
---|---|
Set as Default |
+Set the selected template as the default to be used automatically when creating a new GPO. |
+
Delete |
+Move the selected template to the Recycle Bin. If you do not have permission to delete a GPO, you will be prompted to submit a request. |
+
Rename |
+Change the name of the selected template. |
+
Command | +Effect | +
---|---|
Refresh |
+Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed. |
+
Help |
+Display help for Advanced Group Policy Management (AGPM). |
+
Command | +Effect | +
---|---|
New Controlled GPO |
+Create a new GPO based on the selected template. The option to deploy the new GPO to the production environment is provided. If you do not have permission to create a GPO, you will be prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.) |
+
Command | +Effect | +
---|---|
Settings |
+Generate an HTML-based or XML-based report displaying the settings within the selected GPO. |
+
Differences |
+Generate an HTML-based or XML-based report comparing the settings within two selected GPO templates. |
+
Command | +Effect | +
---|---|
Set as Default |
+Set the selected template as the default to be used automatically when creating a new GPO. |
+
Delete |
+Move the selected template to the Recycle Bin. If you do not have permission to delete a GPO, you will be prompted to submit a request. |
+
Rename |
+Change the name of the selected template. |
+
Command | +Effect | +
---|---|
Refresh |
+Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed. |
+
Help |
+Display help for Advanced Group Policy Management (AGPM). |
+
Command | +Effect | +
---|---|
History |
+Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO. |
+
Control |
+Bring the selected uncontrolled GPO under the change control management of AGPM. If you do not have permission to control a GPO, you will be prompted to submit a request. |
+
Save as Template |
+Create a new template based on the settings of the selected GPO. |
+
Command | +Effect | +
---|---|
Settings |
+Generate an HTML-based or XML-based report displaying the settings within the selected GPO. |
+
Differences |
+Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template. |
+
Command | +Effect | +
---|---|
Refresh |
+Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed. |
+
Help |
+Display help for AGPM. |
+
Command | +Effect | +
---|---|
History |
+Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to an earlier version of a GPO. |
+
Control |
+Bring the selected uncontrolled GPO under the change control management of AGPM. If you do not have permission to control a GPO, you will be prompted to submit a request. |
+
Save as Template |
+Create a new template based on the settings of the selected GPO. |
+
Command | +Effect | +
---|---|
Settings |
+Generate an HTML-based or XML-based report displaying the settings within the selected GPO. |
+
Differences |
+Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template. |
+
Command | +Effect | +
---|---|
Refresh |
+Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed. |
+
Help |
+Display help for AGPM. |
+
Command | +Effect | +
---|---|
History |
+Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO. |
+
Control |
+Bring the selected uncontrolled GPO under the change control management of AGPM. If you do not have permission to control a GPO, you will be prompted to submit a request. |
+
Save as Template |
+Create a new template based on the settings of the selected GPO. |
+
Command | +Effect | +
---|---|
Settings |
+Generate an HTML-based or XML-based report displaying the settings within the selected GPO. |
+
Differences |
+Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template. |
+
Command | +Effect | +
---|---|
Refresh |
+Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed. |
+
Help |
+Display help for AGPM. |
+
AGPM Version From Which You Can Upgrade |
+2.5 |
+3.0 |
+4.0 |
+4.0 SP1 |
+
2.5 |
+Not Applicable |
+Classic Upgrade |
+Classic Upgrade |
+Installation is blocked |
+
3.0 |
+Not Applicable |
+Not Applicable |
+Classic Upgrade |
+Installation is blocked |
+
4.0 |
+Not Applicable |
+Not Applicable |
+Not Applicable |
+Smart Upgrade |
+
Supported Configurations for AGPM 4.0 SP1 Server |
+Supported Configurations for AGPM 4.0 SP1 Client |
+AGPM 4.0 SP1 Support |
+
Windows 8 or Windows Server 2012 |
+Windows 8 or Windows Server 2012 |
+Supported |
+
Windows Server 2008 R2 or Windows 7 |
+Windows Server 2008 R2 or Windows 7 |
+Supported, but cannot edit policy settings or preference items that exist only in Windows 8 |
+
Windows Server 2008 R2 or Windows 7 or Windows 8 or Windows Server 2012 |
+Windows Server 2008 or Windows Vista with SP1 |
+Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7 or Windows 8. |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2008 R2 or Windows 7 or Windows 8 or Windows Server 2012 |
+Supported |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2008 or Windows Vista with SP1 |
+Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7 or Windows 8 |
+
AGPM version from which you can upgrade |
+2.5 |
+3.0 |
+4.0 |
+4.0 SP1 |
+4.0 SP2 |
+
2.5 |
+Not applicable |
+Classic Upgrade |
+Classic Upgrade |
+Installation is blocked |
+Installation is blocked |
+
3.0 |
+Not applicable |
+Not applicable |
+Classic Upgrade |
+Installation is blocked |
+Installation is blocked |
+
4.0 |
+Not applicable |
+Not applicable |
+Not applicable |
+Smart Upgrade |
+Smart Upgrade |
+
4.0 SP1 |
+Not applicable |
+Not applicable |
+Not applicable |
+Not applicable |
+Smart Upgrade |
+
Supported configurations for the AGPM Server | +Supported configurations for the AGPM Client | +AGPM Support | +
---|---|---|
Windows Server 2012 R2 or Windows 8.1 |
+Windows Server 2012 R2 or Windows 8.1 |
+Supported |
+
Windows Server 2012 R2, Windows Server 2012, Windows 8.1, or Windows 8 |
+Windows Server 2012 or Windows 8 |
+Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1 |
+
Windows Server 2008 R2 or Windows 7 |
+Windows Server 2008 R2 or Windows 7 |
+Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1 or Windows 8 |
+
Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7 |
+Windows Server 2008 or Windows Vista with Service Pack 1 (SP1) |
+Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7 |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7 |
+Not supported |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2008 or Windows Vista with SP1 |
+Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7 |
+
AGPM version from which you can upgrade |
+2.5 |
+3.0 |
+4.0 |
+4.0 SP1 |
+4.0 SP2 |
+4.0 SP3 |
+
2.5 |
+Not applicable |
+Classic Upgrade |
+Classic Upgrade |
+Installation is blocked |
+Installation is blocked |
+Installation is blocked |
+
3.0 |
+Not applicable |
+Not applicable |
+Classic Upgrade |
+Installation is blocked |
+Installation is blocked |
+Installation is blocked |
+
4.0 |
+Not applicable |
+Not applicable |
+Not applicable |
+Smart Upgrade |
+Smart Upgrade |
+Smart Upgrade |
+
4.0 SP1 |
+Not applicable |
+Not applicable |
+Not applicable |
+Not applicable |
+Smart Upgrade |
+Smart Upgrade |
+
4.0 SP2 |
+Not applicable |
+Not applicable |
+Not applicable |
+Not applicable |
+Not applicable |
+Smart Upgrade |
+
Supported configurations for the AGPM Server | +Supported configurations for the AGPM Client | +AGPM Support | +
---|---|---|
Windows 10 |
+Windows 10 |
+Supported |
+
Windows Server 2012 R2 or Windows 8.1 |
+Windows Server 2012 R2 or Windows 8.1 |
+Supported |
+
Windows Server 2012 R2, Windows Server 2012, Windows 8.1, or Windows 8 |
+Windows Server 2012 or Windows 8 |
+Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1 |
+
Windows Server 2008 R2 or Windows 7 |
+Windows Server 2008 R2 or Windows 7 |
+Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1 or Windows 8 |
+
Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7 |
+Windows Server 2008 or Windows Vista with Service Pack 1 (SP1) |
+Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7 |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7 |
+Not supported |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2008 or Windows Vista with SP1 |
+Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7 |
+
Operating system on which AGPM Server 4.0 runs | +Operating system on which AGPM Client 4.0 runs | +Status of AGPM 4.0 support | +
---|---|---|
Windows Server 2008 R2 or Windows 7 |
+Windows Server 2008 R2 or Windows 7 |
+Supported |
+
Windows Server 2008 R2 or Windows 7 |
+Windows Server 2008 or Windows Vista with SP1 |
+Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7 |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2008 R2 or Windows 7 |
+Unsupported |
+
Windows Server 2008 or Windows Vista with SP1 |
+Windows Server 2008 or Windows Vista with SP1 |
+Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7 |
+
Name |
+Type |
+Data |
+Description |
+
EnableVFSPassthrough |
+DWORD |
+1 |
+Set this value to 1 in order to start Adobe Reader X in Protected Mode during the launch phase. |
+
Control | +Description | +
---|---|
Protocol |
+Enables you to select the protocol that will stream the sequenced application package from a virtual application server to an Application Virtualization Desktop Client. The following protocols are available: +
|
+
Hostname |
+Enables you to select the virtual application server or the load balancer in front of a group of virtual application servers that will stream the software package to an Application Virtualization Desktop Client. You must complete this item to create a sequenced application package, but you can change from the default %SFT_SOFTGRIDSERVER% environment variable to the actual hostname or IP address of a virtual application server. +
+Note
+
+If you choose not to specify a static hostname or IP address, on each Application Virtualization Desktop Client you must set up an environment variable called SFT_SOFTGRIDSERVER. Its value must be the hostname or IP address of the virtual application server or load balancer that is this client's source of applications. You should make this environment variable a system variable rather than a user variable. Any Application Virtualization Desktop Client session that is running on this computer during your assignment of this variable must be closed and then opened so that the resumed session will be aware of its new application source. +
+
+ |
+
Port |
+Enables you to specify the port on which the virtual application server or the load balancer will listen for an Application Virtualization Desktop Client's request for the package. This information is required to create a package, but you can change it. The default port is 554. |
+
Path |
+Enables you to specify the relative path on the virtual application server where the software package is stored and from which it will be streamed. This information is required to create a package if the SFT file will be stored in a subdirectory of CONTENT; otherwise, this information is not required. |
+
Controls | +Description | +
---|---|
Available Operating Systems |
+Displays a list of operating systems that can support the applications in the package. |
+
Selected Operating Systems |
+Displays a list of selected operating systems that support the applications in the package. |
+
Control | +Description | +
---|---|
Compression Algorithm |
+Use to select the method for compressing the SFT file for streaming across a network. Select one of the following compression methods: +
|
+
Enforce Security Descriptors |
+Select to enforce security descriptors of the applications in the package after it is deployed to the client. |
+
Generate Microsoft Windows Installer (MSI) Package |
+Select to install or deploy a sequenced application package with the Windows Installer. If you have made any changes using the sequencer the changes will not be included with the Windows Installer file. The Windows Installer file will always be created using the .sft file saved on the hard disk. |
+
Parameter | +Description | +
---|---|
APP:<application> |
+The name and version (optional) of the application. |
+
/OSD <osd-pathname> |
+The path or URL for the OSD file. |
+
/ICON <icon-pathname> |
+The path or URL for the icon file. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
PACKAGE:<package-name> |
+User-visible and user-friendly name for the package. |
+
/MANIFEST <manifest-path> |
+The path of the manifest file that lists the applications included in the package and all of their publishing information. |
+
/OVERRIDEURL <URL> |
+The location of the package's SFT file. |
+
/AUTOLOADONREFRESH |
+Background loading is performed after a publishing refresh. |
+
/AUTOLOADONLOGIN |
+Background loading is performed when a user logs in. |
+
/AUTOLOADONLAUNCH |
+Background loading is performed after a user starts an application from the package. |
+
/AUTOLOADTARGET target |
+Indicates which applications from the package will be autoloaded. |
+
NONE |
+No autoloading will be performed, despite the presence of any /AUTOLOADONxxx flags. |
+
ALL |
+If an autoload trigger is enabled, all applications in the package will be loaded into cache whether or not they have been previously started. |
+
PREVUSED |
+If an autoload trigger is enabled, the package will load if any applications in this package have previously been started by a user. |
+
/GLOBAL |
+If present, the package will be available for all users on this computer. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
SERVER:<server-name> |
+The display name for the publishing server. |
+
/HOST <hostname> |
+The host name or IP address for the publishing server. |
+
/TYPE {HTTP|RTSP} |
+Indicates whether the publishing server is a Web server ("HTTP") or an Application Virtualization Server ("RTSP"). |
+
/PORT <port> |
+The port on which the publishing server listens. Defaults to 80 for normal HTTP servers, 443 for HTTP servers using enhanced security, 554 for normal Application Virtualization Servers, and 322 for servers using enhanced security. |
+
/PATH <path> |
+The path portion of the URL used in a publishing request. If the TYPE parameter is set to RTSP, the path is optional and defaults to "/". |
+
/REFRESH |
+If set to ON, publishing information will be refreshed when the user logs in. Defaults to ON. |
+
/SECURE |
+If present, indicates that a connection with enhanced security should be established to the publishing server. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
TYPE:<file-extension> |
+The file name extension that will be associated with the application specified. |
+
/APP <application> |
+The name and version (optional) of the application. |
+
/ICON <icon-pathname> |
+The path or URL for the icon file. |
+
/DESCRIPTION <type-desc> |
+The user-friendly name for the file type. Defaults to "EXTENSION File." |
+
/CONTENT-TYPE <content-type> |
+The content type of the file. Defaults to "application/softricity-extension." |
+
/GLOBAL |
+If present, the package will be available for all users on this computer. |
+
/PERCEIVED-TYPE <perceived-type> |
+The perceived type of the file. Defaults to nothing. |
+
/PROGID <progid> |
+The programmatic identifier for the file type. Defaults to App Virt.extension.File. |
+
/CONFIRMOPEN |
+Indicates whether users downloading a file of this type should be asked whether to open or save the file. Defaults to YES. |
+
/SHOWEXT |
+Indicates whether the file's extension should always be shown, even if the user has requested that all extensions be hidden. Defaults to NO. |
+
/NEWMENU |
+Indicates whether an entry should be added to the shell's New menu. Defaults to NO. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Column | +Contents | +
---|---|
Domain |
+Displays the name of the domain. |
+
Group |
+Displays the name of the administrators group. |
+
Name | +Type | +Data (Examples) | +Description | +
---|---|---|---|
ProductName |
+String |
+Microsoft Application Virtualization Desktop Client |
+Do not modify. |
+
Version |
+String |
+4.5.0.xxx |
+Do not modify. |
+
Drivers |
+String |
+Sftfs.sys |
+If this key value is present, it contains the name of the driver that caused a stop error the last time the core was starting. After you have fixed the stop error, you must delete this key value so that sftlist can start. |
+
InstallPath |
+String |
+Default=C:\Program Files\Microsoft Application Virtualization Client |
+The location where the client is installed. Do not modify. |
+
LogFileName |
+String |
+Default=CSIDL_COMMON_APPDATA\Microsoft\Application Virtualization Client\sftlog.txt |
+The path and name for the client log file. +
+Note
+
+If you are running an earlier version than App-V 4.6, SP1 and you modify the log file name or location, you must restart the sftlist service for the change to take effect. +
+
+
+ |
+
LogMinSeverity |
+DWORD |
+Default=4, Informational |
+Controls which messages are written to the log. The value indicates a threshold of what is logged—everything less than or equal to that value is logged. For example, a value of 0x3 (Warning) indicates that Warnings (0x3), Errors (0x2), and Critical Errors (0x1) are logged. +Value Range: 0x0 = None, 0x1 = Critical, 0x2 = Error, 0x3 = Warning, 0x4 = Information (Default), 0x5 = Verbose. +The log level is configurable from the Application Virtualization (App-V) client console and from the command prompt. At a command prompt, the command sftlist.exe /verboselog will increase the log level to verbose. For more information on command-line details see +http://go.microsoft.com/fwlink/?LinkId=141467http://go.microsoft.com/fwlink/?LinkId=141467 +. |
+
LogRolloverCount |
+DWORD |
+Default=4 |
+Defines the number of backup copies of the log file that are kept when it is reset. The valid range is 0–9999. The default is 4. A value of 0 means no copies will be kept. |
+
LogMaxSize |
+DWORD |
+Default=256 |
+Defines the maximum size in megabytes (MB) that the log file can grow before being reset. The default size is 256 MB. When this size is reached, a log reset will be forced on the next write attempt. |
+
SystemEventLogLevel |
+DWORD |
+Default=0x4 (App-V 4.5) +Default=0x3 (App-V 4.6) |
+Indicates the logging level at which log messages are written to the NT event log. The value indicates a threshold of what is logged—that is, everything equal to or less than that value is logged. For example, a value of 0x3 (Warning) indicates that Warnings (0x3), Errors (0x2), and Critical Errors (0x1) are logged. +Value Range +0x0 = None +0x1 = Critical +0x2 = Error +0x3 = Warning +0x4 = Information (Default) +0x5 = Verbose |
+
AllowIndependentFileStreaming |
+DWORD |
+Default=0 |
+Indicates whether streaming from file will be enabled regardless of how the client has been configured with the APPLICATIONSOURCEROOT parameter. If set to FALSE, the transport will not enable streaming from files even if the OSD HREF or the APPLICATIONSOURCEROOT parameter contains a file path. +0x0=False (default) +0x1=True |
+
ApplicationSourceRoot |
+String |
+rtsps://mainserver:322/prodapps +https://mainserver:443/prodapps +file://\\uncserver\share\prodapps +file://\\uncserver\share |
+Enables an administrator or electronic software distribution (ESD) system to ensure application loading is performed according to the topology management scheme. Use this key value to override the OSD CODEBASE for the HREF element (for example, the source location) for an application. Application Source Root supports URLs and Universal Naming Convention (UNC) path formats. +The correct format for the URL path is protocol://servername:[port][/path][/], where port and path are optional. If a port is not specified, the default port for the protocol is used. Only the protocol://server:port portion of the OSD URL is replaced. +The correct format for the UNC path is \\computername\sharefolder\[folder][\], where folder is optional. The computer name can be a fully qualified domain name (FQDN) or an IP address, and sharefolder can be a drive letter. Only the \\computername\sharefolder or drive letter portion of the OSD path is replaced. |
+
OSDSourceRoot |
+String |
+\\computername\sharefolder\resource +\\computername\content +C:\foldername +http://computername/productivity/ +https://computername/productivity/ |
+Enables an administrator to specify a source location for OSD file retrieval for a sequenced application package during publication. Acceptable formats for the OSDSourceRoot include UNC paths and URLs (http or https). |
+
IconSourceRoot |
+String |
+\\computername\sharefolder\resource +\\computername\content +C:\foldername +http://computername/productivity/ +https://computername/productivity/ |
+Enables an administrator to specify a source location for icon file retrieval for a sequenced application package during publication. Acceptable formats for the IconSourceRoot include UNC paths and URLs (http or https). |
+
AutoLoadTriggers |
+DWORD |
+Default=5 |
+AutoLoad is a client runtime policy configuration parameter that enables the secondary feature block of a virtualized application to be streamed to the client automatically in the background. The AutoLoad triggers are flags to indicate events that initiate auto-loading of applications. AutoLoad implicitly uses background streaming to enable the application to be fully loaded into cache. The primary feature block will be loaded first, and the remaining feature blocks will be loaded in the background to enable foreground operations, such as user interaction with applications, to take place and provide optimal perceived performance. +Bit mask values: +(0) Never: No bits are set (value is 0), no auto loading will be performed, because there are no triggers set. +(1) OnLaunch: Loading starts when a user starts an application. +(2) OnRefresh: Loading starts when the application is published. This occurs whenever the package record is added or updated—for example, when a publishing refresh occurs. +(4) OnLogin: Loading starts when a user logs in. +(5) OnLaunch and OnLogin: Default. |
+
AutoLoadTarget |
+DWORD |
+Default=1 |
+Indicates what will be auto-loaded when any given AutoLoad triggers occur. Bit mask values: +(0) None: No auto-loading, regardless of what triggers may be set. +(1) PreviouslyUsed (default): If any AutoLoad trigger is enabled, load only the packages where at least one application in the package has been previously used—that is, started or precached. +(2) All: If any AutoLoad trigger is enabled, all applications in the package (per package) or all packages (set for client) will be automatically loaded, whether or not they have ever been started. |
+
RequireAuthorizationIfCached |
+DWORD |
+Default=1 |
+Indicates that authorization is always required, whether or not an application is already in cache. Possible values: +0=False: Always try to connect to the server. If a connection to the server cannot be established, the client still allows the user to launch an application that has previously been loaded into cache. +1=True (default): Application always must be authorized at startup. For RTSP streamed applications, the user authorization token is sent to the server for authorization. For file-based applications, file ACLs control whether a user may access the application. +Restart the sftlist service for the change to take effect. |
+
UserDataDirectory |
+String |
+%APPDATA% |
+Location where the icon cache and user settings are stored. |
+
GlobalDataDirectory |
+String |
+C:\Users\Public\Documents |
+Directory to use for global App-V data, including caches for OSD files, icon files, shortcut information, and SystemGuard resources such as .ini files. |
+
AllowCrashes |
+DWORD |
+0 or 1 |
+Default=0: A value of 0 means that the client tries to catch internal program exceptions so that other user applications can recover and continue when a crash happens. A value of 1 means that the client allows the internal program exceptions to occur so that they can be captured in a debugger. |
+
CoreInternalTimeout |
+DWORD |
+60 |
+Time-out in seconds for internal IPC requests between core and front-end. Do not modify. |
+
DefaultSuiteCombineTime |
+DWORD |
+10 |
+This value is used to indicate how soon after being started that a program can shut down and not generate any error messages when another application in the same suite is running. |
+
SerializedSuiteLaunchTimeout |
+DWORD |
+Default=60000 |
+Defines how long in milliseconds the client will wait as it tries to serialize program starts in the same suite. If the client times out, the program start will continue but it will not be serialized. |
+
ScriptTimeout |
+DWORD |
+300 |
+Default time-out in seconds for scripts in OSD file if WAIT=TRUE. You can specify per-script time-outs with TIMEOUT instead of WAIT. A value of 0 means no wait, and 0xFFFFFFFF means wait forever. |
+
LaunchRecordLogPath |
+String |
++ | If, under either HKLM or HKCU, this value contains a valid path to a log file, SFTTray will write to this log when programs start, shut down, fail to launch, and enter or exit disconnected mode. |
+
LaunchRecordMask |
+DWORD |
+0x1A (26) log launch errors and disconnected mode entry and exit activity. +0x1F (31) logs everything. +0x0 (0) logs nothing. |
+Specifies which of the five events are logged (bitmask values): +1 for program starts +2 for launch failure errors +4 for shutdowns +8 for entering disconnected mode +16 for exiting disconnected mode to reconnect to a server +Add any combination of those numbers to turn on the respective messages. Defaults to 0x1F if not in registry. |
+
LaunchRecordWriteTimeout |
+DWORD |
+Default=3000 |
+Specifies in milliseconds how long the tray will wait when trying to write to the launch record log if another process is using it. |
+
ImportSearchPath |
+String |
+d:\files\;C:\documents and settings\user1\SFTs |
+A semicolon delimited list of up to five directories to search for portable SFT files before prompting the user to select a directory. Trailing backslash in paths is optional. This value is not present by default and must be set manually. |
+
UserImportPath |
+String |
+D:\SFTs\ |
+Valid only under HKCU. The last location the user browsed to while finding a SFT file for package import. Set automatically if the SFT is found successfully. This is used on successive imports when trying to automatically locate SFT files. |
+
Name | +Type | +Data (Examples) | +Description | +
---|---|---|---|
DumpPath |
+String |
+Default=C:\ |
+Default path to create dump files when generating a minidump on an exception. This defaults to C:\ if not specified. The Client installer sets this key to the <App Virtualization global data directory>\Dumps. The Sequencer installer sets this key to the installation directory. |
+
DumpPathSizeLimit |
+DWORD |
+1000 |
+Specifies the maximum total amount of disk space in megabytes that can be used to store minidumps. Default = 1000 MB. |
+
Name | +Type | +Data (Examples) | +Description | +
---|---|---|---|
Online |
+DWORD |
+Default=1 |
+Enables or disables offline mode. If set to 0, the client will not communicate with App-V Management Servers or publishing servers. In disconnected operations, the client can start a loaded application even when it is not connected to an App-V Management Server. In offline mode, the client does not attempt to connect to an App-V Management Server or publishing server. You must allow disconnected operations to be able to work offline. Default value is 1 enabled (online), and 0 is disabled (offline). |
+
AllowDisconnectedOperation |
+DWORD |
+Default=1 |
+Enables or disables disconnected operation. Default value is 1 enabled, and 0 is disabled. When disconnected operations are enabled, the App-V client can start a loaded application even when it is not connected to an App-V Management Server. |
+
FastConnectTimeout |
+DWORD |
+Default=1000 |
+This value specifies the TCP connect time-out in milliseconds to determine when to go into disconnected operations mode. This value can be used to override the default ConnectTimeout of 20 seconds (App-V connect time-out for network transactions) or the system’s TCP time-out of approximately 25 seconds. This brings the client into disconnected operations mode quickly. Applied on the next connect. |
+
LimitDisconnectedOperation |
+DWORD |
+Default=1 |
+Applicable only if AllowDisconnectedOperation is 1, enabled. This value determines whether there will be a time limit for how long the client will be allowed to operate in disconnected operations. 1=limited. 0=unlimited. |
+
DOTimeoutMinutes |
+DWORD |
+Default=129,600 |
+Indicates how many minutes an application may be used in disconnected operation mode. |
+
+ | + | + | The valid values are 1–999,999 in days expressed in minutes (1–1,439,998,560 minutes). The default value is 90 days or 129,600 minutes. |
+
Protocol |
+DWORD |
+Default=8 |
+Default protocol to use (TCP vs SSL). Configure in Options Dialog. |
+
ReadTimeout |
+DWORD |
+20 |
+Read time-out for network transactions, in seconds. Do not modify. |
+
WriteTimeout |
+DWORD |
+20 |
+Write time-out for network transactions, in seconds. Do not modify. |
+
ConnectTimeout |
+DWORD |
+20 |
+Connect time-out for network transactions, in seconds. Do not modify. |
+
ReestablishmentRetries |
+DWORD |
+3 |
+The number of times to try to reestablish a dropped session. |
+
ReestablishmentInterval |
+DWORD |
+15 |
+The number of seconds to wait between tries to reestablish a dropped session. |
+
Name | +Type | +Data (Examples) | +Description | +
---|---|---|---|
LaunchIfNotFound |
+DWORD |
+Default=0 |
+Controls the behavior of HTTP streaming when a connection to the HTTP server can be established and the package file no longer exists on the HTTP server. If the value does not exist or if it is not set to 1, the App-V client does not let you launch an application that has previously been loaded into cache. |
+
+ | + | 1 |
+If this value is set to 1, the App-V client lets you launch an application that has previously been loaded into cache. |
+
Name | +Type | +Data (Examples) | +Description | +
---|---|---|---|
FileSize |
+DWORD |
+4096 |
+Maximum size in megabytes of file system cache file. If you change this value in the registry, you must set State to 0 and reboot. |
+
FileName |
+String |
+C:\Users\Public\Documents\SoftGrid Client\sftfs.fsd |
+Location of file system cache file. If you change this value in the registry, you must either leave FileSize the same and reboot or set State to 0 and reboot. |
+
DriveLetter |
+String |
+Q: |
+Drive where App-V file system will be mounted, if it is available. This value is set either by the listener or the installer, and it is read by the file system. |
+
State |
+DWORD |
+0x100 |
+State of file system. Set to 0 and reboot to completely clear the file system cache. |
+
FileSystemStorage |
+String |
+C:\Profiles\Joe\SG |
+Path for symlinks, set under HKCU. Do not modify (use data directory under Configuration to change). |
+
GlobalFileSystemStorage |
+String |
+C:\Users\Public\Documents\SoftGrid Client\AppFS Storage |
+Path for global file system data. Do not modify. |
+
MaxPercentToLockInCache |
+DWORD |
+Default=90 |
+Specifies the maximum percentage of the file system cache file that can be locked. Do not modify. |
+
UnloadLeastRecentlyUsed |
+DWORD |
+Default=1 |
+The file system cache space management feature uses a Least Recently Used (LRU) algorithm and is enabled by default. If the space that is required for a new package would exceed the available free space in the cache, the App-V Client uses this feature to determine which, if any, existing packages it can delete from the cache to make room for the new package. The client deletes the package with the oldest last-accessed date if it is older than the value specified in the MinPkgAge registry value. Values are 0 (disabled) and 1 (default, enabled). |
+
MinPackageAge |
+DWORD |
+1 |
+To determine when the package can be selected for discard, set this registry value to equal the minimum number of days you want to elapse since the package was last accessed. Packages that have been used more recently are not discarded. |
+
Name | +Type | +Data (Examples) | +Description | +
---|---|---|---|
TrayErrorDelay |
+DWORD |
+Default=30 |
+Time in seconds that the Application Virtualization notification area will display error messages like "Launch failed". Minimum value of 1. |
+
TraySuccessDelay |
+DWORD |
+Default=10 |
+Time in seconds that the appvmed notification area will display success messages like "Word launched" or "Excel shut down". If 0, those messages will be suppressed. |
+
TrayVisibility |
+DWORD |
+Default=0 |
+0=Show Tray when virtualized applications are in use. +1=Show Tray always. +2=Never show Tray. |
+
TrayShowRefresh |
+DWORD |
++ | When present and set to a value of 1, allows menu item Refresh Applications to be displayed on the Tray menu and is accessible by the user. |
+
TrayShowLoad |
+DWORD |
++ | When present and set to a value of 1, allows menu item Load Applications to be displayed on the Tray menu and is accessible by the user. |
+
Name | +Type | +Data (Examples) | +Description | +
---|---|---|---|
DataCacheLimit |
+DWORD |
+Default=20 |
+This value specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. When a new record is added (bottom of the list), one or more of the oldest records (top of the list) will be deleted to make room. A warning will be logged to the Client log and the event log the first time this occurs, and it will not be logged again until after the cache has been successfully cleared on transmission and the log has filled up again. |
+
DataBlockSize |
+DWORD |
+Default=65536 |
+This value specifies the maximum size in bytes to transmit to the server at once on publishing refresh, to avoid permanent transmission failures when the log has reached a significant size. The default value is 65536. When transmitting report data to the server, one block of application records—less than or equal to the block size in bytes of XML data—will be removed from the cache and sent to the server. Each block will have the general Client data and global package list data prepended, and these will not factor into the block size calculations; the potential exists for an extremely large package list to result in transmission failures over low bandwidth or unreliable connections. |
+
Step | +Reference | +
---|---|
Install the App-V Management Server. If you are installing the Management Web Service, Management Console, or the Data Store on different servers, you can use the custom installation option. |
+[How to Install Application Virtualization Management Server](how-to-install-application-virtualization-management-server.md) |
+
Install the App-V Management Web Service. (Optional ¹) |
+[How to Install the Management Web Service](how-to-install-the-management-web-service.md) |
+
Install the App-V Management Console. (Optional ¹) |
+[How to Install the Management Console](how-to-install-the-management-console.md) |
+
Install the App-V Data Store. (Optional ¹) |
+[How to Install a Database](how-to-install-a-database.md) |
+
Install the App-V client. |
+[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) |
+
Install the App-V Sequencer. |
+[How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md) |
+
Install the App-V Streaming Server. (This is optional and required only if you are installing the Streaming Server). |
+[How to Install the Application Virtualization Streaming Server](how-to-install-the-application-virtualization-streaming-server.md) |
+
Create Content directories on the servers that will be used for streaming applications to users’ computers. |
+[How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md) +[How to Configure the Application Virtualization Streaming Servers](how-to-configure-the-application-virtualization-streaming-servers.md) +[How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md) +[How to Configure the File Server](how-to-configure-the-file-server.md) |
+
Step | +Reference | +
---|---|
Create firewall exceptions for the App-V Management Server or Streaming Server services. |
+[Configuring the Firewall for the App-V Servers](configuring-the-firewall-for-the-app-v-servers.md) |
+
Verify that the App-V system is functioning correctly by publishing, streaming, and testing the default application. |
+[How to Install and Configure the Default Application](how-to-install-and-configure-the-default-application.md) |
+
Configure the App-V Client to use the App-V Streaming Server or other server for streaming by means of the ApplicationSourceRoot, IconSourceRoot, and OSDSourceRoot settings. |
+[How to Configure the Client for Application Package Retrieval](how-to-configure-the-client-for-application-package-retrieval.md) |
+
Understand how to use the .msi file version of sequenced application packages for offline deployment. |
+[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) |
+
(Optional) Configure SQL Server database mirroring for the App-V database. |
+[How to Configure Microsoft SQL Server Mirroring Support for App-V](how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md) |
+
Step | +Reference | +
---|---|
Ensure your computing environment meets the supported configurations required for App-V. |
+[Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) |
+
Configure the necessary Active Directory groups and accounts. |
+[Configuring Prerequisite Groups in Active Directory for App-V](configuring-prerequisite-groups-in-active-directory-for-app-v.md) |
+
Configure the Internet Information Services (IIS) settings on the server that is running IIS. |
+[How to Configure Windows Server 2008 for App-V Management Servers](how-to-configure-windows-server-2008-for-app-v-management-servers.md) |
+
Configure the server that is running IIS to be trusted for delegation. +
+Note
+
+This is required only if you are installing the App-V Management Server by using a distributed system architecture, that is, if you install the App-V Management Console, the Management Web Service, and the database on different computers. +
+
+ |
+[How to Configure the Server to be Trusted for Delegation](how-to-configure-the-server-to-be-trusted-for-delegation.md) |
+
Install Microsoft SQL Server 2008. |
+[Install SQL Server 2008](http://go.microsoft.com/fwlink/?LinkId=181924) (http://go.microsoft.com/fwlink/?LinkId=181924). |
+
Step | +Reference | +
---|---|
Upgrade the App-V clients. |
+[How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md) |
+
Upgrade the App-V servers and database. +
+Important
+
+If you have more than one server sharing access to the App-V database, all those servers must be taken offline while the database is being upgraded. You should follow your regular business practices for the database upgrade, but we recommend that you test the database upgrade by using a backup copy of the database first on a test server. Then, you should select one of the servers for the first upgrade, which will upgrade the database schema. After the production database has been successfully upgraded, you can upgrade the App-V software on the other servers. +
+
+ |
+[How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) |
+
Upgrade the App-V Management Web Service. +This step applies only if the Management Web Service is on a separate server, which would require that you run the server installer program on that separate server to upgrade the Management Web service. Otherwise, the previous server upgrade step will automatically upgrade the Management Web Service. |
+[How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) |
+
Upgrade the App-V Management Console. +This step applies only if the Management Console is on a separate computer, which would require that you run the server installer program on that separate computer to upgrade the console. Otherwise, the previous server upgrade step will upgrade the Management Console. |
+[How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) |
+
Upgrade the App-V Sequencer. |
+[How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md) |
+
OS Value | +
---|
<OS VALUE=”Win2003TS”/> |
+
<OS VALUE=”Win2003TS64”/> |
+
<OS VALUE=”Win2008TS”/> |
+
<OS VALUE=”Win2008TS64”/> |
+
<OS VALUE=”Win2008R2TS64”/> |
+
<OS VALUE=”Win7”/> |
+
<OS VALUE=”Win764”/> |
+
<OS VALUE=”WinVista”/> |
+
<OS VALUE=”WinVista64”/> |
+
<OS VALUE=”WinXP”/> |
+
<OS VALUE=”WinXP64”/> |
+
+ | Sequenced by using the App-V 4.2 Sequencer | +Sequenced by using the App-V 4.5 Sequencer | +Sequenced by using the 32-bit App-V 4.6 Sequencer | +Sequenced by using the 64-bit App-V 4.6 Sequencer | +
---|---|---|---|---|
4.2 Client |
+Yes |
+No |
+No |
+No |
+
4.5 Client ¹ |
+Yes |
+Yes |
+No |
+No |
+
4.6 Client (32-bit) |
+Yes |
+Yes |
+Yes |
+No |
+
4.6 Client (64-bit) |
+Yes |
+Yes |
+Yes |
+Yes |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows XP |
+Professional Edition |
+SP3 |
+x86 |
+
Windows Vista |
+Business, Enterprise, or Ultimate Edition |
+SP2 |
+x86 |
+
Windows 7 |
+Professional, Enterprise, or Ultimate Edition |
+No service pack or SP1 |
+x86 and x64 |
+
Windows 8 |
+Professional or Enterprise Edition |
++ | x86 and x64 |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows XP |
+Professional Edition |
+SP2 or SP3 |
+x86 |
+
Windows Vista |
+Business, Enterprise, or Ultimate Edition |
+No service pack, SP1, or SP2 |
+x86 |
+
Windows 7¹ |
+Professional, Enterprise, or Ultimate Edition |
+No service pack or SP1 |
+x86 |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows Server 2003 R2 |
+Standard Edition, Enterprise Edition, or Datacenter Edition |
+SP2 |
+x86 |
+
Windows Server 2008 |
+Standard, Enterprise, or Datacenter Edition |
+SP2 |
+x86 |
+
Windows Server 2008 R2 |
+Standard, Enterprise, or Datacenter Edition |
+No service pack or SP1 |
+x64 |
+
Windows Server 2012 |
+Standard, Enterprise, or Datacenter Edition |
++ | x86 or x64 |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows Server 2003 |
+Standard Edition, Enterprise Edition, or Datacenter Edition |
+SP1 or SP2 |
+x86 |
+
Windows Server 2003 R2 |
+Standard Edition, Enterprise Edition, or Datacenter Edition |
+No service pack or SP2 |
+x86 |
+
Windows Server 2008 |
+Standard, Enterprise, or Datacenter Edition |
+SP1 or SP2 |
+x86 |
+
Windows Server 2008 R2 |
+Standard, Enterprise, or Datacenter Edition |
+No service pack or SP1 |
+x64 |
+
Parameter | +Values | +Description | +
---|---|---|
ALLOWINDEPENDENTFILESTREAMING |
+TRUE +FALSE |
+Indicates whether streaming from file will be enabled regardless of how the client has been configured with the APPLICATIONSOURCEROOT parameter. If set to FALSE, the transport will not enable streaming from files even if the OSD HREF or the APPLICATIONSOURCEROOT parameter contains a file path. +Possible values: +
|
+
APPLICATIONSOURCEROOT |
+RTSP:// URL (for dynamic package delivery) +File:// URL or UNC (for load from file package delivery) |
+To enable an administrator or an electronic software distribution system to ensure that application loading is performed in compliance with the topology management scheme, allows an override of the OSD CODEBASE for the application HREF element (the source location). If the value is “”, which is the default value, the existing OSD file settings are used. +A URL has several parts: +<protocol>://<server>:<port>/<path>/<?query><#fragment> +A UNC path has three parts: +\\<computername>\<share folder>\<resource> +If the APPLICATIONSOURCEROOT parameter is specified on a client, the client will break the URL or UNC path from an OSD file into its constituent parts and replace the OSD sections with the corresponding APPLICATIONSOURCEROOT sections. +
+Important
+
+Be sure to use the correct format when using file:// with a UNC path. The correct format is file://\\<server>\<share>. +
+
+ |
+
ICONSOURCEROOT |
+UNC +HTTP://URL or HTTPS://URL |
+Enables an administrator to specify a source location for icon retrieval for a sequenced application package during publication. Icon source roots support UNC paths and URLs (HTTP or HTTPS). If the value is “”, which is the default value, the existing OSD file settings are used. +A URL has several parts: +<protocol>://<server>:<port>/<path>/<?query><#fragment> +A UNC path has three parts: +\\<computername>\<share folder>\<resource> +
+Important
+
+Be sure to use the correct format when using a UNC path. Acceptable formats are \\<server>\<share> or <drive letter>:\<folder>. +
+
+ |
+
OSDSOURCEROOT |
+UNC +HTTP://URL or HTTPS://URL |
+Enables an administrator to specify a source location for OSD file retrieval for an application package during publication. OSD source roots support UNC paths and URLs (HTTP or HTTPS). If the value is “”, which is the default value, the existing OSD file settings are used. +A URL has several parts: +<protocol>://<server>:<port>/<path>/<?query><#fragment> +A UNC path has three parts: +\\<computername>\<share folder>\<resource> +
+Important
+
+Be sure to use the correct format when using a UNC path. Acceptable formats are \\<server>\<share> or <drive letter>:\<folder>. +
+
+ |
+
AUTOLOADONLOGIN +AUTOLOADONLAUNCH +AUTOLOADONREFRESH |
+[0|1] |
+The AutoLoad triggers that define the events that initiate auto-loading of applications. AutoLoad implicitly uses background streaming to enable the application to be fully loaded into cache. +The primary feature block will be loaded as quickly as possible. Remaining feature blocks will be loaded in the background to enable foreground operations, such as user interaction with applications, to take priority and provide optimal performance. +
+Note
+
+The AUTOLOADTARGET parameter determines which applications are auto-loaded. By default, packages that have been used are auto-loaded unless AUTOLOADTARGET is set. +
+
+
+Each parameter affects loading behavior as follows: +
The three values can be combined. In the following example, AutoLoad triggers are enabled both at user login and when publishing refresh occurs: +AUTOLOADONLOGIN AUTOLOADONREFRESH +
+Note
+
+If the client is configured with these values at first install, Autoload will not be triggered until the next time the user logs off and logs back on. +
+
+ |
+
AUTOLOADTARGET |
+NONE +ALL +PREVUSED |
+Indicates what will be auto-loaded when any given AutoLoad triggers occur. +Possible values: +
+Note
+
+When you install the App-V client to use a read-only cache, (for example, as a VDI server implementation), you must set the AUTOLOADTARGET parameter to NONE to prevent the client from trying to update applications in the read-only cache. +
+
+ |
+
DOTIMEOUTMINUTES |
+29600 (default) +1–1439998560 minutes (range) |
+Indicates how many minutes an application may be used in disconnected operation. |
+
INSTALLDIR |
+<pathname> |
+Specifies the installation directory of the App-V Client. +Example: INSTALLDIR="C:\Program Files\Microsoft Application Virtualization Client" |
+
OPTIN |
+“TRUE” +“” |
+Microsoft Application Virtualization Client components will be upgradable through Microsoft Update when updates are made available to the general public. The Microsoft Update Agent installed on Windows operating systems requires a user to explicitly opt-in to use the service. This opt-in is required only one time for all applications on the device. If you have already opted into Microsoft Update, the Microsoft Application Virtualization components on the device will automatically take advantage of the service. +For command-line installation, use of Microsoft Update is by default opt-out (unless a previous application already enabled the device to be opted in) due to the requirement for manually opting into Microsoft Update. Therefore, opting in must be explicit for command-line installations. Setting the command-line parameter OPTIN to TRUE forces the Microsoft Update opt-in to be set. |
+
REQUIREAUTHORIZATIONIFCACHED |
+TRUE +FALSE |
+Indicates whether authorization is always required, whether or not an application is already in cache. +Possible values: +
|
+
SWICACHESIZE |
+Cache size in MB |
+Specifies the size in megabytes of the client cache. The default size is 4096 MB, and the maximum size is 1,048,576 MB (1 TB). The system checks for the available space at installation time, but the space is not reserved. +Example: SWICACHESIZE="1024" |
+
SWIPUBSVRDISPLAY |
+Display name |
+Specifies the displayed name of the publishing server; required when SWIPUBSVRHOST is used. +Example: SWIPUBSVRDISPLAY="PRODUCTION ENVIRONMENT" |
+
SWIPUBSVRTYPE |
+[HTTP|RTSP] |
+Specifies the publishing server type. The default server type is Application Virtualization Server. The /secure switch is not case sensitive. +
Example: SWIPUBSVRTYPE="HTTP /secure" |
+
SWIPUBSVRHOST |
+IP address|host name |
+Specifies either the IP address of the Application Virtualization Server or a host name of the server that resolves into the server's IP address; required when SWIPUBSVRDISPLAY is used. +Example: SWIPUBSVRHOST="SERVER01" |
+
SWIPUBSVRPORT |
+Port number |
+Specifies the logical port that is used by this Application Virtualization Server to listen for requests from the client (default = 554). +
Example: SWIPUBSVRPORT="443" |
+
SWIPUBSVRPATH |
+Path name |
+Specifies the location on the publishing server of the file that defines file type associations (default = /); required when the SWIPUBSVRTYPE parameter value is HTTP. +Example: SWIPUBSVRPATH="/AppVirt/appsntypes.xml" |
+
SWIPUBSVRREFRESH |
+[ON|OFF] |
+Specifies whether the client automatically queries the publishing server for file type associations and applications when a user logs in to the client (default = ON). +Example: SWIPUBSVRREFRESH="off" |
+
SWIGLOBALDATA |
+Global data directory |
+Specifies the directory where data will be stored that is not specific to particular users (default = C:\Documents and Settings\All Users\Documents). +Example: SWIGLOBALDATA="D:\Microsoft Application Virtualization Client\Global" |
+
SWIUSERDATA |
+User data directory |
+Specifies the directory where data will be stored that is specific to particular users (default = %APPDATA%). +Example: SWIUSERDATA="H:\Windows\Microsoft Application Virtualization Client" |
+
SWIFSDRIVE |
+Preferred drive letter |
+Corresponds to the drive letter that you selected for the virtual drive. +Example: SWIFSDRIVE="S" |
+
SYSTEMEVENTLOGLEVEL |
+0–4 |
+Indicates the logging level at which log messages are written to the NT event Log. The value indicates a threshold of what is logged—that is, everything equal to or less than that value is logged. For example, a value of 0x3 (Warning) indicates that Warnings (0x3), Errors (0x2), and Critical Errors (0x1) are logged. +Possible values: +
|
+
MINFREESPACEMB |
+In MB |
+Specifies the amount of free space (in megabytes) that must be available on the host before the cache size can increase. The following example would configure the client to ensure at least 5 GB of free space on the disk before allowing the size of the cache to increase. The default is 5000 MB of free space available on disk at installation time. +Example: MINFREESPACEMB ="5000" (5 GB) |
+
KEEPCURRENTSETTINGS |
+[0|1] |
+Used when you have applied registry settings prior to deploying a client—for example, by using Group Policy. When a client is deployed, set this parameter to a value of 1 so that it will not overwrite the registry settings. +
+Important
+
+If set to a value of 1, the following client installer command-line parameters are ignored: +SWICACHESIZE, MINFREESPACEMB, ALLOWINDEPENDENTFILESTREAMING, APPLICATIONSOURCEROOT, ICONSOURCEROOT, OSDSOURCEROOT, SYSTEMEVENTLOGLEVEL, SWIGLOBALDATA, DOTIMEOUTMINUTES, SWIFSDRIVE, AUTOLOADTARGET, AUTOLOADTRIGGERS, and SWIUSERDATA. +For further information about setting these values after installation, see “How to Configure the App-V Client Registry Settings by Using the Command Line” in the Application Virtualization (App-V) Operations Guide ([http://go.microsoft.com/fwlink/?LinkId=122939](http://go.microsoft.com/fwlink/?LinkId=122939)). +
+
+ |
+
Term | +Definition | +
---|---|
active upgrade |
+An upgrade that enables a new version of an application to be added to an App-V Management Server or Streaming Server without affecting users currently running the application. |
+
Application Source Root |
+Reference to a registry key that allows an override of the OSD CODEBASE for the HREF element (for example, the source location). This registry value enables an administrator or ESD system to ensure application loading is performed according to a planned topology management scheme. |
+
Application Virtualization drive |
+The default virtual application client drive (Q:) from which sequenced applications are run. |
+
Application Virtualization reporting |
+Virtual application information gathered for data analysis. Data is collected for assembly of custom views and interpretation. |
+
AutoLoad configuration parameter |
+A client runtime policy configuration parameter that enables the secondary feature block of a virtualized application to be streamed to the client automatically in the background. |
+
branch a package |
+To upgrade an existing sequenced application package and run it side-by-side with the original sequenced application package. |
+
Dynamic Suite Composition |
+An Application Virtualization feature that enables a virtual application package to allow dependent plug-ins or middleware packages to use the virtual environment. This feature enables plug-ins and middleware packages to use the primary package's registry settings, and the packages behave and interact with one another in the same way as if they were installed locally on a comuter. |
+
ICO file |
+The file for the icon on the client's desktop used to launch a sequenced application. |
+
Icon Source Root |
+Reference to a registry key that allows specification of a source location for icon retrieval for a sequenced application package during publication. Icon Source Roots support UNC formats only (not URLs). |
+
Installation directory |
+The directory where the installer for the application virtualization sequencer places its files. |
+
Microsoft Application Virtualization Desktop Client |
+An application that resides on a Windows-based computer desktop and which communicates and authenticates with the Microsoft System Center Virtual Application Server to receive the application code and allow a sequenced application to be run locally. |
+
Microsoft Application Virtualization for Terminal Services |
+The Application Virtualization feature, including both client and server components, running in a Terminal Services environment. |
+
Microsoft Application Virtualization Management Console |
+Centralized snap-in to the Microsoft Management Console, which you use to administer the Application Virtualization Management System. |
+
Microsoft Application Virtualization Management System |
+A specific deployment of the Application Virtualization platform that includes all of the components that are managed by a single data store. |
+
Microsoft Application Virtualization Management Web Service |
+A service that acts as an intermediary between the Application Virtualization Management Console and the data store. First it authenticates its users, and then it allows authorized administrators to manipulate data in the data store. |
+
Microsoft Application Virtualization platform |
+Name for the Microsoft products that are used to create, store, distribute, and run virtualized applications. |
+
Microsoft Application Virtualization Sequencer |
+Application that monitors and records the installation and setup process for applications so that an application can be sequenced and run in the virtual environment. |
+
Microsoft Application Virtualization Terminal Services Client |
+An application that resides on a Terminal Server and which communicates and authenticates with the Microsoft Virtual Application Server to receive the application code and allow a sequenced application to be run locally. |
+
Microsoft System Center Application Virtualization Management Server |
+One of two Application Virtualization server types from which a sequenced application package can be streamed. In addition to streaming virtual application packages, the Application Virtualization Management Server offers other services such as publishing, management, reporting, and so on. |
+
Microsoft System Center Application Virtualization Streaming Server |
+One of two Application Virtualization server types from which a sequenced application package can be streamed. The Streaming Server streams applications to the client computers only and does not offer other services such as publishing, management, reporting, and so on. |
+
Open Software Descriptor (OSD) file |
+An XML-based file that instructs the client on how to retrieve the sequenced application from the Application Virtualization Management/Streaming Server and how to run the sequenced application in its virtual environment. |
+
OSD Source Root |
+Reference to a registry key that allows specification of a source location for OSD file retrieval for an application package during publication. OSD Source Roots support UNC formats only (not URLs). |
+
package root directory |
+The directory on the sequencing computer on which files for the sequenced application package are installed. This directory also exists virtually on the computer to which a sequenced application will be streamed. |
+
primary feature block |
+The minimum content in an application package that is necessary for an application to run. The content in the primary feature block is identified during the application phase of sequencing and typically consists of the content for the most used application features. |
+
secondary feature block |
+The remainder of the application package that is not contained in the primary feature block. This content is streamed to the client on demand as application features are used. |
+
sequenced application |
+An application that has been monitored by the Sequencer, broken up into primary and secondary feature blocks, streamed to a computer running the Microsoft Application Virtualization Terminal Services Client or the Microsoft Application Virtualization Desktop Client, and can run inside of its own virtual environment. |
+
sequenced application package |
+The files that comprise a virtual application and allow a virtual application to run. These files are created after sequencing and specifically include .osd, .sft, .sprj, and .ico files. |
+
sequencing |
+The process of creating an application package by using the Application Virtualization Sequencer. In this process, an application is monitored, its shortcuts are configured, and a sequenced application package is created containing the .osd, .sft, .sprj, and .ico files. |
+
sequencing computer |
+The computer used to perform sequencing and create a sequenced application package. |
+
Sequencing Wizard |
+Step-by-step wizard that walks the user through sequencing an application, including package configuration, installing the application or applications to be sequenced, and sequencing the application package for streaming. |
+
SFT |
+A file that contains one or more sequenced applications that the Sequencer has packaged into streaming blocks, as well as the associated delivery information. The SFT file is stored on each server that must stream the packaged applications to a client. |
+
SFTMIME |
+A command-line interface for setting up and managing applications, file type associations, and desktop configuration servers managed by Application Virtualization Desktop and Terminal Services Clients. |
+
SPRJ file |
+An XML-based Sequencer Project file, in which the Sequencer stores its Exclusion Items and Parse Items information. The SPRJ file is used heavily in the creation of application records as well as during an upgrade to a package. |
+
virtual application |
+An application packaged by the Sequencer to run in a self-contained, virtual environment. The virtual environment contains the information necessary to run the application on the client without installing the application locally. |
+
Virtual COM |
+The subsystem that manages COM objects created by application processes running in a virtual environment and prevents conflict with the same objects created outside the virtual environment. |
+
virtual directory |
+An opaque directory where only files and subdirectories defined in the application package or created through interaction with an application in a virtual environment are visible. Any files in an identically named local directory are not visible to the application. |
+
virtual environment |
+A runtime container that defines the resources available to application processes launched from a sequenced application package. |
+
virtual file |
+A file name within the virtual environment that is mapped to an alternate target location. A virtual file appears alongside other files in the containing directory, regardless of whether that directory is virtual or local. |
+
virtual file system |
+The subsystem that intercepts and redirects file system requests from application processes running in a virtual environment. These requests are processed based on the virtual files and directories defined in the application package and created or modified through interaction with a virtual application. |
+
virtual registry |
+The subsystem that intercepts and redirects registry requests for keys and values from application processes running in a virtual environment. The redirection is based on the registry information defined in the application package and created or modified through interaction with a virtual application. |
+
virtual services |
+The subsystem that acts as the Service Control Manager (SCM) for services running in a virtual environment. |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows XP |
+Professional |
+SP3 |
+x86 |
+
Windows Vista |
+Business, Enterprise, or Ultimate |
+SP2 |
+x86 |
+
Windows 7 |
+Professional, Enterprise, or Ultimate |
+No service pack or SP1 |
+x86 and x64 |
+
Windows 8 |
+Professional or Enterprise Edition |
++ | x86 and x64 |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows XP |
+Professional |
+SP2 or SP3 |
+x86 |
+
Windows Vista |
+Business, Enterprise, or Ultimate |
+No service pack, SP1, or SP2 |
+x86 |
+
Windows 7¹ |
+Professional, Enterprise, or Ultimate |
++ | x86 |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows Server 2003 R2 |
+Standard Edition, Enterprise Edition, or Datacenter Edition |
+SP2 |
+x86 |
+
Windows Server 2008 |
+Standard, Enterprise, or Datacenter Edition |
+SP2 |
+x86 |
+
Windows Server 2008 R2 |
+Standard, Enterprise, or Datacenter Edition |
+No service pack or SP1 |
+x64 |
+
Windows Server 2012 |
+Standard, Enterprise, or Datacenter Edition |
++ | x86 or x64 |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows Server 2003 |
+Standard Edition, Enterprise Edition, or Datacenter Edition |
+SP1 or SP2 |
+x86 |
+
Windows Server 2003 R2 |
+Standard Edition, Enterprise Edition, or Datacenter Edition |
+No service pack or SP2 |
+x86 |
+
Windows Server 2008 |
+Standard, Enterprise, or Datacenter Edition |
+SP1 or SP2 |
+x86 |
+
Windows Server 2008 R2 |
+Standard, Enterprise, or Datacenter Edition |
+No service pack or SP1 |
+x64 |
+
Name | +Description | +
---|---|
Add the following files to the VFS |
+Select to add the listed files to the virtual file system. |
+
Remove |
+Click to remove a selected file from the list so that it will not be added to the virtual file system. |
+
Add |
+Click to add a file so that you can add a file to the virtual file system. |
+
Reset |
+Click to restore the default list of files under Add the following files to the VFS. |
+
Back |
+Accesses the Sequencing Wizard's previous page. |
+
Next |
+Accesses the Sequencing Wizard's next page. |
+
Cancel |
+Terminates operation of the Sequencing Wizard. |
+
Name | +Description | +
---|---|
Block Size |
+Use to specify the size of blocks that the SFT file will be divided into when streamed across a network. All blocks equal the specified size; however, the last block might be smaller than specified. Select one of the following values: +
+Note
+
+When you select a block size, consider the size of the SFT file and your network bandwidth. A file with a smaller block size takes longer to stream over the network but is less bandwidth-intensive. Files with larger block sizes might stream faster, but they use more network bandwidth. Through experimentation, you can discover the optimum block size for streaming applications on your network. +
+
+ |
+
Enable Microsoft Update During Monitoring |
+Enables installation of Microsoft Updates during the Sequencing Wizard's monitoring phase. |
+
Rebase DLLs |
+Enables remapping of supported dynamic-link libraries to a contiguous space in RAM, saving memory and improving performance. |
+
Back |
+Accesses the Sequencing Wizard's previous page. |
+
Next |
+Accesses the Sequencing Wizard's next page. |
+
Cancel |
+Terminates operation of the Sequencing Wizard. |
+
Name | +Description | +
---|---|
Allow Microsoft Update to run during monitoring |
+Specifies whether software updates will be applied to the application during the monitoring phase of application sequencing. This option is helpful if updates are required to successfully complete the application installation. This option is not selected by default. |
+
Rebase Dlls |
+Enables remapping of supported dynamic-link libraries to a contiguous space in RAM. Selecting this option can help manage memory and improve application performance. This option is not selected by default. |
+
Back |
+Goes to the previous page of the wizard. |
+
Next |
+Goes to the next page of the wizard. |
+
Cancel |
+Discards the settings and exits the wizard. |
+
Name | +Description | +
---|---|
Application |
+Displays a list of applications, which can be expanded to add or edit file type associations. |
+
Name |
+Displays the name of the application you are sequencing. |
+
Version |
+Displays the version number for the application you are sequencing. |
+
Command Line |
+Displays any command-line directive of the application you are sequencing. |
+
Add |
+Adds a selected application to a package. |
+
Remove |
+Deletes a selected application from a package. |
+
Edit |
+Enables editing of the application path and OSD file properties of the selected application. |
+
Back |
+Goes to the previous page of the wizard. |
+
Next |
+Goes to the next page of the wizard |
+
Cancel |
+Discards the settings and closes the wizard. |
+
Name | +Description | +
---|---|
Name |
+Displays the name of application you are sequencing. |
+
Command Line |
+Displays any command-line directive for the application you are sequencing. |
+
Launch All |
+Starts each application displayed, exercises each application sufficiently to cover the actions that users typically take immediately after they open the application, and then exits each application. |
+
Launch |
+Starts a selected application and exercises the application sufficiently to cover the actions that users typically take immediately after they open the application. |
+
Back |
+Goes to the previous page of the wizard. |
+
Next |
+Goes to the next page of the wizard. |
+
Cancel |
+Discards the settings and closes the wizard. |
+
Name | +Description | +
---|---|
Begin Monitoring |
+Starts the monitoring of the sequencing process. +
+Note
+
+The Sequencer will minimize so that you can run your application's installer, except on Vista. +
+
+ |
+
Stop Monitoring |
+Stops the monitoring of the sequencing process. +
+Note
+
+The Stop Monitoring button is displayed only after the monitoring process starts. +
+
+ |
+
Back |
+Accesses the Sequencing Wizard's previous page. |
+
Next |
+Accesses the Sequencing Wizard's next page. |
+
Cancel |
+Terminates operation of the Sequencing Wizard. |
+
Name | +Description | +
---|---|
Begin Monitoring |
+Starts the monitoring of the application installation by the sequencer. This option enables the sequencer to record the installation process. After you click Start Monitoring, you must wait while sequencer prepares the computer for sequencing. All new and changed application components will be added to the virtual application package. |
+
Stop Monitoring |
+Stops the sequencer from recording the installation process. This button is not available until you click Begin Monitoring. |
+
Back |
+Goes to the previous page of the wizard. |
+
Next |
+Goes to the next page of the wizard. |
+
Cancel |
+Discards the settings and closes the wizard. |
+
Name | +Description | +
---|---|
Package Name |
+Specifies the name that will be associated with the virtual application package. This is a required field. |
+
Comments |
+Specifies identifying information that will be associated with the package. The information will be added to OSD file ABSTRACT element. This field is optional. |
+
Show Advanced Monitoring Options |
+Displays the Advanced Options page of the Sequencing Wizard. |
+
Next |
+Goes to the next page of the wizard. |
+
Cancel |
+Discards the settings and exits the wizard. |
+
Name | +Description | +
---|---|
Finish |
+Closes the Sequencing Wizard and displays the virtual application package in the Sequence console. |
+
Method | +Advantages | +Disadvantages | +Comments | +
---|---|---|---|
Dynamic package delivery |
+Applications are delivered and updated on demand. +Applications are delivered and updated incrementally to optimize launch time. +Updates are delivered automatically to the client desktop. |
+Larger footprint in enterprise topology because of server requirements. +Application streaming should be over a LAN; deployment scenarios over a WAN or that use an unreliable or intermittent connection between the server and client might be unusable. |
+Requires a streaming infrastructure. +Windows Installer used to deploy Application Virtualization Desktop Client software to end-user computers. +Large enterprises should use Application Virtualization Streaming Servers as distribution points. |
+
Load from file package delivery |
+Consistent with typical enterprise management practices. +Supports stand-alone configuration scenario. +Provides solution to micro–branch office problem. |
+Application delivery and update is not possible on-demand. +Application delivery and update is not incremental; it increases resource consumption relative to dynamic delivery. |
+The IT organization is often responsible for managing application licenses, user authorization, and authentication. |
+
Server Type | +Protocols | +External Components Needed | +Reporting | +Active Upgrade | +
---|---|---|---|---|
Application Virtualization Management Server |
+RTSP +RTSPS |
+When using HTTPS, use an IIS server to download ICO and OSD files and a firewall to protect the server from exposure to the Internet. |
+Internal |
+Supported |
+
Application Virtualization Streaming Server |
+RTSP +RTSPS |
+Use a mechanism to synchronize the content between the Management Server and the Streaming Server. When using HTTPS, use an IIS server to download ICO and OSD files and use a firewall to protect the server from exposure to the Internet. |
+Internal |
+Supported |
+
IIS server |
+HTTP +HTTPS |
+Use a mechanism to synchronize the content between the Management Server and the Streaming Server. When using HTTP or HTTPS, use an IIS server to download ICO and OSD files and a firewall to protect the server from exposure to the Internet. |
+Internal |
+Not Supported |
+
File |
+SMB |
+You need a way to synchronize the content between the Management Server and the Streaming Server. You need a client computer with file sharing or streaming capability. |
+Internal |
+Not Supported |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows Server 2003 |
+Standard Edition |
+SP1 or SP2 |
+x86 or x64 |
+
Windows Server 2003 |
+Enterprise Edition or Datacenter Edition |
+SP1 or SP2 |
+x86 or x64 |
+
Windows Server 2003 R2 |
+Standard Edition |
+No service pack or SP2 |
+x86 or x64 |
+
Windows Server 2003 R2 |
+Enterprise Edition or Datacenter Edition |
+No service pack or SP2 |
+x86 or x64 |
+
Windows Server 2008 |
+Standard, Enterprise, or Datacenter Edition |
+SP1 or SP2 |
+x86 or x64 |
+
Windows Server 2008 R2¹ |
+Standard, Enterprise, or Datacenter Edition |
++ | x64 |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows Server 2003 |
+Standard Edition |
+SP1 or SP2 |
+x86 or x64 |
+
Windows Server 2003 |
+Enterprise Edition or Datacenter Edition |
+SP1 or SP2 |
+x86 or x64 |
+
Windows Server 2003 R2 |
+Standard Edition |
+No service pack or SP2 |
+x86 or x64 |
+
Windows Server 2003 R2 |
+Enterprise Edition or Datacenter Edition |
+No service pack or SP2 |
+x86 or x64 |
+
Windows Server 2008 |
+Standard, Enterprise, or Datacenter Edition |
+SP1 or SP2 |
+x86 or x64 |
+
Windows Server 2008 R2¹ |
+Standard, Enterprise, or Datacenter Edition |
++ | x64 |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows Server 2003 |
+Standard Edition |
+SP1 or SP2 |
+x86 or x64 |
+
Windows Server 2003 |
+Enterprise Edition or Datacenter Edition |
+SP1 or SP2 |
+x86 or x64 |
+
Windows Server 2003 R2 |
+Standard Edition |
+No service pack or SP2 |
+x86 or x64 |
+
Windows Server 2003 R2 |
+Enterprise Edition or Datacenter Edition |
+No service pack or SP2 |
+x86 or x64 |
+
Windows Server 2008 |
+Standard, Enterprise, or Datacenter Edition |
+SP1 or SP2 |
+x86 or x64 |
+
Windows Server 2008 R2¹ |
+Standard, Enterprise, or Datacenter Edition |
++ | x64 |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows XP |
+Professional Edition |
+SP2 or SP3 |
+x86 or x64 |
+
Windows Vista |
+Business, Enterprise, or Ultimate Edition |
+No service pack, SP1, or SP2 |
+x86 or x64 |
+
Windows 7 |
+Professional, Enterprise, or Ultimate Edition |
++ | x86 or x64 |
+
Windows Server 2003 |
+Standard Edition, Enterprise Edition, or Datacenter Edition |
+SP1 or SP2 |
+x86 or x64 |
+
Windows Server 2003 R2 |
+Standard Edition, Enterprise Edition, or Datacenter Edition |
+No service pack or SP2 |
+x86 or x64 |
+
Windows Server 2008 |
+Standard, Enterprise, or Datacenter Edition |
+SP1 or SP2 |
+x86 or x64 |
+
Windows Server 2008 R2¹ |
+Standard, Enterprise, or Datacenter Edition |
++ | x64 |
+
Column | +Contents | +
---|---|
Description |
+Describes the license. |
+
Type |
+Lists the type of license. The available types are Unlimited (any number or users), Concurrent (a specified number of concurrent users), and Named (licenses reserved for specific users). |
+
Expiration Date |
+Displays the date the license is set to expire. |
+
Enabled |
+Displays the enabled status of the license as true or false. |
+
Column | +Contents | +
---|---|
Name |
+Displays the application name. |
+
Version |
+Displays the application version. |
+
Package |
+Displays the name of the package. |
+
OSD Path |
+Displays the full original path or URL to the Open Software Descriptor (OSD) file. |
+
Icon File |
+Displays the complete path to the icon file. |
+
Enabled |
+Displays the enabled status of the file; the status is either true or false. |
+
Application License |
+Displays the name of the application license. |
+
Type |
+Displays the application or application group type. |
+
Description |
+Displays a brief description of the application. |
+
Parameter | +Description | +
---|---|
APP:<application> |
+The name and version (optional) of the application. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
APP:<application> |
+The name and version (optional) of the application. |
+
/ICON <icon-pathname> |
+The path or URL for the icon file. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
PACKAGE:<package-name> |
+User-visible and user-friendly name for the package. |
+
/MANIFEST <manifest-path> |
+The path or URL of the manifest file that lists the applications included in the package and all of their publishing information. |
+
/OVERRIDEURL <URL> |
+The location of the package's SFT file. |
+
/AUTOLOADNEVER |
+Background loading is turned off for the package. |
+
/AUTOLOADONREFRESH |
+Background loading is performed after a publishing refresh. |
+
/AUTOLOADONLOGIN |
+Background loading is performed when a user logs in. |
+
/AUTOLOADONLAUNCH |
+Background loading is performed after a user starts an application from the package. |
+
/AUTOLOADTARGET <target> |
+Indicates which applications from the package will be autoloaded. |
+
NONE |
+No autoloading will be performed despite the presence of any /AUTOLOADONxxx flags. |
+
ALL |
+If an autoload trigger is enabled, all applications in the package will be loaded into cache regardless of whether they have ever been launched. |
+
PREVUSED |
+If an autoload trigger is enabled, the package will load if any applications in this package have previously been started by a user. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
[/NO-UPDATE-FTA-SHORTCUT {TRUE|FALSE} {/GLOBAL}] |
+If set to TRUE, a registry value is created for the package, either per user, or globally if the /GLOBAL flag is specified. +If set to FALSE, the registry value is removed and the file type associations (FTA) for the package are reinstalled. +If not specified, normal FTA and shortcut publishing behavior occurs. If you perform any subsequent publishing refresh operations on the App-V 4.6 SP2 client, the shortcuts and FTAs for packages that have this registry value set will not be changed, and the shortcuts and FTAs will not be registered at system startup or user login unless you reset the flag. |
+
/GLOBAL |
+Works in conjunction with the /NO-UPDATE-FTA-SHORTCUT flag. If the /GLOBAL flag is present, it indicates that a registry value will be created for that package for all users. By default, the registry value is created only for this user. |
+
Parameter | +Description | +
---|---|
SERVER:<server-name> |
+The display name for the publishing server. |
+
/NAME <display-name> |
+New display name for the server. |
+
/HOST <hostname> |
+The host name or IP address for the publishing server. |
+
/PORT <port> |
+The port on which the publishing server listens. Defaults to 80 for normal HTTP servers, 443 for HTTP servers using enhanced security, 554 for normal Application Virtualization Servers, and 322 for servers using enhanced security. |
+
/PATH <path> |
+The path portion of the URL used in a publishing request. If the TYPE parameter is set to RTSP, the path is optional and defaults to "/". |
+
/TYPE |
+Indicates whether the publishing server is a Web server ("HTTP") or an Application Virtualization Server ("RTSP"). |
+
/REFRESH |
+If set to ON, publishing information will be refreshed when the user logs in. Defaults to ON. |
+
/SECURE |
+If present, indicates that a connection with enhanced security should be established to the publishing server. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
TYPE:<file-extension> |
+The file name extension to be configured. |
+
/APP <application> |
+The name and version (optional) of the application to associate this file type with. Cannot be specified with PROGID. |
+
/ICON <icon-pathname> |
+The path or URL for the icon file. |
+
/DESCRIPTION <type-desc> |
+The user-friendly name for the file type. |
+
/CONTENT-TYPE <content-type> |
+The content type of the file. |
+
/GLOBAL |
+If present, indicates that the association that applies to all users should be edited, not the user-specific one. |
+
/PERCEIVED-TYPE <perceived-type> |
+The perceived type of the file. |
+
/PROGID <progid> |
+Indicates that the extension should be associated with a different file type. The previous file type is not deleted. Cannot be specified with APP, ICON, DESCRIPTION, CONFIRMOPEN, or SHOWEXT. |
+
/CONFIRMOPEN |
+Indicates whether users downloading a file of this type should be asked whether to open or save the file. |
+
/SHOWEXT |
+Indicates whether the file's extension should always be shown, even if the user has requested that all extensions be hidden. |
+
/NEWMENU |
+Indicates whether an entry should be added to the shell's New menu. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Object | +Description | +
---|---|
Organizational Unit (OU) |
+Create an OU in Active Directory for the specific groups required for App-V. |
+
App-V Administrative Group |
+During installation of the App-V Management Server, you must select an Active Directory group to use as the App-V Administrators group to control administrative access to the Management Console. Create a security group for App-V administrators, and add to this group every user who needs to use the Management Console. You cannot create this group directly from the App-V Management Server installer. |
+
App-V Users Group |
+App-V requires that every User account that accesses App-V functions be a member of a provider policy associated with a single group for general platform access. Use an existing group; for example, Domain Users, if all users are to have access to App-V, or create a new group. |
+
Application Groups |
+App-V associates the right to use an individual application with an Active Directory group. Create an Active Directory group for each application, and assign users to these groups as needed to control user access to the applications. |
+
Parameter | +Description | +
---|---|
APP:<application> |
+The name and version (optional) of the application to be removed. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
/GLOBAL |
+If specified, all applications are removed. By default, only applications the current user has access to are removed. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
PACKAGE:<package-name> |
+The name of the package to be removed. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
SERVER:<server-name> |
+The display name of the publishing server. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
TYPE:<file-extension> |
+The file name extension to be removed. |
+
/GLOBAL |
+If specified, indicates that the global association for the file name extension should be removed. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Method | +Advantages | +Disadvantages | +
---|---|---|
Generate a Windows Installer file during sequencing, as a stand-alone solution. |
+
|
+
|
+
Generate a Windows Installer file during sequencing, used with MODE, LOAD, and OVERRIDEURL command-line properties and the package manifest. |
+
|
+
|
+
Run SFTMIME commands. |
+
|
+
|
+
Server Type | +Protocol | +Advantages | +Disadvantages | +Links | +
---|---|---|---|---|
File server |
+File |
+
|
+
|
+[How to Configure the File Server](how-to-configure-the-file-server.md) |
+
IIS server |
+HTTP/ HTTPS |
+
|
+
|
+[How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md) |
+
Application Virtualization Streaming Server |
+RTSP/ RTSPS |
+
|
+
|
+[How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md) |
+
Column | +Description | +
---|---|
Extension |
+Displays the extension, such as DOC or HTML. This is the field by which the list is organized, so each extension is displayed once on the list. |
+
File Type |
+Displays the file type. |
+
Parameter | +Description | +
---|---|
/?, /HELP |
+Displays usage information. |
+
verb |
+The command to run, such as ADD, REFRESH, HELP or REMOVE. |
+
object |
+What the command applies to, such as APP:"Default Application." |
+
parameters |
+Optional parameters for the specified verb and object. |
+
/LOG |
+Log output to the specified path name. |
+
/CONSOLE |
+Displays output in the active console window (default). |
+
/GUI |
+Displays errors in a dialog box (not valid for queries). |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
ADD |
+Adds a new application, package, file type association, or publishing server to the App-V Client. |
+
CONFIGURE |
+Changes the configuration of an application, a package, a file type association, or a publishing server. |
+
DELETE |
+Removes applications, packages, file type associations, or servers. |
+
LOAD |
+Loads a package into the file system cache. |
+
REPAIR |
+Resets your personal settings for an application. |
+
REFRESH |
+Triggers a publishing server refresh. |
+
PUBLISH |
+Publishes an application shortcut to the user's Start menu, desktop, or other specified location, or can be used to publish the contents of an entire package. |
+
UNPUBLISH |
+Removes the shortcuts and file types for an entire package. |
+
QUERY |
+Gets a current list of applications, packages, file type associations, or publishing servers. |
+
CLEAR |
+Removes your personal settings and desktop configurations for one or more applications. |
+
UNLOAD |
+Unloads a package from the file system cache. |
+
LOCK |
+Locks the application specified in the file system cache. |
+
UNLOCK |
+Unlocks the application specified in the file system cache. |
+
Value | +Logging Level | +
---|---|
0 |
+ Transactions Only |
+
1 |
+ Fatal Errors |
+
2 |
+ Errors |
+
3 |
+ Warnings/Errors |
+
4 |
+ Information/ Warnings/Errors |
+
5 |
+ Verbose |
+
Key | +Type | +Value | +Purpose | +
---|---|---|---|
FileName |
+ String |
+ path of FSD |
+ Specifies the path of the shared cache file, for example, \\RDSServername\Sharefolder\SFTFS.FSD (Required). |
+
ReadOnlyFSD |
+ DWORD |
+ 1 |
+ Configures the client to operate in Read-Only mode. This ensures that the client will not try to stream updates to the package cache. (Required) |
+
ErrorLogLocation |
+ String |
+ path of error log (.etl) file |
+ Entry used to specify the path of the error log. (Recommended. Use a local path such as C:\Logs\Sftfs.etl). |
+
Key | +Type | +Value | +Purpose | +
---|---|---|---|
FileName |
+ String |
+ path to FSD |
+ Specifies the path to the shared cache file, for example, \\VDIServername\Sharefolder\SFTFS.FSD (Required). |
+
ReadOnlyFSD |
+ DWORD |
+ 1 |
+ Configures the client to operate in Read-Only mode. This ensures that the client will not attempt to stream updates to the package cache. (Required) |
+
ErrorLogLocation |
+ String |
+ path to error log (.etl) file |
+ Entry used to specify the path to the error log. (Recommended. Use a local path such as C:\Logs\Sftfs.etl). |
+
Name |
+Type |
+Data (Examples) |
+Description |
+
FileTypePolicy |
+DWORD |
+Default=0x2 (App-V 4.6) |
+(0x0) – “ClientOnly”- remove any existing items from the same publishing information source, and keep only items that are added locally +(0x1) – “ServerOnly” - remove any outdated items from the same publishing information source and any items that are added locally, and add the new items +(0x2) – “ClientAndServer”- remove any outdated items from the same publishing information source, keep items added locally, and add the new items (default if not present for App-V 4.6) +(0x3) – “NoChange” - make no changes to file types or shortcuts |
+
ShortcutPolicy |
+DWORD |
+Default=0x2 |
+(0x0) – “ClientOnly”- remove any existing items from the same publishing information source, and keep only items added locally +(0x1) – “ServerOnly” - remove any outdated items from the same publishing information source and any items added locally, and add the new items +(0x2) – “ClientAndServer”- remove any outdated items from the same publishing information source, keep items added locally, and add the new items (default if not present) +(0x3) – “NoChange” - make no changes to file types or shortcuts |
+
ApplicationSourceRoot | +OSD File HREF Path | +Result | +Comments | +
---|---|---|---|
rtsps://mainserver:322 |
+ rtsp://appserver/productivity/office2k3.sft?customer=seq |
+ rtsps://mainserver:322/productivity/office2k3.sft?customer=seq |
+ + |
rtsps://mainserver:322/prodapps |
+ rtsp://appserver/productivity/office2k3.sft?customer=seq |
+ rtsps://mainserver:322/prodapps/productivity/office2k3.sft?customer=seq |
+ + |
https://mainserver:443/prodapps |
+ rtsp://appserver/productivity/office2k3.sft?customer=seq |
+ https://mainserver:443/prodapps/productivity/office2k3.sft?customer=seq |
+ + |
rtsps://mainserver:322/prodapps |
+ rtsp://%SFT_APPVSERVER%:554/productivity/office2k3.sft?customer=seq |
+ rtsps://mainserver:322/prodapps/productivity/office2k3.sft?customer=seq |
+ + |
rtsps://mainserver:322 |
+ \\uncserver\share\productivity\office2k3.sft |
+ rtsps://mainserver:322/productivity/office2k3.sft |
+ ‘\’ converted to ‘/’ |
+
rtsps://mainserver:322 |
+ file://\\uncserver\share\productivity\office2k3.sft |
+ rtsps://mainserver:322/productivity/office2k3.sft |
+ ‘\’ converted to ‘/’ |
+
\\uncserver\share |
+ rtsp://appserver/productivity/office2k3.sft?customer=seq |
+ \\uncserver\share\productivity\office2k3.sft |
+ ‘/’ converted to ‘\’ and parameter dropped when converting to UNC path |
+
\\uncserver\share\prodapps |
+ rtsp://appserver/productivity/office2k3.sft?customer=seq |
+ \\uncserver\share\prodapps\productivity\office2k3.sft |
+ ‘/’ converted to ‘\’ and parameter dropped when converting to UNC path |
+
M: |
+ \\uncserver\share\productivity\office2k3.sft |
+ M:\productivity\office2k3.sft |
+ + |
M:\prodapps |
+ \\uncserver\share\productivity\office2k3.sft |
+ M:\prodapps\productivity\office2k3.sft |
+ + |
Symbol | +Description | +
---|---|
YYYY |
+ 4-digit year |
+
MM |
+ 2-digit month (01–12) |
+
DD |
+ 2-digit day of the month (01–31) |
+
hh |
+ hour (00–23) |
+
mm |
+ minutes (00–59) |
+
ss |
+ seconds (00–59) |
+
uuu |
+ milliseconds (000–999) |
+
Domain Functional Level | +Delegation Levels Available | +
---|---|
Windows 2000 native |
+
|
+
Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 |
+
|
+
Action | +Open for edit | +Open for upgrade | +
---|---|---|
View package properties. |
+Yes |
+Yes |
+
View package change history. |
+Yes |
+Yes |
+
View associated package files. |
+Yes |
+Yes |
+
Edit registry settings. |
+Yes |
+Yes |
+
Review additional package settings (except operating system file properties). |
+Yes |
+Yes |
+
Create associated Windows Installer (MSI). |
+Yes |
+Yes |
+
Modify OSD file. |
+Yes |
+Yes |
+
Compress and uncompress package. |
+Yes |
+Yes |
+
Add file type associations. |
+Yes |
+Yes |
+
Rename shortcuts. |
+Yes |
+Yes |
+
Set virtualized registry key state (override / merge). |
+Yes |
+Yes |
+
Set virtualized folder state. |
+Yes |
+Yes |
+
Edit virtual file system mappings. |
+Yes |
+Yes |
+
Review all associated operating system file properties for a package. |
+No |
+Yes |
+
Add additional services. |
+No |
+Yes |
+
Add additional files. |
+No |
+Yes |
+
Collect and configure associated security descriptors. |
+No |
+Yes |
+
Apply security updates or upgrade to a new version. |
+No |
+Yes |
+
Add an additional application. |
+No |
+Yes |
+
Apply updates that require the application to open. |
+No |
+Yes |
+
Apply updates that require the computer to restart. |
+No |
+Yes |
+
Application Type | +Description | +More Information | +
---|---|---|
Standard |
+Select this option to create a package that contains an application or a suite of applications. You should select this option for most applications that you plan to sequence. |
+[How to Sequence a New Standard Application (App-V 4.6 SP1)](how-to-sequence-a-new-standard-application--app-v-46-sp1-.md) |
+
Add-on or Plug-in |
+Select this option to create a package that extends the functionality of a standard application, for example, a plug-in for Microsoft Excel. Additionally, you can use plug-ins for natively installed applications, or another package that is linked by using Dynamic Suite Composition. For more information about Dynamic Suite Composition, see [How To Use Dynamic Suite Composition](http://go.microsoft.com/fwlink/?LinkId=203804) (http://go.microsoft.com/fwlink/?LinkId=203804). |
+[How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1)](how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md) |
+
Middleware |
+Select this option to create a package that is required by a standard application, for example, the Microsoft .NET Framework. Middleware packages are used for linking to other packages by using Dynamic Suite Composition. For more information about Dynamic Suite Composition, see [How To Use Dynamic Suite Composition](http://go.microsoft.com/fwlink/?LinkId=203804) (http://go.microsoft.com/fwlink/?LinkId=203804). |
+[How to Sequence a New Middleware Application (App-V 4.6 SP1)](how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md) |
+
Default Content Path | +OSD File CODEBASE HREF | +Resulting Value | +
---|---|---|
\\server\content\ |
+http://WebServer/myFolder/package.sft |
+\\server\content\myFolder\package.sft |
+
Version | +Product Code for Desktop Client | +Product Code for Client for Remote Desktop Services | +
---|---|---|
App-V 4.5 CU1 |
+FE495DBC-6D42-4698-B61F-86E655E0796D |
+8A97C241-D92A-47DC-B360-E716C1AAA929 |
+
App-V 4.5 SP1 |
+93468B43-C19D-44F9-8BCC-114076DB0443 |
+0042AD3C-99A4-4E58-B5F0-744D5AD96E1C |
+
App-V 4.5 SP2 |
+C6FC75B9-7D86-4C44-8BDB-EAFE1F0E200D |
+ECF80BBA-CA07-4A74-9ED6-E064F38AF1F5 |
+
App-V 4.6 x86 |
+9E9D30B2-2065-4FDE-B756-8F1A6EABAFC3 |
+439FAC21-B423-41D4-8126-54F9FCB70039 |
+
App-V 4.6 x64 |
+E569E45F-7BA6-4C7F-B6BA-3FFCBE92FC22 |
+D2977C18-D88A-47CB-AFD8-652DD36F4D0D |
+
App-V 4.6 x86 ¹ |
+40C3258B-F9D1-46DF-AE97-72C1F86F2427 |
+9915D911-CC73-4122-AF4F-564F89454655 |
+
App-V 4.6 x64 ¹ |
+1650E31F-23B8-40B5-A60A-C5934F557E3B |
+7580D918-C621-49E7-9877-3CC59F9BD1DA |
+
App-V 4.6 x86 SP1 |
+DB9F70CD-29BC-480B-8BA2-C9C2232C4553 |
+1354855A-2298-4C73-9022-EF0686C65991 |
+
App-V 4.6 x64 SP1 |
+342C9BB8-65A0-46DE-AB7A-8031E151AF69 |
+B2C6C8D5-FE76-4056-A326-EE5D633EA175 |
+
Value | +Description | +
---|---|
pathtoMSI |
+ Specifies the Windows Installer or a batch file that will be used to install an application so that it can be sequenced. |
+
pathtopackageroot |
+ Specify the package root directory. |
+
pathtodestinationSPRJ |
+ Specifies the path and file name of the SPRJ file that will be created. |
+
Value | +Description | +
---|---|
pathtoMSI |
+ Specifies the Windows Installer or a batch file that will be used to install an application so that it can be sequenced. |
+
pathtopackageroot |
+ Specifies the package root directory. |
+
pathtodestinationSPRJ |
+ Specifies the path and file name of the SPRJ file that will be created. |
+
Value | +Description | +
---|---|
pathtosourceSPRJ |
+ Specifies the directory location of the virtual application to be upgraded. |
+
pathtoUpgradeInstaller |
+ Specifies the Windows Installer or a batch file that will be used to install an upgrade to the application. |
+
pathtodecodefolder |
+ Specify the directory in which to unpack the SFT file. |
+
pathtodestinationSPRJ |
+ Specifies the path and file name of the SPRJ file that will be created. |
+
Value | +Description | +
---|---|
pathtosourceSPRJ |
+ Specifies the directory location of the virtual application to be upgraded. |
+
pathtoUpgradeInstaller |
+ Specifies the Windows Installer or a batch file that will be used to install an upgrade to the application. |
+
pathtodecodefolder |
+ Specify the directory in which to unpack the SFT file. |
+
pathtodestinationSPRJ |
+ Specifies the path and file name of the SPRJ file that will be created. |
+
Traffic Requirements from Internet to Perimeter Network | +Details | +
---|---|
RTSPS (publishing refresh and streaming packages) |
+TCP 322 by default; this can be changed in App-V Management Server. |
+
HTTPS (publishing ICO and OSD files and streaming packages) |
+TCP 443 by default; this can be changed in the IIS configuration. |
+
Traffic Requirements from Perimeter Network to Internal Network | +Details | +
---|---|
SQL Server |
+TCP 1433 is the default but can be configured in SQL Server. |
+
SMB/CIFS |
+If the content directory is located remotely from the Management Server(s) or IIS server (recommended). |
+
Kerberos |
+TCP and UDP 88 |
+
LDAP |
+TCP and UDP 389 |
+
DNS |
+For name resolution of internal resources (can be eliminated with the use of host’s file on perimeter network servers) |
+
Parameter | +Description | +
---|---|
APP:<application> |
+The name and version (optional) of the application to load. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
PACKAGE:<package-name> |
+The name of the package to load. |
+
/SFTPATH <sft-pathname> |
+If specified, the path to an SFT file to load from. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
APP:<application> |
+The name and version (optional) of the application to lock. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Log File Name | +Description | +
---|---|
sftlog.txt |
+Provides general information about App-V Client operations and errors. Use this log as a starting point for troubleshooting App-V Client errors. +Log file location for either the Desktop Client or the Client for Remote Desktop Services (formerly Terminal Services): +
|
+
Log File Name | +Description | +
---|---|
sft-seq-log.txt |
+Provides general information about sequencing an application. Use this log as a starting point for troubleshooting Sequencer errors. +Log file location: %windir%\Microsoft Application Virtualization Sequencer\Logs +[Template Token Value] App-V 4.6 log file location: %windir%\Program Files\Microsoft Application Virtualization Sequencer\Logs[Template Token Value] |
+
sftbt.txt |
+Provides information about computer restart tasks that occur during the Sequencer’s simulated restart. +Log file location: %windir%\Microsoft Application Virtualization Sequencer\Logs +[Template Token Value] App-V 4.6 log file location: %windir%\Program Files\Microsoft Application Virtualization Sequencer\Logs[Template Token Value] |
+
SftCallBack.txt |
+Provides general information about processes used during sequencing. +Log file location: %windir%\Microsoft Application Virtualization Sequencer\Logs +[Template Token Value] App-V 4.6 log file location: %windir%\Program Files\Microsoft Application Virtualization Sequencer\Logs[Template Token Value] |
+
Feature | +Function | +Additional Information | +
---|---|---|
Microsoft Application Virtualization Management Server |
+Responsible for streaming the package content and publishing the shortcuts and file type associations to the Application Virtualization client. |
+The Application Virtualization Management Server supports active upgrade, License Management, and a database that can be used for reporting. |
+
Content folder |
+Indicates the location of the Application Virtualization packages for streaming. |
+This folder can be located on a share on or off the Application Virtualization Management Server. |
+
Microsoft Application Virtualization Management Console |
+This console is an MMC 3.0 snap-in management tool used for Microsoft Application Virtualization Server administration. |
+This tool can be installed on the Microsoft Application Virtualization server or located on a separate workstation that has Microsoft Management Console (MMC) 3.0 and Microsoft .NET Framework 2.0 installed. |
+
Microsoft Application Virtualization Management Web Service |
+Responsible for communicating any read and write requests to the Application Virtualization data store. |
+The Management Web Service can be installed on the Microsoft Application Virtualization Management server or on a separate computer that has Microsoft Internet Information Services (IIS) installed. |
+
Microsoft Application Virtualization Data Store |
+The App-V SQL Server database responsible for storing all information related to the Application Virtualization infrastructure. |
+This information includes all application records, application assignments, and which groups have responsibility for managing the Application Virtualization environment. |
+
Microsoft Application Virtualization Streaming Server |
+Responsible for hosting the Application Virtualization packages for streaming to clients in a branch office, where the link back to the Application Virtualization Management Server is considered a wide area networks (WAN) connection. |
+This server contains streaming functionality only and provides neither the Application Virtualization Management Console nor the Application Virtualization Management Web Service. |
+
Microsoft Application Virtualization Sequencer |
+The sequencer is used to monitor and capture the installation of applications to create virtual application packages. |
+The output consists of the application’s icons, an .osd file that contains package definition information, a package manifest file, and the .sft file that contains the application program’s content files. |
+
Microsoft Application Virtualization Client |
+The Application Virtualization Desktop Client and the Application Virtualization Client for Remote Desktop Services provide and manage the virtual environment for the virtualized applications. |
+The Microsoft Application Virtualization client manages the package streaming into cache, publishing refresh, transport, and all interaction with the Application Virtualization servers. |
+
Component | +Function | +Additional Information | +
---|---|---|
Microsoft Application Virtualization Management Server |
+The component responsible for streaming the package content and publishing the shortcuts and file type associations to the Application Virtualization Client. |
+The Application Virtualization Management Server supports active upgrade, License Management, and a database that can be used for reporting. |
+
Content folder |
+The location of the Application Virtualization packages for streaming. |
+This folder can be located on a share on or off the Application Virtualization Management Server. The folder can also be located on a Storage Area Network (SAN). |
+
Microsoft Application Virtualization Management Console |
+An MMC 3.0 snap-in management utility for Microsoft Application Virtualization Server administration. |
+This component can be installed on the Microsoft Application Virtualization server or located on a separate workstation that has MMC 3.0 and .NET 2.0 installed. |
+
Microsoft Application Virtualization Management Web Service |
+The component responsible for communicating any read/write requests to the Application Virtualization data store. |
+This component can installed on the Microsoft Application Virtualization Server or on a separate computer with IIS installed. |
+
Microsoft Application Virtualization Data Store |
+The component stored in the SQL database and responsible for storing all information related to the Application Virtualization infrastructure. |
+This information includes all application records, application assignments, and which groups have responsibility for managing the Application Virtualization environment. |
+
Microsoft Application Virtualization Streaming Server |
+The component responsible for hosting the Application Virtualization packages for streaming to clients in a branch office, where the link back to the Application Virtualization Management Server is considered a WAN. |
+This server contains streaming functionality only and provides neither the Application Virtualization Management Console nor the Application Virtualization Management Web Service. |
+
Microsoft Application Virtualization Sequencer |
+The component used to monitor and capture the installation of applications to create virtual application packages. |
+Output consists of the application’s icons, an OSD file containing package definition information, a package manifest file, and the SFT file containing the application program’s content files. |
+
Microsoft Application Virtualization Client |
+The component installed on the Application Virtualization Desktop Client or on the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services) and that provides the virtual environment for the virtualized applications. |
+The Microsoft Application Virtualization Client manages the package streaming into cache, publishing refresh, transport, and all interaction with the Application Virtualization Servers. |
+
Column | +Contents | +
---|---|
Number |
+Displays the package icon and the version number. |
+
Package File |
+Displays the name of the application file (SFT). |
+
Date Added |
+Displays the date and time the package was added to the server. |
+
Version GUID |
+Displays the version GUID. |
+
OS Value | +
---|
<OS VALUE=”Win2003TS”/> |
+
<OS VALUE=”Win2003TS64”/> |
+
<OS VALUE=”Win2008TS”/> |
+
<OS VALUE=”Win2008TS64”/> |
+
<OS VALUE=”Win2008R2TS64”/> |
+
<OS VALUE=”Win7”/> |
+
<OS VALUE=”Win764”/> |
+
<OS VALUE=”WinVista”/> |
+
<OS VALUE=”WinVista64”/> |
+
<OS VALUE=”WinXP”/> |
+
<OS VALUE=”WinXP64”/> |
+
+ | Sequenced by using the App-V 4.2 Sequencer | +Sequenced by using the App-V 4.5 Sequencer | +Sequenced by using the 32-bit App-V 4.6 Sequencer | +Sequenced by using the 64-bit App-V 4.6 Sequencer | +Sequenced by using the 32-bit App-V 4.6 SP1 Sequencer | +Sequenced by using the 64-bit App-V 4.6 SP1 Sequencer | +
---|---|---|---|---|---|---|
4.2 Client |
+Yes |
+No |
+No |
+No |
+No |
+No |
+
4.5 Client ¹ |
+Yes |
+Yes |
+No |
+No |
+No |
+No |
+
4.6 Client (32-bit) |
+Yes |
+Yes |
+Yes |
+No |
+Yes |
+No |
+
4.6 Client (64-bit) |
+Yes |
+Yes |
+Yes |
+Yes |
+Yes |
+Yes |
+
4.6 SP1 Client |
+Yes |
+Yes |
+Yes |
+No |
+Yes |
+No |
+
4.6 SP1 Client (64-bit) |
+Yes |
+Yes |
+Yes |
+Yes |
+Yes |
+Yes |
+
Server Type | +Protocol | +Advantages | +Disadvantages | +Links | +
---|---|---|---|---|
File server |
+SMB |
+
|
+
|
+[How to Configure the File Server](how-to-configure-the-file-server.md) |
+
IIS server |
+HTTP/ HTTPS |
+
|
+
|
+[How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md) |
+
Application Virtualization Streaming Server |
+RTSP/ RTSPS |
+
|
+
|
+[How to Configure the Application Virtualization Streaming Servers](how-to-configure-the-application-virtualization-streaming-servers.md) |
+
Application Virtualization Management Server |
+RTSP/ RTSPS |
+
|
+
|
+[How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md) |
+
Server Type | +Protocol | +Advantages | +Disadvantages | +Links | +
---|---|---|---|---|
File server |
+SMB |
+
|
+
|
+[How to Configure the File Server](how-to-configure-the-file-server.md) |
+
IIS server |
+HTTP/ HTTPS |
+
|
+
|
+[How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md) |
+
Application Virtualization Streaming Server |
+RTSP/ RTSPS |
+
|
+
|
+[How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md) |
+
Column | +Contents | +
---|---|
Name |
+This column displays the name of the provider policy. |
+
Parameter | +Description | +
---|---|
APPLICATION:<application> |
+The name and version (optional) of the application. |
+
/DESKTOP |
+Publishes a shortcut to the user's desktop. |
+
/START |
+Publishes a shortcut to the Application Virtualization Applications folder in the Programs folder of the Start menu. |
+
/TARGET <target-path> |
+The absolute path where the shortcut should be published. |
+
/ICON <icon-pathname> |
+The path or URL for the icon file. |
+
/DISPLAY <display-name> |
+The display name for the shortcut. |
+
/ARGS <command-args> |
+Parameters to be passed to the application. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
PACKAGE:<package-name> |
+User-visible and user-friendly name for the package. |
+
/MANIFEST <manifest-path> |
+The path or URL of the manifest file that lists the applications included in the package and all of their publishing information. |
+
/GLOBAL |
+If present, the package will be available for all users on this computer. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
APP |
+Returns a list of applications. |
+
PACKAGE |
+Returns a list of packages. |
+
TYPE |
+Returns a list of file type associations. |
+
SERVER |
+Returns a list of publishing servers. |
+
/SHORT |
+Without displaying the full properties of each, returns a list of application names, packages, associations, or server names. |
+
/GLOBAL |
+For applications, returns all known applications instead of only the ones the current user has access to. For packages, returns all known packages instead of only the ones the current user has access to. For associations, returns only associations that apply to all users, not user-specific ones. Not valid for servers. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
/NO-UPDATE-FTA-SHORTCUT |
+Indicates the current state of the /NO-UPDATE-FTA-SHORTCUT flag. |
+
Parameter | +Description | +
---|---|
SERVER:<server-name> |
+The display name of the server. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
APP:<application> |
+The name and version (optional) of the application. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Column | +Contents | +
---|---|
Report Name |
+This column displays the report name. |
+
Report Type |
+This column displays the report type. |
+
Period Type |
+This column displays the frequency with which Application Virtualization generates the report. |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows XP |
+Professional |
+SP2 or SP3 |
+x86 |
+
Windows Vista |
+Business, Enterprise, or Ultimate |
+No service pack, SP1, or SP2 |
+x86 |
+
Windows 7¹ |
+Professional, Enterprise, or Ultimate |
++ | x86 |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows Server 2003 |
+Standard Edition, Enterprise Edition, or Datacenter Edition |
+SP1 or SP2 |
+x86 |
+
Windows Server 2003 R2 |
+Standard Edition, Enterprise Edition, or Datacenter Edition |
++ | x86 |
+
Windows Server 2008 |
+Standard, Enterprise, or Datacenter |
+SP1 or SP2 |
+x86 |
+
Column | +Contents | +
---|---|
Name |
+Displays the name of the server group. |
+
Column | +Contents | +
---|---|
Name |
+Displays the name of the virtual application server. |
+
Host Name |
+Displays the DNS host name for the virtual application server. |
+
Switch | +Description | +
---|---|
/HIDE |
+Hides the SFTTRAY icon in the Windows notification area. |
+
/SHOW |
+Displays the SFTTRAY icon in the Windows notification area. |
+
/QUIET |
+Supports unattended usage by preventing errors from displaying message boxes that require user acknowledgement. |
+
/EXE <alternate-exe> |
+Used with /LAUNCH to specify that an executable program is to be started in the virtual environment when a virtual application is started in place of the target file specified in the OSD. +
+Note
+
+For example, use “SFTTRAY.EXE /EXE REGEDIT.EXE /LAUNCH <app>” to enable you to examine the registry of the virtual environment in which the application is running. +
+
+ |
+
/LAUNCH <app> [<args>] |
+Starts a virtual application. Specify the name and version of an application or the path to an OSD file. Optionally, command-line arguments can be passed to the virtual application. +
+Note
+
+Use the command “SFTMIME.EXE /QUERY OBJ:APP /SHORT” to obtain a list of the names and versions of available virtual applications. +
+
+ |
+
/LOAD |
+Loads or imports a virtual application. |
+
/LOADALL |
+Loads all applications into cache. |
+
/REFRESHALL |
+Starts a publishing refresh for all applications. |
+
/LAUNCHRESULT <UNIQUE ID> |
+Returns the launch result code to the process that launches sfttray.exe by using a global event and a memory mapped file that are based on the specified root name for the UNIQUE ID.¹ |
+
/SFTFILE <sft> |
+Optional switch used with /LOAD to specify the path to the application’s SFT file. If specified, the application is imported rather than loaded. |
+
/EXIT |
+Closes the SFTTRAY program and all active virtual applications and removes the icon from the Windows notification area. |
+
Parameter | +Description | +
---|---|
APP:<application> |
+The name and version (optional) of the application to unload. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
PACKAGE:<package-name> |
+The name of the package to unload. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
APP:<application> |
+The name and version (optional) of the application to unlock. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Parameter | +Description | +
---|---|
PACKAGE:<package-name> |
+The name of the package. |
+
/CLEAR |
+If present, user settings will also be removed. (For more information, see the Important note later in this topic.) |
+
/GLOBAL |
+If present, the package will be unpublished for all users on this computer. |
+
/LOG |
+If specified, output is logged to the specified path name. |
+
/CONSOLE |
+If specified, output is presented in the active console window (default). |
+
/GUI |
+If specified, output is presented in a Windows dialog box. |
+
/LOGU |
+If specified, output is logged to the specified path name in UNICODE format. |
+
Permission Name | +Description | +
---|---|
Add applications |
+Register new applications by passing a new OSD file to the client by using sfttray.exe, sftmime.exe or the MMC. |
+
Change file system cache size |
+Increase the size of the file system cache. |
+
Change file system drive |
+Select a different preferred drive letter for the file system. |
+
Change log settings |
+Change the log level or the log path for the client log file. |
+
Change OSD files |
+Modify OSD files for registered applications and pass them into the client. This does not affect publishing refresh. |
+
Clear application settings |
+Delete file types, shortcuts and any configurations for the current user. |
+
Delete applications |
+Remove all references to an application from the file system and OSD cache for all users on the computer. |
+
Import applications into the cache |
+Load application data directly from a specified SFT file into the file system cache. This affects all users. |
+
Load applications into the cache |
+Start a load of the SFT file for an application from the configured source, such as an App-V Streaming Server. This loads the application for all users on the computer. |
+
Lock and unlock applications in the cache |
+Prevent or allow applications from being unloaded from the file system cache. This affects all users on the computer. |
+
Manage file type associations |
+Add, modify, or delete file type associations for the current user only. |
+
Manage publishing refresh settings |
+Change settings that control the timing of publishing refreshes for all users on the computer. |
+
Manage publishing servers |
+Add, modify, or delete publishing servers for all users on the computer. This permission implicitly includes permission to manage publishing refresh settings. |
+
Publish shortcuts |
+Create new shortcuts to registered applications. The user must also have permission to create files in the local file system. |
+
Repair applications |
+Remove application specific configurations for the current user without removing shortcuts or file type associations. |
+
Start a publishing refresh |
+Start an unscheduled publishing refresh for the current user. |
+
Toggle offline mode |
+Change the entire client from online to offline mode for all users. |
+
Unload applications from the cache |
+Clear application data from the file system cache for all users without removing user-specific settings, shortcuts, or file type associations. |
+
View all applications |
+Allow the user to see the virtual applications for all users registered on the computer. |
+
User Configuration .xml file |
+
Deployment Configuration .xml file |
+
Package Manifest |
+
Script Execution Time | +Can be specified in Deployment Configuration | +Can be specified in User Configuration | +Can run in the Virtual Environment of the package | +Can be run in the context of a specific application | +Runs in system/user context: (Deployment Configuration, User Configuration) | +
---|---|---|---|---|---|
AddPackage |
+X |
++ | + | + | (SYSTEM, N/A) |
+
PublishPackage |
+X |
+X |
++ | + | (SYSTEM, User) |
+
UnpublishPackage |
+X |
+X |
++ | + | (SYSTEM, User) |
+
RemovePackage |
+X |
++ | + | + | (SYSTEM, N/A) |
+
StartProcess |
+X |
+X |
+X |
+X |
+(User, User) |
+
ExitProcess |
+X |
+X |
++ | X |
+(User, User) |
+
StartVirtualEnvironment |
+X |
+X |
+X |
++ | (User, User) |
+
TerminateVirtualEnvironment |
+X |
+X |
++ | + | (User, User) |
+
Question | +More Information | +
---|---|
What is the frequency that reporting information is sent to the reporting database? |
+The frequency depends on how the reporting task is configured on the computer running the App-V 5.0 client. You must configure the frequency / interval for sending the reporting data. App-V 5.0 Reporting is not enabled by default. |
+
What information is stored in the reporting server database? |
+The following list displays what is stored in the reporting database: +
|
+
What is the average volume of information that is sent to the reporting server? |
+It depends. The following list displays the three sets of the data sent to the reporting server: +
|
+
Can reporting be scheduled? |
+Yes. Besides manually sending reporting using PowerShell Cmdlets (Send-AppvClientReport), the task can be scheduled so it will happen automatically. There are two ways to schedule the reporting: +
|
+
Client Information | +Package Information | +Application Usage | +
---|---|---|
Host Name |
+Package Name |
+Start and End Times |
+
App-V 5.0 Client Version |
+Package Version |
+Run Status |
+
Processor Architecture |
+Package Source |
+Shutdown State |
+
Operating System Version |
+Percent Cached |
+Application Name |
+
Service Pack Level |
++ | Application Version |
+
Operating System Type |
++ | Username |
+
+ | + | Connection Group |
+
With a Reporting Server | +Without a Reporting Server | +
---|---|
If you have an existing App-V 5.0 reporting Server, create a customized scheduled task or script. Specify that the client send the data to the specified location with the desired frequency. |
+If you do not have an existing App-V 5.0 reporting Server, use the –URL parameter to send the data to a specified share. For example: +
The previous example will send the reporting data to \\MyShare\MyData\ location indicated by the -URL parameter. After the data has been sent, the cache is cleared. +
+Note
+
+If a location other than the Reporting Server is specified, the data is sent using .xml format with no additional processing. +
+
+ |
+
Task type | +Applicable rule | +
---|---|
User-based task, e.g., publishing a package to a user |
+The pending task will be performed after the user logs off and then logs back on. |
+
Globally based task, e.g., enabling a connection group globally |
+The pending task will be performed when the computer is shut down and then restarted. |
+
User-based or globally based task | +Where the registry key is generated | +
---|---|
User-based tasks |
+KEY_CURRENT_USER\Software\Microsoft\AppV\Client\PendingTasks |
+
Globally based tasks |
+HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\PendingTasks |
+
Links to prerequisites and supported configurations | +Description | +
---|---|
[App-V 5.0 SP3 Prerequisites](app-v-50-sp3-prerequisites.md) |
+Prerequisite software that you must install before starting the App-V 5.0 SP3 installation |
+
[App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md) |
+Supported operating systems and hardware requirements for the App-V Server, Sequencer, and Client components |
+
Items to review before upgrading | +Description | +
---|---|
Components to upgrade |
+
+Note
+
+To use the App-V client user interface, download the existing version from [Microsoft Application Virtualization 5.0 Client UI Application](http://www.microsoft.com/download/details.aspx?id=41186). +
+
+ |
+
Upgrading from App-V 4.x |
+You must first upgrade to App-V 5.0. You cannot upgrade directly from App-V 4.x to App-V 5.0 SP3. +For more information, see: +
|
+
Upgrading from App-V 5.0 or later |
+You can upgrade to App-V 5.0 SP3 directly from any of the following versions: +
To upgrade to App-V 5.0 SP3, follow the steps in the remaining sections of this article. |
+
Required changes to packages and connection groups after upgrade |
+None. Packages and connection groups will continue to work as they currently do. |
+
Step | +For more information | +||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Step 1: Upgrade the App-V Server. +If you are not using the App-V Server, skip this step and go to the next step. +
+Note
+
+The App-V 5.0 SP3 client is compatible with the App-V 5.0 SP1 Server. +
+
+ |
+Follow these steps: +
|
+||||||||||
Step 2: Upgrade the App-V Sequencer. |
+See [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md). |
+||||||||||
Step 3: Upgrade the App-V client or App-V RDS client. |
+See [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md). |
+
When this step is required |
+You are upgrading from App-V SP1 with any subsequent Hotfix Packages that you installed by using an .msp file. |
+
Which components require that you do this step |
+Only the App-V Server components that you are upgrading. |
+
When you need to do this step |
+Before you upgrade the App-V Server to App-V 5.0 SP3 |
+
What you need to do |
+Using the information in the following tables, update each registry key value under |
+
Key name | +Description | +
---|---|
IS_MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED |
+Describes whether a public access account is required to access non-local management databases. Value is set to “1” if it is required. |
+
MANAGEMENT_DB_NAME |
+Name of the Management database. |
+
MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT |
+Account used for read (public) access to the Management database. +Used when |
+
MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_SID |
+Secure identifier (SID) of the account used for read (public) access to the Management database. +Used when |
+
MANAGEMENT_DB_SQL_INSTANCE |
+SQL Server instance for the Management database. +If the value is blank, the default database instance is used. |
+
MANAGEMENT_DB_WRITE_ACCESS_ACCOUNT |
+Account used for write (administrator) access to the Management database. |
+
MANAGEMENT_DB_WRITE_ACCESS_ACCOUNT_SID |
+Secure identifier (SID) of the account used for write (administrator) access to the Management database. |
+
MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT |
+Management server remote computer account (domain\account). |
+
MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT |
+Installation administrator login for the Management server (domain\account). |
+
MANAGEMENT_SERVER_MACHINE_USE_LOCAL |
+Valid values are: +
|
+
Key name | +Description | +
---|---|
MANAGEMENT_ADMINACCOUNT |
+Active Directory Domain Services (AD DS) group or account that is authorized to manage App-V (domain\account). |
+
MANAGEMENT_DB_SQL_INSTANCE |
+SQL server instance that contains the Management database. +If the value is blank, the default database instance is used. |
+
MANAGEMENT_DB_SQL_SERVER_NAME |
+Name of the remote SQL server with the Management database. +If the value is blank, the local computer is used. |
+
Key name | +Description | +
---|---|
IS_REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED |
+Describes whether a public access account is required to access non-local reporting databases. Value is set to “1” if it is required. |
+
REPORTING_DB_NAME |
+Name of the Reporting database. |
+
REPORTING_DB_PUBLIC_ACCESS_ACCOUNT |
+Account used for read (public) access to the Reporting database. +Used when |
+
REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_SID |
+Secure identifier (SID) of the account used for read (public) access to the Reporting database. +Used when |
+
REPORTING_DB_SQL_INSTANCE |
+SQL Server instance for the Reporting database. +If the value is blank, the default database instance is used. |
+
REPORTING_DB_WRITE_ACCESS_ACCOUNT |
++ |
REPORTING_DB_WRITE_ACCESS_ACCOUNT_SID |
++ |
REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT |
+Reporting server remote computer account (domain\account). |
+
REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT |
+Installation administrator login for the Reporting server (domain\account). |
+
REPORTING_SERVER_MACHINE_USE_LOCAL |
+Valid values are: +
|
+
Key name | +Description | +
---|---|
REPORTING_DB_SQL_INSTANCE |
+SQL Server instance for the Reporting database. +If the value is blank, the default database instance is used. |
+
REPORTING_DB_SQL_SERVER_NAME |
+Name of the remote SQL server with the Reporting database. +If the value is blank, the local computer is used. |
+
Task/feature | +Description | +Links to more information | +||||||||
---|---|---|---|---|---|---|---|---|---|---|
Enable a connection group to include optional packages |
+Including optional packages in a connection group enables you to dynamically determine which applications will be included in the connection group’s virtual environment, based on the applications that users are entitled to. +You don’t need to manage as many connection groups because you can mix optional and non-optional packages in the same connection group. Mixing packages allows different groups of users to use the same connection group, even though users might have only one package in common. +Example: You can enable a package with Microsoft Office for all users, but enable different optional packages, which contain different Office plug-ins, to different subsets of users. |
+[How to Use Optional Packages in Connection Groups](how-to-use-optional-packages-in-connection-groups.md#bkmk-apps-plugs-optional) |
+||||||||
Unpublish or delete an optional package without changing the connection group |
+Unpublish or delete, or unpublish and republish an optional package, which is in a connection group, without having to disable or re-enable the connection group on the App-V client. |
+[How to Use Optional Packages in Connection Groups](how-to-use-optional-packages-in-connection-groups.md#bkmk-apps-plugs-optional) |
+||||||||
Publish connection groups that contain user-published and globally published packages |
+Create a user-published connection group that contains user-published and globally published packages. |
+[How to Create a Connection Group with User-Published and Globally Published Packages](how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md) |
+||||||||
Make a connection group ignore the package version |
+Configure a connection group to accept any version of a package, which enables you to upgrade a package without having to disable the connection group. In addition, if there is an optional package with an incorrect version in the connection group, the package is ignored and won’t block the connection group’s virtual environment from being created. |
+[How to Make a Connection Group Ignore the Package Version](how-to-make-a-connection-group-ignore-the-package-version.md) |
+||||||||
Limit end users’ publishing capabilities |
+Enable only administrators (not end users) to publish packages and to enable connection groups. |
+For information about connection groups, see [How to Allow Only Administrators to Enable Connection Groups](how-to-allow-only-administrators-to-enable-connection-groups.md) +For information about packages, see the following articles: +
|
+||||||||
Enable or disable a connection group for a specific user |
+Administrators can enable or disable a connection group for a specific user by using the optional –UserSID parameter with the following cmdlets: +
|
+[How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md#bkmk-enable-cg-for-user-poshtopic) |
+||||||||
Merging identical package paths into one virtual directory in connection groups |
+If two or more packages in a connection group contain identical directory paths, the paths are merged into a single virtual directory inside the connection group virtual environment. +This merging of paths allows an application in one package to access files that are in a different package. |
+[About the Connection Group Virtual Environment](about-the-connection-group-virtual-environment.md#bkmk-merged-root-ve-exp) |
+
Cmdlet | +Examples | +
---|---|
Publish-AppvClientPackage |
+Publish-AppvClientPackage “ContosoApplication” -UserSID S-1-2-34-56789012-3456789012-345678901-2345 |
+
Unpublish-AppvClientPackage |
+Unpublish-AppvClientPackage “ContosoApplication” -UserSID S-1-2-34-56789012-3456789012-345678901-2345 |
+
Method | +More information | +
---|---|
Group Policy setting |
+Navigate to the following Group Policy Object node: +Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing. +Enable the Require publish as administrator Group Policy setting. |
+
PowerShell |
+[How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-admins-pub-pkgs) |
+
Cmdlet | +Description | +
---|---|
Add-AppvServerConnectionGroupPackage |
+Appends a package to the end of a connection group's package list and enables you to configure the package as optional and/or with no version within the connection group. |
+
Set-AppvServerConnectionGroupPackage |
+Enables you to edit details about the connection group package, such as whether it is optional. |
+
Remove-AppvServerConnectionGroupPackage |
+Removes a package from a connection group. |
+
Format | +Description | +||||||||
---|---|---|---|---|---|---|---|---|---|
As a downloadable module |
+To get the latest help after downloading the cmdlet module: +
|
+||||||||
On TechNet as web pages |
+See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](http://technet.microsoft.com/library/dn520245.aspx). |
+
Method | +Steps | +
---|---|
Use a command line parameter |
+Pass the –EnablePVADControl parameter to the Sequencer.exe. |
+
Create a registry subkey |
+
|
+
Value | +Additional details | +
---|---|
ClientVersion |
+If you omit the ClientVersion parameter from the query, the metadata excludes the new App-V 5.0 SP3 features. |
+
ClientOS |
+You have to provide this value only if you select specific client operating systems when you sequence the package. If you select the default (all operating systems), do not specify this value in the query. +If you omit the ClientOS parameter from the query, only the packages that were sequenced to support any operating system appear in the metadata. |
+
App-V 4.6 | +App-V 5.0 | +
---|---|
Must Use a dedicated drive letter (Q:\). |
+No dedicated drive letter required. |
+
4 GB package size limit requirement. |
+No 4 GB package size limit requirement. |
+
Virtual applications are isolated from locally installed applications. |
+Virtual applications can be extended to support local application interaction. |
+
Dynamic Suite Composition enabled interaction with middleware applications. |
+Peer applications are shared using connection groups. For more information about connection groups see, [Managing Connection Groups](managing-connection-groups.md). |
+
VDI/RDS environments required a read-only shared cache. |
+You can update the shared content store using the standard workflow. |
+
Limited command-line scripting. |
+Supports robust PowerShell scripting for the sequencer, client, and server components. |
+
+ | Provides web-based management capabilities. |
+
User Configuration .xml file |
+
Deployment Configuration .xml file |
+
Package Manifest |
+
Script Execution Time | +Can be specified in Deployment Configuration | +Can be specified in User Configuration | +Can run in the Virtual Environment of the package | +Can be run in the context of a specific application | +Runs in system/user context: (Deployment Configuration, User Configuration) | +
---|---|---|---|---|---|
AddPackage |
+X |
++ | + | + | (SYSTEM, N/A) |
+
PublishPackage |
+X |
+X |
++ | + | (SYSTEM, User) |
+
UnpublishPackage |
+X |
+X |
++ | + | (SYSTEM, User) |
+
RemovePackage |
+X |
++ | + | + | (SYSTEM, N/A) |
+
StartProcess |
+X |
+X |
+X |
+X |
+(User, User) |
+
ExitProcess |
+X |
+X |
++ | X |
+(User, User) |
+
StartVirtualEnvironment |
+X |
+X |
+X |
++ | (User, User) |
+
TerminateVirtualEnvironment |
+X |
+X |
++ | + | (User, User) |
+
Parameter in the example file | +Description | +
---|---|
|
+Name of the event trigger for which you are running a script, such as adding a package or publishing a package. |
+
|
+The script launcher application that is installed as part of the App-V client installation. +
+Note
+
+Although ScriptRunner.exe is installed as part of the App-V client, the location of the App-V client must be in %path% or ScriptRunner will not run. ScriptRunner.exe is typically located in the C:\Program Files\Microsoft Application Virtualization\Client folder. +
+
+ |
+
|
+
|
+
|
+Waits for overall completion of ScriptRunner.exe. +Set the timeout value for the overall runner to be greater than or equal to the sum of the timeout values on the individual scripts. +If any individual script reported an error and rollbackonerror was set to |
+
Question | +More Information | +
---|---|
What is the frequency that reporting information is sent to the reporting database? |
+The frequency depends on how the reporting task is configured on the computer running the App-V 5.1 client. You must configure the frequency / interval for sending the reporting data. App-V 5.1 Reporting is not enabled by default. |
+
What information is stored in the reporting server database? |
+The following list displays what is stored in the reporting database: +
|
+
What is the average volume of information that is sent to the reporting server? |
+It depends. The following list displays the three sets of the data sent to the reporting server: +
|
+
Can reporting be scheduled? |
+Yes. Besides manually sending reporting using PowerShell Cmdlets (Send-AppvClientReport), the task can be scheduled so it will happen automatically. There are two ways to schedule the reporting: +
|
+
Client Information | +Package Information | +Application Usage | +
---|---|---|
Host Name |
+Package Name |
+Start and End Times |
+
App-V 5.1 Client Version |
+Package Version |
+Run Status |
+
Processor Architecture |
+Package Source |
+Shutdown State |
+
Operating System Version |
+Percent Cached |
+Application Name |
+
Service Pack Level |
++ | Application Version |
+
Operating System Type |
++ | Username |
+
+ | + | Connection Group |
+
With a Reporting Server | +Without a Reporting Server | +
---|---|
If you have an existing App-V 5.1 reporting Server, create a customized scheduled task or script. Specify that the client send the data to the specified location with the desired frequency. |
+If you do not have an existing App-V 5.1 reporting Server, use the –URL parameter to send the data to a specified share. For example: +
The previous example will send the reporting data to \\MyShare\MyData\ location indicated by the -URL parameter. After the data has been sent, the cache is cleared. +
+Note
+
+If a location other than the Reporting Server is specified, the data is sent using .xml format with no additional processing. +
+
+ |
+
Links to prerequisites and supported configurations | +Description | +
---|---|
[App-V 5.1 Prerequisites](app-v-51-prerequisites.md) |
+Prerequisite software that you must install before starting the App-V 5.1 installation |
+
[App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md) |
+Supported operating systems and hardware requirements for the App-V Server, Sequencer, and Client components |
+
Items to review before upgrading | +Description | +
---|---|
Components to upgrade, in any order |
+
+Note
+
+To use the App-V client user interface, download the existing version from [Application Virtualization 5.0 Client UI Application](http://www.microsoft.com/download/details.aspx?id=41186). +
+
+ |
+
Upgrading from App-V 4.x |
+For more information, see: +
|
+
Upgrading from App-V 5.0 or later |
+You can upgrade to App-V 5.1 directly from any of the following versions: +
To upgrade to App-V 5.1, follow the steps in the remaining sections of this topic. +Packages and connection groups will continue to work with App-V 5.1 as they currently do. |
+
Step | +For more information | +
---|---|
Step 1: Upgrade the App-V Server. +
+Note
+
+If you are not using the App-V Server, skip this step and go to the next step. +
+
+ |
+See [How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md) |
+
Step 2: Upgrade the App-V Sequencer. |
+See [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md). |
+
Step 3: Upgrade the App-V Client or App-V RDS Client. |
+See [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md). |
+
Component | +App-V 5.1 | +App-V 5.0 | +
---|---|---|
App-V Client |
+Yes |
+No |
+
App-V RDS Client |
+Yes |
+No |
+
App-V Sequencer |
+Yes |
+No |
+
New in App-V 5.1 | +Prior to App-V 5.1 | +
---|---|
Number of messages indicator: +On the title bar of the App-V Management Console, a number is now displayed next to a flag icon to indicate the number of messages that are waiting to be read. |
+You could see only one message or error at a time, and you were unable to determine how many messages there were. |
+
Message appearance: +
|
+You could see only one message or error at a time. |
+
Dismissing messages: +Use the Dismiss All link to dismiss all messages and errors at one time, or dismiss them one at a time. |
+You could dismiss messages and errors only one at a time. |
+
New in App-V 5.1 | +Prior to App-V 5.1 | +
---|---|
Each page in the console has a different URL, which enables you to bookmark specific pages for quick access in the future. +The number that appears in some URLs indicates the specific package. These numbers are unique. |
+All console pages are accessed through the same URL. |
+
New in App-V 5.1 | +Prior to App-V 5.1 | +
---|---|
The CONNECTION GROUPS page is now part of the main menu, at the same level as the PACKAGES page. |
+To open the CONNECTION GROUPS page, you navigate through the PACKAGES page. |
+
New in App-V 5.1 | +Prior to App-V 5.1 | +
---|---|
The following options are now buttons that appear at the bottom of the PACKAGES page: +
The following options will still appear when you right-click a package to open the drop-down context menu: +
When you click Delete to remove a package, a dialog box opens and asks you to confirm that you want to delete the package. |
+The Add or Upgrade option was a button at the top right of the PACKAGES page. +The Publish, Unpublish, and Delete options were available only if you right-clicked a package name in the packages list. |
+
The following package operations are now buttons on the package details page for each package: +
|
+These package options were available only if you right-clicked a package name in the packages list. |
+
Setting Name | +Setup Flag | +Description | +Setting Options | +Registry Key Value | +Disabled Policy State Keys and Values | +
---|---|---|---|---|---|
PackageInstallationRoot |
+PACKAGEINSTALLATIONROOT |
+Specifies directory where all new applications and updates will be installed. |
+String |
+Streaming\PackageInstallationRoot |
+Policy value not written (same as Not Configured) |
+
PackageSourceRoot |
+PACKAGESOURCEROOT |
+Overrides source location for downloading package content. |
+String |
+Streaming\PackageSourceRoot |
+Policy value not written (same as Not Configured) |
+
AllowHighCostLaunch |
+Not available. |
+This setting controls whether virtualized applications are launched on Windows 8 machines connected via a metered network connection (For example, 4G). |
+True (enabled); False (Disabled state) |
+Streaming\AllowHighCostLaunch |
+0 |
+
ReestablishmentRetries |
+Not available. |
+Specifies the number of times to retry a dropped session. |
+Integer (0-99) |
+Streaming\ReestablishmentRetries |
+Policy value not written (same as Not Configured) |
+
ReestablishmentInterval |
+Not available. |
+Specifies the number of seconds between attempts to reestablish a dropped session. |
+Integer (0-3600) |
+Streaming\ReestablishmentInterval |
+Policy value not written (same as Not Configured) |
+
AutoLoad |
+AUTOLOAD |
+Specifies how new packages should be loaded automatically by App-V on a specific computer. |
+(0x0) None; (0x1) Previously used; (0x2) All |
+Streaming\AutoLoad |
+Policy value not written (same as Not Configured) |
+
LocationProvider |
+Not available. |
+Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface. |
+String |
+Streaming\LocationProvider |
+Policy value not written (same as Not Configured) |
+
CertFilterForClientSsl |
+Not available. |
+Specifies the path to a valid certificate in the certificate store. |
+String |
+Streaming\CertFilterForClientSsl |
+Policy value not written (same as Not Configured) |
+
VerifyCertificateRevocationList |
+Not available. |
+Verifies Server certificate revocation status before steaming using HTTPS. |
+True(enabled); False(Disabled state) |
+Streaming\VerifyCertificateRevocationList |
+0 |
+
SharedContentStoreMode |
+SHAREDCONTENTSTOREMODE |
+Specifies that streamed package contents will be not be saved to the local hard disk. |
+True(enabled); False(Disabled state) |
+Streaming\SharedContentStoreMode |
+0 |
+
Name +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+PUBLISHINGSERVERNAME |
+Displays the name of publishing server. |
+String |
+Publishing\Servers\{serverId}\FriendlyName |
+Policy value not written (same as Not Configured) |
+
URL +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+PUBLISHINGSERVERURL |
+Displays the URL of publishing server. |
+String |
+Publishing\Servers\{serverId}\URL |
+Policy value not written (same as Not Configured) |
+
GlobalRefreshEnabled +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+GLOBALREFRESHENABLED |
+Enables global publishing refresh (Boolean) |
+True(enabled); False(Disabled state) |
+Publishing\Servers\{serverId}\GlobalEnabled |
+False |
+
GlobalRefreshOnLogon +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+GLOBALREFRESHONLOGON |
+Triggers a global publishing refresh on logon. ( Boolean) |
+True(enabled); False(Disabled state) |
+Publishing\Servers\{serverId}\GlobalLogonRefresh |
+False |
+
GlobalRefreshInterval +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+GLOBALREFRESHINTERVAL |
+Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0. |
+Integer (0-744 |
+Publishing\Servers\{serverId}\GlobalPeriodicRefreshInterval |
+0 |
+
GlobalRefreshIntervalUnit +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+GLOBALREFRESHINTERVALUNI |
+Specifies the interval unit (Hour 0-23, Day 0-31). |
+0 for hour, 1 for day |
+Publishing\Servers\{serverId}\GlobalPeriodicRefreshIntervalUnit |
+1 |
+
UserRefreshEnabled +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+USERREFRESHENABLED |
+Enables user publishing refresh (Boolean) |
+True(enabled); False(Disabled state) |
+Publishing\Servers\{serverId}\UserEnabled |
+False |
+
UserRefreshOnLogon +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+USERREFRESHONLOGON |
+Triggers a user publishing refresh onlogon. ( Boolean) +Word count (with spaces): 60 |
+True(enabled); False(Disabled state) |
+Publishing\Servers\{serverId}\UserLogonRefresh |
+False |
+
UserRefreshInterval +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+USERREFRESHINTERVAL |
+Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0. +Word count (with spaces): 85 |
+Integer (0-744 Hours) |
+Publishing\Servers\{serverId}\UserPeriodicRefreshInterval |
+0 |
+
UserRefreshIntervalUnit +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+USERREFRESHINTERVALUNIT |
+Specifies the interval unit (Hour 0-23, Day 0-31). |
+0 for hour, 1 for day |
+Publishing\Servers\{serverId}\UserPeriodicRefreshIntervalUnit |
+1 |
+
MigrationMode |
+MIGRATIONMODE |
+Migration mode allows the App-V client to modify shortcuts and FTA’s for packages created using a previous version of App-V. |
+True(enabled state); False (disabled state) |
+Coexistence\MigrationMode |
++ |
CEIPOPTIN |
+CEIPOPTIN |
+Allows the computer running the App-V 5.0 Client to collect and return certain usage information to help allow us to further improve the application. |
+0 for disabled; 1 for enabled |
+SOFTWARE/Microsoft/AppV/CEIP/CEIPEnable |
+0 |
+
EnablePackageScripts |
+ENABLEPACKAGESCRIPTS |
+Enables scripts defined in the package manifest of configuration files that should run. |
+True(enabled); False(Disabled state) |
+\Scripting\EnablePackageScripts |
++ |
RoamingFileExclusions |
+ROAMINGFILEEXCLUSIONS |
+Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /ROAMINGFILEEXCLUSIONS='desktop;my pictures' |
++ | + | + |
RoamingRegistryExclusions |
+ROAMINGREGISTRYEXCLUSIONS |
+Specifies the registry paths that do not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\\classes;software\\clients |
+String |
+Integration\RoamingReglstryExclusions |
+Policy value not written (same as Not Configured) |
+
IntegrationRootUser |
+Not available. |
+Specifies the location to create symbolic links associated with the current version of a per-user published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %localappdata%\Microsoft\AppV\Client\Integration. |
+String |
+Integration\IntegrationRootUser |
+Policy value not written (same as Not Configured) |
+
IntegrationRootGlobal |
+Not available. |
+Specifies the location to create symbolic links associated with the current version of a globally published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %allusersprofile%\Microsoft\AppV\Client\Integration |
+String |
+Integration\IntegrationRootGlobal |
+Policy value not written (same as Not Configured) |
+
VirtualizableExtensions |
+Not available. |
+A comma -delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment. +When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application that is associated with the extension point is locally installed. If the extension is located, the RunVirtual command line parameter will be added, and the application will run virtually. +For more information about the RunVirtual parameter, see [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md). |
+String |
+Integration\VirtualizableExtensions |
+Policy value not written |
+
ReportingEnabled |
+Not available. |
+Enables the client to return information to a reporting server. |
+True (enabled); False (Disabled state) |
+Reporting\EnableReporting |
+False |
+
ReportingServerURL |
+Not available. |
+Specifies the location on the reporting server where client information is saved. |
+String |
+Reporting\ReportingServer |
+Policy value not written (same as Not Configured) |
+
ReportingDataCacheLimit |
+Not available. |
+Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. Set between 0 and 1024. |
+Integer [0-1024] |
+Reporting\DataCacheLimit |
+Policy value not written (same as Not Configured) |
+
ReportingDataBlockSize |
+Not available. |
+Specifies the maximum size in bytes to transmit to the server for reporting upload requests. This can help avoid permanent transmission failures when the log has reached a significant size. Set between 1024 and unlimited. |
+Integer [1024 - Unlimited] |
+Reporting\DataBlockSize |
+Policy value not written (same as Not Configured) |
+
ReportingStartTime |
+Not available. |
+Specifies the time to initiate the client to send data to the reporting server. You must specify a valid integer between 0-23 corresponding to the hour of the day. By default the ReportingStartTime will start on the current day at 10 P.M.or 22. +
+Note
+
+You should configure this setting to a time when computers running the App-V 5.0 client are least likely to be offline. +
+
+ |
+Integer (0 – 23) |
+Reporting\ StartTime |
+Policy value not written (same as Not Configured) |
+
ReportingInterval |
+Not available. |
+Specifies the retry interval that the client will use to resend data to the reporting server. |
+Integer |
+Reporting\RetryInterval |
+Policy value not written (same as Not Configured) |
+
ReportingRandomDelay |
+Not available. |
+Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data. This can help to prevent collisions on the server. |
+Integer [0 - ReportingRandomDelay] |
+Reporting\RandomDelay |
+Policy value not written (same as Not Configured) |
+
EnableDynamicVirtualization +
+Important
+
+This setting is available only with App-V 5.0 SP2 or later. +
+
+ |
+Not available. |
+Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications. |
+1 (Enabled), 0 (Disabled) |
+HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Virtualization |
++ |
EnablePublishingRefreshUI +
+Important
+
+This setting is available only with App-V 5.0 SP2. +
+
+ |
+Not available. |
+Enables the publishing refresh progress bar for the computer running the App-V 5.0 Client. |
+1 (Enabled), 0 (Disabled) |
+HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Publishing |
++ |
HideUI +
+Important
+
+This setting is available only with App-V 5.0 SP2. +
+
+ |
+Not available. |
+Hides the publishing refresh progress bar. |
+1 (Enabled), 0 (Disabled) |
++ | + |
ProcessesUsingVirtualComponents |
+Not available. |
+Specifies a list of process paths (that may contain wildcards), which are candidates for using dynamic virtualization (supported shell extensions, browser helper objects, and ActiveX controls). Only processes whose full path matches one of these items can use dynamic virtualization. |
+String |
+Virtualization\ProcessesUsingVirtualComponents |
+Empty string. |
+
Setting Name | +Setup Flag | +Description | +Setting Options | +Registry Key Value | +Disabled Policy State Keys and Values | +
---|---|---|---|---|---|
PackageInstallationRoot |
+PACKAGEINSTALLATIONROOT |
+Specifies directory where all new applications and updates will be installed. |
+String |
+Streaming\PackageInstallationRoot |
+Policy value not written (same as Not Configured) |
+
PackageSourceRoot |
+PACKAGESOURCEROOT |
+Overrides source location for downloading package content. |
+String |
+Streaming\PackageSourceRoot |
+Policy value not written (same as Not Configured) |
+
AllowHighCostLaunch |
+Not available. |
+This setting controls whether virtualized applications are launched on Windows 10 machines connected via a metered network connection (For example, 4G). |
+True (enabled); False (Disabled state) |
+Streaming\AllowHighCostLaunch |
+0 |
+
ReestablishmentRetries |
+Not available. |
+Specifies the number of times to retry a dropped session. |
+Integer (0-99) |
+Streaming\ReestablishmentRetries |
+Policy value not written (same as Not Configured) |
+
ReestablishmentInterval |
+Not available. |
+Specifies the number of seconds between attempts to reestablish a dropped session. |
+Integer (0-3600) |
+Streaming\ReestablishmentInterval |
+Policy value not written (same as Not Configured) |
+
AutoLoad |
+AUTOLOAD |
+Specifies how new packages should be loaded automatically by App-V on a specific computer. |
+(0x0) None; (0x1) Previously used; (0x2) All |
+Streaming\AutoLoad |
+Policy value not written (same as Not Configured) |
+
LocationProvider |
+Not available. |
+Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface. |
+String |
+Streaming\LocationProvider |
+Policy value not written (same as Not Configured) |
+
CertFilterForClientSsl |
+Not available. |
+Specifies the path to a valid certificate in the certificate store. |
+String |
+Streaming\CertFilterForClientSsl |
+Policy value not written (same as Not Configured) |
+
VerifyCertificateRevocationList |
+Not available. |
+Verifies Server certificate revocation status before steaming using HTTPS. |
+True(enabled); False(Disabled state) |
+Streaming\VerifyCertificateRevocationList |
+0 |
+
SharedContentStoreMode |
+SHAREDCONTENTSTOREMODE |
+Specifies that streamed package contents will be not be saved to the local hard disk. |
+True(enabled); False(Disabled state) |
+Streaming\SharedContentStoreMode |
+0 |
+
Name +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+PUBLISHINGSERVERNAME |
+Displays the name of publishing server. |
+String |
+Publishing\Servers\{serverId}\FriendlyName |
+Policy value not written (same as Not Configured) |
+
URL +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+PUBLISHINGSERVERURL |
+Displays the URL of publishing server. |
+String |
+Publishing\Servers\{serverId}\URL |
+Policy value not written (same as Not Configured) |
+
GlobalRefreshEnabled +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+GLOBALREFRESHENABLED |
+Enables global publishing refresh (Boolean) |
+True(enabled); False(Disabled state) |
+Publishing\Servers\{serverId}\GlobalEnabled |
+False |
+
GlobalRefreshOnLogon +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+GLOBALREFRESHONLOGON |
+Triggers a global publishing refresh on logon. ( Boolean) |
+True(enabled); False(Disabled state) |
+Publishing\Servers\{serverId}\GlobalLogonRefresh |
+False |
+
GlobalRefreshInterval +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+GLOBALREFRESHINTERVAL |
+Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0. |
+Integer (0-744 |
+Publishing\Servers\{serverId}\GlobalPeriodicRefreshInterval |
+0 |
+
GlobalRefreshIntervalUnit +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+GLOBALREFRESHINTERVALUNI |
+Specifies the interval unit (Hour 0-23, Day 0-31). |
+0 for hour, 1 for day |
+Publishing\Servers\{serverId}\GlobalPeriodicRefreshIntervalUnit |
+1 |
+
UserRefreshEnabled +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+USERREFRESHENABLED |
+Enables user publishing refresh (Boolean) |
+True(enabled); False(Disabled state) |
+Publishing\Servers\{serverId}\UserEnabled |
+False |
+
UserRefreshOnLogon +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+USERREFRESHONLOGON |
+Triggers a user publishing refresh onlogon. ( Boolean) +Word count (with spaces): 60 |
+True(enabled); False(Disabled state) |
+Publishing\Servers\{serverId}\UserLogonRefresh |
+False |
+
UserRefreshInterval +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+USERREFRESHINTERVAL |
+Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0. +Word count (with spaces): 85 |
+Integer (0-744 Hours) |
+Publishing\Servers\{serverId}\UserPeriodicRefreshInterval |
+0 |
+
UserRefreshIntervalUnit +
+Note
+
+This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet. +
+
+ |
+USERREFRESHINTERVALUNIT |
+Specifies the interval unit (Hour 0-23, Day 0-31). |
+0 for hour, 1 for day |
+Publishing\Servers\{serverId}\UserPeriodicRefreshIntervalUnit |
+1 |
+
MigrationMode |
+MIGRATIONMODE |
+Migration mode allows the App-V client to modify shortcuts and FTA’s for packages created using a previous version of App-V. |
+True(enabled state); False (disabled state) |
+Coexistence\MigrationMode |
++ |
CEIPOPTIN |
+CEIPOPTIN |
+Allows the computer running the App-V 5.1 Client to collect and return certain usage information to help allow us to further improve the application. |
+0 for disabled; 1 for enabled |
+SOFTWARE/Microsoft/AppV/CEIP/CEIPEnable |
+0 |
+
EnablePackageScripts |
+ENABLEPACKAGESCRIPTS |
+Enables scripts defined in the package manifest of configuration files that should run. |
+True(enabled); False(Disabled state) |
+\Scripting\EnablePackageScripts |
++ |
RoamingFileExclusions |
+ROAMINGFILEEXCLUSIONS |
+Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /ROAMINGFILEEXCLUSIONS='desktop;my pictures' |
++ | + | + |
RoamingRegistryExclusions |
+ROAMINGREGISTRYEXCLUSIONS |
+Specifies the registry paths that do not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\\classes;software\\clients |
+String |
+Integration\RoamingReglstryExclusions |
+Policy value not written (same as Not Configured) |
+
IntegrationRootUser |
+Not available. |
+Specifies the location to create symbolic links associated with the current version of a per-user published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %localappdata%\Microsoft\AppV\Client\Integration. |
+String |
+Integration\IntegrationRootUser |
+Policy value not written (same as Not Configured) |
+
IntegrationRootGlobal |
+Not available. |
+Specifies the location to create symbolic links associated with the current version of a globally published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %allusersprofile%\Microsoft\AppV\Client\Integration |
+String |
+Integration\IntegrationRootGlobal |
+Policy value not written (same as Not Configured) |
+
VirtualizableExtensions |
+Not available. |
+A comma -delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment. +When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application that is associated with the extension point is locally installed. If the extension is located, the RunVirtual command line parameter will be added, and the application will run virtually. +For more information about the RunVirtual parameter, see [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md). |
+String |
+Integration\VirtualizableExtensions |
+Policy value not written |
+
ReportingEnabled |
+Not available. |
+Enables the client to return information to a reporting server. |
+True (enabled); False (Disabled state) |
+Reporting\EnableReporting |
+False |
+
ReportingServerURL |
+Not available. |
+Specifies the location on the reporting server where client information is saved. |
+String |
+Reporting\ReportingServer |
+Policy value not written (same as Not Configured) |
+
ReportingDataCacheLimit |
+Not available. |
+Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. Set between 0 and 1024. |
+Integer [0-1024] |
+Reporting\DataCacheLimit |
+Policy value not written (same as Not Configured) |
+
ReportingDataBlockSize |
+Not available. |
+Specifies the maximum size in bytes to transmit to the server for reporting upload requests. This can help avoid permanent transmission failures when the log has reached a significant size. Set between 1024 and unlimited. |
+Integer [1024 - Unlimited] |
+Reporting\DataBlockSize |
+Policy value not written (same as Not Configured) |
+
ReportingStartTime |
+Not available. |
+Specifies the time to initiate the client to send data to the reporting server. You must specify a valid integer between 0-23 corresponding to the hour of the day. By default the ReportingStartTime will start on the current day at 10 P.M.or 22. +
+Note
+
+You should configure this setting to a time when computers running the App-V 5.1 client are least likely to be offline. +
+
+ |
+Integer (0 – 23) |
+Reporting\ StartTime |
+Policy value not written (same as Not Configured) |
+
ReportingInterval |
+Not available. |
+Specifies the retry interval that the client will use to resend data to the reporting server. |
+Integer |
+Reporting\RetryInterval |
+Policy value not written (same as Not Configured) |
+
ReportingRandomDelay |
+Not available. |
+Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data. This can help to prevent collisions on the server. |
+Integer [0 - ReportingRandomDelay] |
+Reporting\RandomDelay |
+Policy value not written (same as Not Configured) |
+
EnableDynamicVirtualization +
+Important
+
+This setting is available only with App-V 5.0 SP2 or later. +
+
+ |
+Not available. |
+Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications. |
+1 (Enabled), 0 (Disabled) |
+HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Virtualization |
++ |
EnablePublishingRefreshUI +
+Important
+
+This setting is available only with App-V 5.0 SP2. +
+
+ |
+Not available. |
+Enables the publishing refresh progress bar for the computer running the App-V 5.1 Client. |
+1 (Enabled), 0 (Disabled) |
+HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Publishing |
++ |
HideUI +
+Important
+
+This setting is available only with App-V 5.0 SP2. +
+
+ |
+Not available. |
+Hides the publishing refresh progress bar. |
+1 (Enabled), 0 (Disabled) |
++ | + |
ProcessesUsingVirtualComponents |
+Not available. |
+Specifies a list of process paths (that may contain wildcards), which are candidates for using dynamic virtualization (supported shell extensions, browser helper objects, and ActiveX controls). Only processes whose full path matches one of these items can use dynamic virtualization. |
+String |
+Virtualization\ProcessesUsingVirtualComponents |
+Empty string. |
+
Connection group purpose |
+A connection group is an App-V feature that enables you to group packages together to create a virtual environment in which the applications in those packages can interact with each other. +Example: You want to use plug-ins with Microsoft Office. You can create a package that contains the plug-ins, and create another package that contains Office, and then add both packages to a connection group to enable Office to use those plug-ins. |
+
How the connection group file works |
+When you apply an Application Virtualization 5.0 connection group file, the packages that are enumerated in the file will be combined at runtime into a single virtual environment. Use the Microsoft Application Virtualization (App-V) 5.0 connection group file to configure existing Application Virtualization 5.0 connection groups. |
+
Example file path |
+%APPDATA%\Microsoft\AppV\Client\Catalog\PackageGroups\{6CCC7575-162E-4152-9407-ED411DA138F4}\{4D1E16E1-8EF8-41ED-92D5-8910A8527F96}. |
+
Field | +Description | +
---|---|
Schema name |
+Name of the schema. +Applicable starting in App-V 5.0 SP3: If you want to use the new “optional packages” and “use any version” features that are described in this table, you must specify the following schema in the XML file: +
|
+
AppConnectionGroupId |
+Unique GUID identifier for this connection group. The connection group state is associated with this identifier. Specify this identifier only when you create the connection group. +You can create a new GUID by typing: [Guid]::NewGuid(). |
+
VersionId |
+Version GUID identifier for this version of the connection group. +When you update a connection group (for example, by adding or updating a new package), you must update the version GUID to reflect the new version. |
+
DisplayName |
+Display name of the connection group. |
+
Priority |
+Optional priority field for the connection group. +“0” - indicates the highest priority. +If a priority is required, but has not been configured, the package will fail because the correct connection group to use cannot be determined. |
+
Field | +Description | +
---|---|
PackageId |
+Unique GUID identifier for this package. This GUID doesn’t change when newer versions of the package are published. |
+
VersionId |
+Unique GUID identifier for the version of the package. +Applicable starting in App-V 5.0 SP3: If you specify “*” for the package version, the GUID of the latest available package version is dynamically inserted. |
+
IsOptional |
+Applicable starting in App-V 5.0 SP3: Parameter that enables you to make a package optional within the connection group. Valid entries are: +
See [How to Use Optional Packages in Connection Groups](how-to-use-optional-packages-in-connection-groups.md). |
+
Configuration | +Example scenario | +||||||
---|---|---|---|---|---|---|---|
An. exe file and plug-in (.dll) |
+
|
+||||||
An. exe file and a middleware application |
+
|
+||||||
An. exe file and an .exe file |
+You have an application that relies on another application, and you want to keep the packages separate for operational efficiencies, licensing restrictions, or rollout timelines. +Example: +If you are deploying Microsoft Lync 2010, you can use three packages: +
You can manage the deployment using the following connection groups: +
When the deployment has completed, you can either create a single new Microsoft Office 2010 + Microsoft Lync 2010 package, or keep and maintain them as separate packages and deploy them by using a connection group. |
+
Connection group purpose |
+A connection group is an App-V feature that enables you to group packages together to create a virtual environment in which the applications in those packages can interact with each other. +Example: You want to use plug-ins with Microsoft Office. You can create a package that contains the plug-ins, and create another package that contains Office, and then add both packages to a connection group to enable Office to use those plug-ins. |
+
How the connection group file works |
+When you apply an App-V 5.1 connection group file, the packages that are enumerated in the file will be combined at runtime into a single virtual environment. Use the Microsoft Application Virtualization (App-V) 5.1 connection group file to configure existing App-V 5.1 connection groups. |
+
Example file path |
+%APPDATA%\Microsoft\AppV\Client\Catalog\PackageGroups\{6CCC7575-162E-4152-9407-ED411DA138F4}\{4D1E16E1-8EF8-41ED-92D5-8910A8527F96}. |
+
Field | +Description | +
---|---|
Schema name |
+Name of the schema. +Applicable starting in App-V 5.0 SP3: If you want to use the new “optional packages” and “use any version” features that are described in this table, you must specify the following schema in the XML file: +
|
+
AppConnectionGroupId |
+Unique GUID identifier for this connection group. The connection group state is associated with this identifier. Specify this identifier only when you create the connection group. +You can create a new GUID by typing: [Guid]::NewGuid(). |
+
VersionId |
+Version GUID identifier for this version of the connection group. +When you update a connection group (for example, by adding or updating a new package), you must update the version GUID to reflect the new version. |
+
DisplayName |
+Display name of the connection group. |
+
Priority |
+Optional priority field for the connection group. +“0” - indicates the highest priority. +If a priority is required, but has not been configured, the package will fail because the correct connection group to use cannot be determined. |
+
Field | +Description | +
---|---|
PackageId |
+Unique GUID identifier for this package. This GUID doesn’t change when newer versions of the package are published. |
+
VersionId |
+Unique GUID identifier for the version of the package. +Applicable starting in App-V 5.0 SP3: If you specify “*” for the package version, the GUID of the latest available package version is dynamically inserted. |
+
IsOptional |
+Applicable starting in App-V 5.0 SP3: Parameter that enables you to make a package optional within the connection group. Valid entries are: +
See [How to Use Optional Packages in Connection Groups](how-to-use-optional-packages-in-connection-groups51.md). |
+
Configuration | +Example scenario | +||||||
---|---|---|---|---|---|---|---|
An. exe file and plug-in (.dll) |
+
|
+||||||
An. exe file and a middleware application |
+
|
+||||||
An. exe file and an .exe file |
+You have an application that relies on another application, and you want to keep the packages separate for operational efficiencies, licensing restrictions, or rollout timelines. +Example: +If you are deploying Microsoft Lync 2010, you can use three packages: +
You can manage the deployment using the following connection groups: +
When the deployment has completed, you can either create a single new Microsoft Office 2010 + Microsoft Lync 2010 package, or keep and maintain them as separate packages and deploy them by using a connection group. |
+
Package A | +Package B | +
---|---|
C:\Windows\System32 |
+C:\Windows\System32 |
+
C:\AppTest |
+C:\AppTest |
+
Package A | +Package B | +
---|---|
C:\Windows\System32 |
+C:\Windows\System32 |
+
C:\AppTest |
+C:\AppTest |
+
To do this | +Press | +
---|---|
Rename App-V 5.0 connection groups or the App-V 5.0 publishing server description. |
+F2 |
+
Transfer access and configuration information from an existing App-V 5.0 package. |
+CTRL + Shift + A |
+
Transfer default configurations from an existing App-V 5.0 package. |
+CTRL + Shift + C |
+
Refresh the current page of the App-V 5.0 client console. |
+F5 |
+
On the Connections Groups page of the client management console, copies as a new version. |
+CTRL + Shift + C |
+
Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.) +20 Roszel Road +Princeton, NJ 08540 |
++ |
Telephone number from within the United States: |
+(800) 221-4792 |
+
Telephone number from outside the United States and Canada: |
+(609) 452-0606 |
+
Fax: |
+(609) 987-8116 |
+
[http://www.learningally.org/](http://go.microsoft.com/fwlink/?linkid=239) |
+Web addresses can change, so you might be unable to connect to the website or sites mentioned here. |
+
To do this | +Press | +
---|---|
Close a dialog box. |
+Esc |
+
Perform the default action of a dialog box. |
+Enter |
+
Refresh the current page of the App-V 5.1 client console. |
+F5 |
+
To do this | +Press | +
---|---|
Open the Find dialog box. |
+CTRL + F |
+
Open the Replace dialog box. |
+CTRL + H |
+
Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.) +20 Roszel Road +Princeton, NJ 08540 |
++ |
Telephone number from within the United States: |
+(800) 221-4792 |
+
Telephone number from outside the United States and Canada: |
+(609) 452-0606 |
+
Fax: |
+(609) 987-8116 |
+
[http://www.learningally.org/](http://go.microsoft.com/fwlink/?linkid=239) |
+Web addresses can change, so you might be unable to connect to the website or sites mentioned here. |
+
Management Console tab | +Description | +
---|---|
Overview |
+
+
|
+
Packages tab |
+Use the PACKAGES tab to add or upgrade packages. You can also manage connection groups by clicking CONNECTION GROUPS. |
+
Servers tab |
+Use the SERVERS tab to register a new server. |
+
Administrators tab |
+Use the ADMINISTRATORS tab to register, add, or remove administrators in your App-V 5.0 environment. |
+
Name | +Description | +
---|---|
[How to Load the PowerShell Cmdlets and Get Cmdlet Help](how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md) |
+Describes how to install the PowerShell cmdlets and find cmdlet help and examples. |
+
[How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md) |
+Describes how to manage the client package lifecycle on a stand-alone computer using PowerShell. |
+
[How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md) |
+Describes how to manage connection groups using PowerShell. |
+
[How to Modify Client Configuration by Using PowerShell](how-to-modify-client-configuration-by-using-powershell51.md) |
+Describes how to modify the client using PowerShell. |
+
[How to Apply the User Configuration File by Using PowerShell](how-to-apply-the-user-configuration-file-by-using-powershell51.md) |
+Describes how to apply a user configuration file using PowerShell. |
+
[How to Apply the Deployment Configuration File by Using PowerShell](how-to-apply-the-deployment-configuration-file-by-using-powershell51.md) |
+Describes how to apply a deployment configuration file using PowerShell. |
+
[How to Sequence a Package by Using PowerShell](how-to-sequence-a-package--by-using-powershell-51.md) |
+Describes how to create a new package using PowerShell. |
+
[How to Create a Package Accelerator by Using PowerShell](how-to-create-a-package-accelerator-by-using-powershell51.md) |
+Describes how to create a package accelerator using PowerShell. You can use package accelerators automatically sequence large, complex applications. |
+
[How to Enable Reporting on the App-V 5.1 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md) |
+Describes how to enable the computer running the App-V 5.1 to send reporting information. |
+
[How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md) |
+Describes how to take an array of account names and to convert each of them to the corresponding SID in standard and hexadecimal formats. |
+
Event | +Action | +
---|---|
Using the RollbackOnError attribute with embedded scripts |
+When you use the RollbackOnError attribute with embedded scripts, the attribute is ignored for the following events: +
|
+
Package name contains $ |
+If a package name contains the character ( $ ), you must use a single-quote ( ‘ ), for example, +Add-AppvClientPackage ‘Contoso$App.appv’ |
+
Management Console tab | +Description | +
---|---|
Packages tab |
+Use the PACKAGES tab to add or upgrade packages. |
+
Connection Groups tab |
+Use the CONNECTION GROUPS tab to manage connection groups. |
+
Servers tab |
+Use the SERVERS tab to register a new server. |
+
Administrators tab |
+Use the ADMINISTRATORS tab to register, add, or remove administrators in your App-V 5.1 environment. |
+
Name | +Description | +
---|---|
[How to Load the PowerShell Cmdlets and Get Cmdlet Help](how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md) |
+Describes how to install the PowerShell cmdlets and find cmdlet help and examples. |
+
[How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md) |
+Describes how to manage the client package lifecycle on a stand-alone computer using PowerShell. |
+
[How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md) |
+Describes how to manage connection groups using PowerShell. |
+
[How to Modify Client Configuration by Using PowerShell](how-to-modify-client-configuration-by-using-powershell.md) |
+Describes how to modify the client using PowerShell. |
+
[How to Apply the User Configuration File by Using PowerShell](how-to-apply-the-user-configuration-file-by-using-powershell.md) |
+Describes how to apply a user configuration file using PowerShell. |
+
[How to Apply the Deployment Configuration File by Using PowerShell](how-to-apply-the-deployment-configuration-file-by-using-powershell.md) |
+Describes how to apply a deployment configuration file using PowerShell. |
+
[How to Sequence a Package by Using PowerShell](how-to-sequence-a-package--by-using-powershell-50.md) |
+Describes how to create a new package using PowerShell. |
+
[How to Create a Package Accelerator by Using PowerShell](how-to-create-a-package-accelerator-by-using-powershell.md) |
+Describes how to create a package accelerator using PowerShell. You can use package accelerators automatically sequence large, complex applications. |
+
[How to Enable Reporting on the App-V 5.0 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md) |
+Describes how to enable the computer running the App-V 5.0 to send reporting information. |
+
[How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md) |
+Describes how to take an array of account names and to convert each of them to the corresponding SID in standard and hexadecimal formats. |
+
Event | +Action | +
---|---|
Using the RollbackOnError attribute with embedded scripts |
+When you use the RollbackOnError attribute with embedded scripts, the attribute is ignored for the following events: +
|
+
Package name contains $ |
+If a package name contains the character ( $ ), you must use a single-quote ( ‘ ), for example, +Add-AppvClientPackage ‘Contoso$App.appv’ |
+
Task | +More Information | +
---|---|
Determine Application Scope |
+Depending on the applications to be virtualized, the App-V 5.0 infrastructure can be set up in different ways. The first task is to define what applications you want to virtualize. |
+
Determine Location Scope |
+Location scope refers to the physical locations (for example, enterprise-wide or a specific geographic location) where you plan to run the virtualized applications. It can also refer to the user population (for example, a single department) who will run the virtual applications. You should obtain a network map that includes the connection paths as well as available bandwidth to each location and the number of users using virtualized applications and the WAN link speed. |
+
Factors impacting round trip response time | +More Information | +
---|---|
The number of publishing servers simultaneously requesting package metadata refreshes. |
+
+
|
+
The number of connection groups configured on the management server. + |
+
+
|
+
The number of access groups configured on the management server. + |
+
+
|
+
Scenario | +Variation | +Number of connection groups | +Number of access groups | +Number of publishing servers | +Network connection type publishing server / management server | +Round trip response time on the publishing server (in seconds) | +CPU utilization on management server | +
---|---|---|---|---|---|---|---|
Publishing servers simultaneously contacting management server for publishing metadata. |
+Number of publishing servers |
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
Publishing metadata contains connection groups |
+Number of connection groups |
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
Publishing metadata contains access groups |
+Number of access groups |
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
Scenario | +Variation | +Number of connection groups | +Number of access groups | +Number of publishing servers | +Network connection type publishing server / management server | +Round trip response time on the publishing server (in seconds) | +CPU utilization on management server | +
---|---|---|---|---|---|---|---|
Network connection between the publishing server and management server |
+1.5 Mbps Slow link Network |
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
Network connection between the publishing server and management server |
+LAN / WIFI Network |
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
Scenario | +Summary | +
---|---|
Multiple App-V 5.0 clients send reporting information to the reporting server simultaneously. |
+
+
|
+
Requests per second processed by the reporting server. + |
+
+
|
+
Reporting Database. + |
+
+
|
+
Scenario | +Summary | +
---|---|
Multiple App-V 5.0 clients connect to a single publishing server simultaneously. |
+
+
|
+
Number of packages in each refresh. + |
+
+
|
+
Network between the App-V 5.0 client and the publishing server. + |
+
+
|
+
Scenario | +Variation | +Number of App-V 5.0 clients | +Number of packages | +Processor configuration on the publishing server | +Network connection type publishing server / App-V 5.0 client | +Round trip time on the App-V 5.0 client (in seconds) | +CPU utilization on publishing server (in %) | +
---|---|---|---|---|---|---|---|
App-V 5.0 client sends publishing refresh request & receives response, each request containing 120 packages |
+Number of clients |
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
Multiple packages in each refresh |
+Number of packages |
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
Network between client and publishing server |
+1.5 Mbps Slow link network |
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
++ |
Scenario | +Summary | +
---|---|
Multiple App-V 5.0 clients stream applications from a single streaming server simultaneously. |
+
+
|
+
Size of the package being streamed. + |
+
+
|
+
Network between the App-V 5.0 client and the streaming server. + |
+
+
|
+
Scenario | +Variation | +Number of App-V 5.0 clients | +Size of each package | +Network connection type streaming server / App-V 5.0 client | +Round trip time on the App-V 5.0 client (in seconds) | +
---|---|---|---|---|---|
Multiple App-V 5.0 clients streaming virtual application packages from a streaming server. |
+Number of clients. |
+
+
|
+
+
|
+
+
|
+
+
|
+
Size of each package being streamed. |
+Size of each package. |
+
+
|
+
+
|
+
+
|
+
+ 33 +83 + +100 +160 |
+
Network connection between client and App-V 5.0 streaming server. |
+1.5 Mbps Slow link network. |
+
+
|
+
+
|
+
+
|
+
+ 102 + +121 |
+
+ | Task | +References | +Notes | +
---|---|---|---|
![]() |
+Complete the planning phase to prepare the computing environment for App-V 5.0 deployment. |
+[App-V 5.0 Planning Checklist](app-v-50-planning-checklist.md) |
++ |
![]() |
+Review the App-V 5.0 supported configurations information to make sure selected client and server computers are supported for App-V 5.0 feature installation. |
+[App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md) |
++ |
![]() |
+Run App-V 5.0 Setup to deploy the required App-V 5.0 features for your environment. +
+Note
+
+Keep track of the names of the servers and associated URL’s created during installation. This information will be used throughout the installation process. +
+
+ |
+
+
|
++ |
+ | Task | +References | +Notes | +
---|---|---|---|
![]() |
+Review the getting started information about App-V 5.0 to gain a basic understanding of the product before beginning deployment planning. |
+[Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) |
++ |
![]() |
+Plan for App-V 5.0 1.0 Deployment Prerequisites and prepare your computing environment. |
+[App-V 5.0 Prerequisites](app-v-50-prerequisites.md) |
++ |
![]() |
+If you plan to use the App-V 5.0 management server, plan for the required roles. |
+[Planning for the App-V 5.0 Server Deployment](planning-for-the-app-v-50-server-deployment.md) |
++ |
![]() |
+Plan for the App-V 5.0 sequencer and client so you to create and run virtualized applications. |
+[Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md) |
++ |
![]() |
+If applicable, review the options and steps for migrating from a previous version of App-V. |
+[Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v.md) |
++ |
![]() |
+Plan for running App-V 5.0 clients using in shared content store mode. |
+[How to Install the App-V 5.0 Client for Shared Content Store Mode](how-to-install-the-app-v-50-client-for-shared-content-store-mode.md) |
++ |
Operating systems | +Prerequisite description | +
---|---|
Computers that are running: +
|
+The following prerequisites are already installed: +
|
+
Computers that are running: +
|
+You may want to download the following KB: +[Microsoft Security Advisory: Insecure library loading could allow remote code execution](http://support.microsoft.com/kb/2533623) +Be sure to check for subsequent KBs that have superseded this one, and note that some KBs may require that you uninstall previous updates. |
+
Prerequisite | +Details | +
---|---|
Software requirements |
+
|
+
Prerequisite | +Details | +
---|---|
Software requirements |
+
|
+
Prerequisite | +Details | +
---|---|
Software requirements |
+
|
+
Prerequisite | +Details | +
---|---|
Management Server |
+
The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management server. +
|
+
Management Database |
+
+
+Note
+
+The database is required only when using the App-V 5.0 management server. +
+
+
+
The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management database. +
|
+
Reporting Server |
+
|
+
Reporting Database |
+
+
+Note
+
+The database is required only when using the App-V 5.0 reporting server. +
+
+
+
The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 reporting database. +
|
+
Publishing Server |
+
The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 publishing server. +
|
+
Group name | +Details | +
---|---|
App-V Management Admin group |
+Used to manage the App-V 5.0 management server. This group is created during the App-V 5.0 Management Server installation. +
+Important
+
+There is no method to create the group using the management console after you have completed the installation. +
+
+ |
+
Database read/write for Management Service account |
+Provides read/write access to the management database. This account should be created during the App-V 5.0 management database installation. |
+
App-V Management Service install admin account +
+Note
+
+This is only required if management database is being installed separately from the service. +
+
+ |
+Provides public access to schema-version table in management database. This account should be created during the App-V 5.0 management database installation. |
+
App-V Reporting Service install admin account +
+Note
+
+This is only required if reporting database is being installed separately from the service. +
+
+ |
+Public access to schema-version table in reporting database. This account should be created during the App-V 5.0 reporting database installation. |
+
Operating system | +Prerequisite description | +
---|---|
Windows 8.1 |
+All of the prerequisite software is already installed. |
+
Windows 8 +Windows Server 2012 |
+The following prerequisite software is already installed: +
|
+
Windows 7 |
+The prerequisite software is not already installed. You must install it before you can install App-V. |
+
Account for installing the App-V Server |
+The account that you use to install the App-V Server components must have: +
|
+
Port and firewall |
+
|
+
Web Distributed Authoring and Versioning (WebDAV) |
+WebDAV is automatically disabled for the Management Service. |
+
Supported deployment scenarios |
+
|
+
Unsupported deployment scenarios |
+
|
+
Prerequisites and required settings | +Details | +
---|---|
Supported version of SQL Server |
+For supported versions, see [App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md). |
+
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
++ |
[Windows PowerShell 3.0](http://www.microsoft.com/download/details.aspx?id=34595) |
+Installing PowerShell 3.0 requires a restart. |
+
Download and install [KB2533623](http://support.microsoft.com/kb/2533623) |
+Applies to Windows 7 only. |
+
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
++ |
64-bit ASP.NET registration |
++ |
Windows Server Web Server Role |
+This role must be added to a server operating system that is supported for the Management server. |
+
Web Server (IIS) Management Tools |
+Click IIS Management Scripts and Tools. |
+
Web Server Role Services |
+Common HTTP Features: +
Application Development: +
Security: +
Management Tools: +
|
+
Default installation location |
+%PROGRAMFILES%\Microsoft Application Virtualization Server |
+
Location of the Management database |
+SQL Server database name, SQL Server database instance name, and database name. |
+
Management console and Management database permissions |
+A user or group that can access the Management console and database after the deployment is complete. Only these users or groups will have access to the Management console and database unless additional administrators are added by using the Management console. |
+
Management service website name |
+Name for the Management console website. |
+
Management service port binding |
+Unique port number for the Management service. This port cannot be used by another process on the computer. |
+
Microsoft Silverlight 5 |
+The Management console is available only if Silverlight is installed. |
+
Prerequisites and required settings | +Details | +
---|---|
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
++ |
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
++ |
Default installation location |
+%PROGRAMFILES%\Microsoft Application Virtualization Server |
+
Custom SQL Server instance name (if applicable) |
+Format to use: INSTANCENAME +This format is based on the assumption that the installation is on the local computer. +If you specify the name with the format SVR\INSTANCE, the installation will fail. |
+
Custom database name (if applicable) |
+Unique database name. +Default: AppVManagement |
+
Management server location |
+Machine account on which the Management server is deployed. +Format to use: Domain\MachineAccount |
+
Management server installation administrator |
+Account used to install the Management server. +Format to use: Domain\AdministratorLoginName |
+
Microsoft SQL Server Service Agent |
+Configure the Management database computer so that the Microsoft SQL Server Agent service is restarted automatically. For instructions, see [Configure SQL Server Agent to Restart Services Automatically](http://technet.microsoft.com/magazine/gg313742.aspx). |
+
Prerequisites and required settings | +Details | +||||||
---|---|---|---|---|---|---|---|
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
++ | ||||||
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
++ | ||||||
64-bit ASP.NET registration |
++ | ||||||
Windows Server Web Server Role |
+This role must be added to a server operating system that is supported for the Management server. |
+||||||
Web Server (IIS) Management Tools |
+Click IIS Management Scripts and Tools. |
+||||||
Web Server Role Services |
+Common HTTP Features: +
Application Development: +
Security: +
Management Tools: +
|
+||||||
Default installation location |
+%PROGRAMFILES%\Microsoft Application Virtualization Server |
+||||||
Management service URL |
+URL of the App-V Management service. This is the port with which the Publishing server communicates. +
+ |
+||||||
Publishing service website name |
+Name for the Publishing website. |
+||||||
Publishing service port binding |
+Unique port number for the Publishing service. This port cannot be used by another process on the computer. |
+
Prerequisites and required settings | +Details | +
---|---|
Supported version of SQL Server |
+For supported versions, see [App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md). |
+
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
++ |
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
++ |
64-bit ASP.NET registration |
++ |
Windows Server Web Server Role |
+This role must be added to a server operating system that is supported for the Management server. |
+
Web Server (IIS) Management Tools |
+Click IIS Management Scripts and Tools. |
+
Web Server Role Services |
+To reduce the risk of unwanted or malicious data being sent to the Reporting server, you should restrict access to the Reporting Web Service per your corporate security policy. +Common HTTP Features: +
Application Development: +
Security: +
Management Tools: +
|
+
Default installation location |
+%PROGRAMFILES%\Microsoft Application Virtualization Server |
+
Reporting service website name |
+Name for the Reporting website. |
+
Reporting service port binding |
+Unique port number for the Reporting service. This port cannot be used by another process on the computer. |
+
Prerequisites and required settings | +Details | +
---|---|
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
++ |
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
++ |
Default installation location |
+%PROGRAMFILES%\Microsoft Application Virtualization Server |
+
Custom SQL Server instance name (if applicable) |
+Format to use: INSTANCENAME +This format is based on the assumption that the installation is on the local computer. +If you specify the name with the format SVR\INSTANCE, the installation will fail. |
+
Custom database name (if applicable) |
+Unique database name. +Default: AppVReporting |
+
Reporting server location |
+Machine account on which the Reporting server is deployed. +Format to use: Domain\MachineAccount |
+
Reporting server installation administrator |
+Account used to install the Reporting server. +Format to use: Domain\AdministratorLoginName |
+
Microsoft SQL Server Service and Microsoft SQL Server Service Agent |
+Configure these services to be associated with user accounts that have access to query AD DS. |
+
Prerequisite | +Details | +
---|---|
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
++ |
[Windows PowerShell 3.0](http://www.microsoft.com/download/details.aspx?id=34595) + |
+Installing PowerShell 3.0 requires a restart. |
+
[KB2533623](http://support.microsoft.com/kb/2533623) |
+Applies to Windows 7 only: Download and install the KB. |
+
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
++ |
Prerequisite | +Details | +
---|---|
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
++ |
[Windows PowerShell 3.0](http://www.microsoft.com/download/details.aspx?id=34595) + |
+Installing PowerShell 3.0 requires a restart. |
+
[KB2533623](http://support.microsoft.com/kb/2533623) |
+Applies to Windows 7 only: Download and install the KB. |
+
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
++ |
Prerequisite | +Details | +
---|---|
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
++ |
[Windows PowerShell 3.0](http://www.microsoft.com/download/details.aspx?id=34595) + |
+Installing PowerShell 3.0 requires a restart. |
+
[KB2533623](http://support.microsoft.com/kb/2533623) |
+Applies to Windows 7 only: Download and install the KB. |
+
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
++ |
Operating system | +Service Pack | +System architecture | +
---|---|---|
Microsoft Windows Server 2012 R2 |
++ | 64-bit |
+
Microsoft Windows Server 2012 |
++ | 64-bit |
+
Microsoft Windows Server 2008 R2 |
+SP1 |
+64-bit |
+
SQL Server version | +Service pack | +System architecture | +
---|---|---|
Microsoft SQL Server 2014 |
++ | 32-bit or 64-bit |
+
Microsoft SQL Server 2012 |
+SP2 |
+32-bit or 64-bit |
+
Microsoft SQL Server 2008 R2 |
+SP3 |
+32-bit or 64-bit |
+
Operating system | +Service Pack | +System architecture | +
---|---|---|
Microsoft Windows Server 2012 R2 |
++ | 64-bit |
+
Microsoft Windows Server 2012 |
++ | 64-bit |
+
Microsoft Windows Server 2008 R2 |
+SP1 |
+64-bit |
+
Operating system | +Service Pack | +System architecture | +
---|---|---|
Microsoft Windows Server 2012 R2 |
++ | 64-bit |
+
Microsoft Windows Server 2012 |
++ | 64-bit |
+
Microsoft Windows Server 2008 R2 |
+SP1 |
+64-bit |
+
SQL Server version | +Service pack | +System architecture | +
---|---|---|
Microsoft SQL Server 2014 |
++ | 32-bit or 64-bit |
+
Microsoft SQL Server 2012 |
+SP2 |
+32-bit or 64-bit |
+
Microsoft SQL Server 2008 R2 |
+SP3 |
+32-bit or 64-bit |
+
Operating system | +Service pack | +System architecture | +
---|---|---|
Microsoft Windows 8.1 |
++ | 32-bit or 64-bit |
+
Microsoft Windows 8 |
++ | 32-bit or 64-bit |
+
Windows 7 |
+SP1 |
+32-bit or 64-bit |
+
Operating system | +Service Pack | +System architecture | +
---|---|---|
Microsoft Windows Server 2012 R2 |
++ | 64-bit |
+
Microsoft Windows Server 2012 |
++ | 64-bit |
+
Microsoft Windows Server 2008 R2 |
+SP1 |
+64-bit |
+
Operating system | +Service pack | +System architecture | +
---|---|---|
Microsoft Windows Server 2012 R2 |
++ | 64-bit |
+
Microsoft Windows Server 2012 |
++ | 64-bit |
+
Microsoft Windows Server 2008 R2 |
+SP1 |
+64-bit |
+
Microsoft Windows 8.1 |
++ | 32-bit and 64-bit |
+
Microsoft Windows 8 |
++ | 32-bit and 64-bit |
+
Microsoft Windows 7 |
+SP1 |
+32-bit and 64-bit |
+
Operating system | +Edition | +Service pack | +System architecture | +
---|---|---|---|
Microsoft Windows Server 2008 (Standard, Enterprise, Datacenter, or Web Server) |
+R2 |
+SP1 and higher |
+64-bit |
+
Microsoft Windows Server 2012 (Standard, Datacenter) |
++ | + | 64-bit |
+
Microsoft Windows Server 2012 (Standard, Datacenter) |
+R2 |
++ | 64-bit |
+
Operating system | +Edition | +Service pack | +System architecture | +
---|---|---|---|
Microsoft Windows Server 2008 (Standard, Enterprise, Datacenter, or Web Server) |
+R2 |
++ | 64-bit |
+
Microsoft Windows Server 2012 (Standard, Datacenter) |
++ | + | 64-bit |
+
Microsoft Windows Server 2012 (Standard, Datacenter) |
+R2 |
++ | 64-bit |
+
Operating system | +Edition | +Service Pack | +System architecture | +
---|---|---|---|
Microsoft Windows Server 2008 (Standard, Enterprise, Datacenter, or Web Server) |
+R2 |
++ | 64-bit |
+
Microsoft Windows Server 2012 (Standard, Datacenter) |
++ | + | 64-bit |
+
Microsoft Windows Server 2012 (Standard, Datacenter) |
+R2 |
++ | 64-bit |
+
App-V 5.0 server type | +SQL Server version | +Edition | +Service pack | +System architecture | +
---|---|---|---|---|
Management / Reporting |
+Microsoft SQL Server 2008 +(Standard, Enterprise, Datacenter, or the Developer Edition with the following feature: Database Engine Services.) |
++ | + | 32-bit or 64-bit |
+
Management / Reporting |
+Microsoft SQL Server 2008 +(Standard, Enterprise, Datacenter, or the Developer Edition with the following feature: Database Engine Services.) |
+R2 |
+SP2 |
+32-bit or 64-bit |
+
Management / Reporting |
+Microsoft SQL Server 2012 +(Standard, Enterprise, Datacenter, or the Developer Edition with the following feature: Database Engine Services.) |
++ | + | 32-bit or 64-bit |
+
Operating system | +Service pack | +System architecture | +
---|---|---|
Microsoft Windows 7 |
+SP1 |
+32-bit or 64-bit |
+
Microsoft Windows 8 |
++ | 32-bit or 64-bit |
+
+Important
+
+Windows 8.1 is only supported by App-V 5.0 SP2 +
+
+
+Windows 8.1 |
++ | 32-bit or 64-bit |
+
Operating system | +Edition | +Service pack | +System architecture | +
---|---|---|---|
Microsoft Windows 7 |
++ | SP1 |
+32-bit and 64-bit |
+
Microsoft Windows 8 |
++ | + | 32-bit and 64-bit |
+
+Important
+
+Windows 8.1 is only supported by App-V 5.0 SP2 +
+
+
+Windows 8.1 |
++ | + | 32-bit or 64-bit |
+
Microsoft Windows Server 2008 |
+R2 |
+SP1 |
+32-bit and 64-bit |
+
Microsoft Windows Server 2012 |
++ | + | 32-bit and 64-bit |
+
+Important
+
+Windows Server 2012 R2 is only supported by App-V 5.0 SP2 +
+
+
+Microsoft Windows Server 2012 |
+R2 |
++ | 64-bit |
+
Supported Configuration Manager version | +App-V version | +
---|---|
Microsoft System Center 2012 Configuration Manager |
+
|
+
System Center 2012 R2 Configuration Manager |
+
|
+
Task | +More Information | +
---|---|
Determine Application Scope |
+Depending on the applications to be virtualized, the App-V 5.1 infrastructure can be set up in different ways. The first task is to define what applications you want to virtualize. |
+
Determine Location Scope |
+Location scope refers to the physical locations (for example, enterprise-wide or a specific geographic location) where you plan to run the virtualized applications. It can also refer to the user population (for example, a single department) who will run the virtual applications. You should obtain a network map that includes the connection paths as well as available bandwidth to each location and the number of users using virtualized applications and the WAN link speed. |
+
Factors impacting round trip response time | +More Information | +
---|---|
The number of publishing servers simultaneously requesting package metadata refreshes. |
+
+
|
+
The number of connection groups configured on the management server. + |
+
+
|
+
The number of access groups configured on the management server. + |
+
+
|
+
Scenario | +Variation | +Number of connection groups | +Number of access groups | +Number of publishing servers | +Network connection type publishing server / management server | +Round trip response time on the publishing server (in seconds) | +CPU utilization on management server | +
---|---|---|---|---|---|---|---|
Publishing servers simultaneously contacting management server for publishing metadata. |
+Number of publishing servers |
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
Publishing metadata contains connection groups |
+Number of connection groups |
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
Publishing metadata contains access groups |
+Number of access groups |
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
Scenario | +Variation | +Number of connection groups | +Number of access groups | +Number of publishing servers | +Network connection type publishing server / management server | +Round trip response time on the publishing server (in seconds) | +CPU utilization on management server | +
---|---|---|---|---|---|---|---|
Network connection between the publishing server and management server |
+1.5 Mbps Slow link Network |
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
Network connection between the publishing server and management server |
+LAN / WIFI Network |
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
Scenario | +Summary | +
---|---|
Multiple App-V 5.1 clients send reporting information to the reporting server simultaneously. |
+
+
|
+
Requests per second processed by the reporting server. + |
+
+
|
+
Reporting Database. + |
+
+
|
+
Scenario | +Summary | +
---|---|
Multiple App-V 5.1 clients connect to a single publishing server simultaneously. |
+
+
|
+
Number of packages in each refresh. + |
+
+
|
+
Network between the App-V 5.1 client and the publishing server. + |
+
+
|
+
Scenario | +Variation | +Number of App-V 5.1 clients | +Number of packages | +Processor configuration on the publishing server | +Network connection type publishing server / App-V 5.1 client | +Round trip time on the App-V 5.1 client (in seconds) | +CPU utilization on publishing server (in %) | +
---|---|---|---|---|---|---|---|
App-V 5.1 client sends publishing refresh request & receives response, each request containing 120 packages |
+Number of clients |
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
Multiple packages in each refresh |
+Number of packages |
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
+
Network between client and publishing server |
+1.5 Mbps Slow link network |
+
+
|
+
+
|
+
+
|
+
+
|
+
+
|
++ |
Scenario | +Summary | +
---|---|
Multiple App-V 5.1 clients stream applications from a single streaming server simultaneously. |
+
+
|
+
Size of the package being streamed. + |
+
+
|
+
Network between the App-V 5.1 client and the streaming server. + |
+
+
|
+
Scenario | +Variation | +Number of App-V 5.1 clients | +Size of each package | +Network connection type streaming server / App-V 5.1 client | +Round trip time on the App-V 5.1 client (in seconds) | +
---|---|---|---|---|---|
Multiple App-V 5.1 clients streaming virtual application packages from a streaming server. |
+Number of clients. |
+
+
|
+
+
|
+
+
|
+
+
|
+
Size of each package being streamed. |
+Size of each package. |
+
+
|
+
+
|
+
+
|
+
+ 33 +83 + +100 +160 |
+
Network connection between client and App-V 5.1 streaming server. |
+1.5 Mbps Slow link network. |
+
+
|
+
+
|
+
+
|
+
+ 102 + +121 |
+
+ | Task | +References | +Notes | +
---|---|---|---|
![]() |
+Complete the planning phase to prepare the computing environment for App-V 5.1 deployment. |
+[App-V 5.1 Planning Checklist](app-v-51-planning-checklist.md) |
++ |
![]() |
+Review the App-V 5.1 supported configurations information to make sure selected client and server computers are supported for App-V 5.1 feature installation. |
+[App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md) |
++ |
![]() |
+Run App-V 5.1 Setup to deploy the required App-V 5.1 features for your environment. +
+Note
+
+Keep track of the names of the servers and associated URL’s created during installation. This information will be used throughout the installation process. +
+
+ |
+
+
|
++ |
+ | Task | +References | +Notes | +
---|---|---|---|
![]() |
+Review the getting started information about App-V 5.1 to gain a basic understanding of the product before beginning deployment planning. |
+[Getting Started with App-V 5.1](getting-started-with-app-v-51.md) |
++ |
![]() |
+Plan for App-V 5.1 1.0 Deployment Prerequisites and prepare your computing environment. |
+[App-V 5.1 Prerequisites](app-v-51-prerequisites.md) |
++ |
![]() |
+If you plan to use the App-V 5.1 management server, plan for the required roles. |
+[Planning for the App-V 5.1 Server Deployment](planning-for-the-app-v-51-server-deployment.md) |
++ |
![]() |
+Plan for the App-V 5.1 sequencer and client so you to create and run virtualized applications. |
+[Planning for the App-V 5.1 Sequencer and Client Deployment](planning-for-the-app-v-51-sequencer-and-client-deployment.md) |
++ |
![]() |
+If applicable, review the options and steps for migrating from a previous version of App-V. |
+[Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v51.md) |
++ |
![]() |
+Plan for running App-V 5.1 clients using in shared content store mode. |
+[How to Install the App-V 5.1 Client for Shared Content Store Mode](how-to-install-the-app-v-51-client-for-shared-content-store-mode.md) |
++ |
Operating system | +Prerequisite description | +
---|---|
Windows 10 |
+All of the prerequisite software is already installed. |
+
Windows 8.1 |
+All of the prerequisite software is already installed. +
+Note
+
+If you are running Windows 8, upgrade to Windows 8.1 before using App-V 5.1. +
+
+ |
+
Windows Server 2012 |
+The following prerequisite software is already installed: +
|
+
Windows 7 |
+The prerequisite software is not already installed. You must install it before you can install App-V. |
+
Account for installing the App-V Server |
+The account that you use to install the App-V Server components must have: +
|
+
Port and firewall |
+
|
+
Web Distributed Authoring and Versioning (WebDAV) |
+WebDAV is automatically disabled for the Management Service. |
+
Supported deployment scenarios |
+
|
+
Unsupported deployment scenarios |
+
|
+
Prerequisites and required settings | +Details | +
---|---|
Supported version of SQL Server |
+For supported versions, see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). |
+
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
++ |
[Windows PowerShell 3.0](http://www.microsoft.com/download/details.aspx?id=34595) |
+Installing PowerShell 3.0 requires a restart. |
+
Download and install [KB2533623](http://support.microsoft.com/kb/2533623) |
+Applies to Windows 7 only. |
+
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
++ |
64-bit ASP.NET registration |
++ |
Windows Server Web Server Role |
+This role must be added to a server operating system that is supported for the Management server. |
+
Web Server (IIS) Management Tools |
+Click IIS Management Scripts and Tools. |
+
Web Server Role Services |
+Common HTTP Features: +
Application Development: +
Security: +
Management Tools: +
|
+
Default installation location |
+%PROGRAMFILES%\Microsoft Application Virtualization Server |
+
Location of the Management database |
+SQL Server database name, SQL Server database instance name, and database name. |
+
Management console and Management database permissions |
+A user or group that can access the Management console and database after the deployment is complete. Only these users or groups will have access to the Management console and database unless additional administrators are added by using the Management console. |
+
Management service website name |
+Name for the Management console website. |
+
Management service port binding |
+Unique port number for the Management service. This port cannot be used by another process on the computer. |
+
Prerequisites and required settings | +Details | +
---|---|
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
++ |
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
++ |
Default installation location |
+%PROGRAMFILES%\Microsoft Application Virtualization Server |
+
Custom SQL Server instance name (if applicable) |
+Format to use: INSTANCENAME +This format is based on the assumption that the installation is on the local computer. +If you specify the name with the format SVR\INSTANCE, the installation will fail. |
+
Custom database name (if applicable) |
+Unique database name. +Default: AppVManagement |
+
Management server location |
+Machine account on which the Management server is deployed. +Format to use: Domain\MachineAccount |
+
Management server installation administrator |
+Account used to install the Management server. +Format to use: Domain\AdministratorLoginName |
+
Microsoft SQL Server Service Agent |
+Configure the Management database computer so that the Microsoft SQL Server Agent service is restarted automatically. For instructions, see [Configure SQL Server Agent to Restart Services Automatically](http://technet.microsoft.com/magazine/gg313742.aspx). |
+
Prerequisites and required settings | +Details | +||||||
---|---|---|---|---|---|---|---|
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
++ | ||||||
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
++ | ||||||
64-bit ASP.NET registration |
++ | ||||||
Windows Server Web Server Role |
+This role must be added to a server operating system that is supported for the Management server. |
+||||||
Web Server (IIS) Management Tools |
+Click IIS Management Scripts and Tools. |
+||||||
Web Server Role Services |
+Common HTTP Features: +
Application Development: +
Security: +
Management Tools: +
|
+||||||
Default installation location |
+%PROGRAMFILES%\Microsoft Application Virtualization Server |
+||||||
Management service URL |
+URL of the App-V Management service. This is the port with which the Publishing server communicates. +
+ |
+||||||
Publishing service website name |
+Name for the Publishing website. |
+||||||
Publishing service port binding |
+Unique port number for the Publishing service. This port cannot be used by another process on the computer. |
+
Prerequisites and required settings | +Details | +
---|---|
Supported version of SQL Server |
+For supported versions, see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). |
+
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
++ |
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
++ |
64-bit ASP.NET registration |
++ |
Windows Server Web Server Role |
+This role must be added to a server operating system that is supported for the Management server. |
+
Web Server (IIS) Management Tools |
+Click IIS Management Scripts and Tools. |
+
Web Server Role Services |
+To reduce the risk of unwanted or malicious data being sent to the Reporting server, you should restrict access to the Reporting Web Service per your corporate security policy. +Common HTTP Features: +
Application Development: +
Security: +
Management Tools: +
|
+
Default installation location |
+%PROGRAMFILES%\Microsoft Application Virtualization Server |
+
Reporting service website name |
+Name for the Reporting website. |
+
Reporting service port binding |
+Unique port number for the Reporting service. This port cannot be used by another process on the computer. |
+
Prerequisites and required settings | +Details | +
---|---|
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
++ |
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
++ |
Default installation location |
+%PROGRAMFILES%\Microsoft Application Virtualization Server |
+
Custom SQL Server instance name (if applicable) |
+Format to use: INSTANCENAME +This format is based on the assumption that the installation is on the local computer. +If you specify the name with the format SVR\INSTANCE, the installation will fail. |
+
Custom database name (if applicable) |
+Unique database name. +Default: AppVReporting |
+
Reporting server location |
+Machine account on which the Reporting server is deployed. +Format to use: Domain\MachineAccount |
+
Reporting server installation administrator |
+Account used to install the Reporting server. +Format to use: Domain\AdministratorLoginName |
+
Microsoft SQL Server Service and Microsoft SQL Server Service Agent |
+Configure these services to be associated with user accounts that have access to query AD DS. |
+
Prerequisite | +Details | +
---|---|
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
++ |
[Windows PowerShell 3.0](http://www.microsoft.com/download/details.aspx?id=34595) + |
+Installing PowerShell 3.0 requires a restart. |
+
[KB2533623](http://support.microsoft.com/kb/2533623) |
+Applies to Windows 7 only: Download and install the KB. |
+
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
++ |
Prerequisite | +Details | +
---|---|
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
++ |
[Windows PowerShell 3.0](http://www.microsoft.com/download/details.aspx?id=34595) + |
+Installing PowerShell 3.0 requires a restart. |
+
[KB2533623](http://support.microsoft.com/kb/2533623) |
+Applies to Windows 7 only: Download and install the KB. |
+
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) |
++ |
Prerequisite | +Details | +
---|---|
[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773) |
++ |
[Windows PowerShell 3.0](http://www.microsoft.com/download/details.aspx?id=34595) + |
+Installing PowerShell 3.0 requires a restart. |
+
[KB2533623](http://support.microsoft.com/kb/2533623) |
+Applies to Windows 7 only: Download and install the KB. |
+
Group name | +Details | +
---|---|
App-V Management Admin group |
+Used to manage the App-V 5.1 management server. This group is created during the App-V 5.1 Management Server installation. +
+Important
+
+There is no method to create the group using the management console after you have completed the installation. +
+
+ |
+
Database read/write for Management Service account |
+Provides read/write access to the management database. This account should be created during the App-V 5.1 management database installation. |
+
App-V Management Service install admin account +
+Note
+
+This is only required if management database is being installed separately from the service. +
+
+ |
+Provides public access to schema-version table in management database. This account should be created during the App-V 5.1 management database installation. |
+
App-V Reporting Service install admin account +
+Note
+
+This is only required if reporting database is being installed separately from the service. +
+
+ |
+Public access to schema-version table in reporting database. This account should be created during the App-V 5.1 reporting database installation. |
+
Operating system | +Service Pack | +System architecture | +
---|---|---|
Microsoft Windows Server 2012 R2 |
++ | 64-bit |
+
Microsoft Windows Server 2012 |
++ | 64-bit |
+
Microsoft Windows Server 2008 R2 |
+SP1 |
+64-bit |
+
SQL Server version | +Service pack | +System architecture | +
---|---|---|
Microsoft SQL Server 2014 |
++ | 32-bit or 64-bit |
+
Microsoft SQL Server 2012 |
+SP2 |
+32-bit or 64-bit |
+
Microsoft SQL Server 2008 R2 |
+SP3 |
+32-bit or 64-bit |
+
Operating system | +Service Pack | +System architecture | +
---|---|---|
Microsoft Windows Server 2012 R2 |
++ | 64-bit |
+
Microsoft Windows Server 2012 |
++ | 64-bit |
+
Microsoft Windows Server 2008 R2 |
+SP1 |
+64-bit |
+
Operating system | +Service Pack | +System architecture | +
---|---|---|
Microsoft Windows Server 2012 R2 |
++ | 64-bit |
+
Microsoft Windows Server 2012 |
++ | 64-bit |
+
Microsoft Windows Server 2008 R2 |
+SP1 |
+64-bit |
+
SQL Server version | +Service pack | +System architecture | +
---|---|---|
Microsoft SQL Server 2014 |
++ | 32-bit or 64-bit |
+
Microsoft SQL Server 2012 |
+SP2 |
+32-bit or 64-bit |
+
Microsoft SQL Server 2008 R2 |
+SP3 |
+32-bit or 64-bit |
+
Operating system | +Service pack | +System architecture | +
---|---|---|
Microsoft Windows 10 |
++ | 32-bit or 64-bit |
+
Microsoft Windows 8.1 |
++ | 32-bit or 64-bit |
+
Microsoft Windows 8 |
++ | 32-bit or 64-bit |
+
Windows 7 |
+SP1 |
+32-bit or 64-bit |
+
Operating system | +Service Pack | +System architecture | +
---|---|---|
Microsoft Windows Server 2012 R2 |
++ | 64-bit |
+
Microsoft Windows Server 2012 |
++ | 64-bit |
+
Microsoft Windows Server 2008 R2 |
+SP1 |
+64-bit |
+
Operating system | +Service pack | +System architecture | +
---|---|---|
Microsoft Windows Server 2012 R2 |
++ | 64-bit |
+
Microsoft Windows Server 2012 |
++ | 64-bit |
+
Microsoft Windows Server 2008 R2 |
+SP1 |
+64-bit |
+
Microsoft Windows 10 |
++ | 32-bit and 64-bit |
+
Microsoft Windows 8.1 |
++ | 32-bit and 64-bit |
+
Microsoft Windows 8 |
++ | 32-bit and 64-bit |
+
Microsoft Windows 7 |
+SP1 |
+32-bit and 64-bit |
+
App-V Version | +System Center Configuration Manager 2007 | +System Center 2012 Configuration Manager | +System Center 2012 Configuration Manager SP1 | +System Center 2012 R2 Configuration Manager | +System Center 2012 R2 Configuration Manager SP1 | +
---|---|---|---|---|---|
App-V 4.5 |
+R2 |
++ | + | + | + |
App-V 4.5 CU1 |
+R2 |
++ | + | + | + |
App-V 4.5 SP1 |
+R2 |
++ | + | + | + |
App-V 4.5 SP2 |
+R2 |
++ | + | + | + |
App-V 4.6 |
+R2, SP1 |
++ | + | + | + |
App-V 4.6 SP1 |
+R2, R3, SP2 |
+X |
+X |
+X |
++ |
App-V 4.6 SP2 |
+R2, R3, SP2 |
+X |
+X |
+X |
++ |
App-V 4.6 SP3 |
+R2, R3, SP2 |
++ | X |
+X |
++ |
App-V 5.0 |
+MSI-Wrapper-Only |
++ | X |
+X |
++ |
App-V 5.0 SP1 |
+MSI-Wrapper Only |
++ | X |
+X |
++ |
App-V 5.0 SP2 |
+MSI-Wrapper Only |
+CU4 - 2922875 |
+CU4 - 2922875 |
+CU1 - 2938441 |
++ |
App-V 5.0 SP2 HF4 |
+MSI-Wrapper Only |
+CU4 - 2922875 |
+CU4 - 2922875 |
+CU1 - 2938441 |
++ |
App-V 5.0 SP3 |
+MSI-Wrapper Only |
+CU4 - 2922875 |
+CU4 - 2922875 |
+CU1 - 2938441 |
++ |
App-V 5.1 |
+MSI-Wrapper Only |
+CU4 - 2922875 |
+CU4 - 2922875 |
+CU1 - 2938441 |
+X |
+
File | +Description | +
---|---|
.appv |
+
|
+
.MSI |
+Executable deployment wrapper that you can use to deploy .appv files manually or by using a third-party deployment platform. |
+
_DeploymentConfig.XML |
+File used to customize the default publishing parameters for all applications in a package that is deployed globally to all users on a computer that is running the App-V client. |
+
_UserConfig.XML |
+File used to customize the publishing parameters for all applications in a package that is a deployed to a specific user on a computer that is running the App-V client. |
+
Report.xml |
+Summary of messages resulting from the sequencing process, including omitted drivers, files, and registry locations. |
+
.CAB |
+Optional: Package accelerator file used to automatically rebuild a previously sequenced virtual application package. |
+
.appvt |
+Optional: Sequencer template file used to retain commonly reused Sequencer settings. |
+
Name | +Type | +Description | +
---|---|---|
Root |
+File folder |
+Directory that contains the file system for the virtualized application that is captured during sequencing. |
+
[Content_Types].xml |
+XML File |
+List of the core content types in the appv file (e.g. DLL, EXE, BIN). |
+
AppxBlockMap.xml |
+XML File |
+Layout of the appv file, which uses File, Block, and BlockMap elements that enable location and validation of files in the App-V package. |
+
AppxManifest.xml |
+XML File |
+Metadata for the package that contains the required information for adding, publishing, and launching the package. Includes extension points (file type associations and shortcuts) and the names and GUIDs associated with the package. |
+
FilesystemMetadata.xml |
+XML File |
+List of the files captured during sequencing, including attributes (e.g., directories, files, opaque directories, empty directories,and long and short names). |
+
PackageHistory.xml |
+XML File |
+Information about the sequencing computer (operating system version, Internet Explorer version, .Net Framework version) and process (upgrade, package version). |
+
Registry.dat |
+DAT File |
+Registry keys and values captured during the sequencing process for the package. |
+
StreamMap.xml |
+XML File |
+List of files for the primary and publishing feature block. The publishing feature block contains the ICO files and required portions of files (EXE and DLL) for publishing the package. When present, the primary feature block includes files that have been optimized for streaming during the sequencing process. |
+
Name | +Location | +Description | +
---|---|---|
Package Store |
+%ProgramData%\App-V |
+Default location for read only package files |
+
Machine Catalog |
+%ProgramData%\Microsoft\AppV\Client\Catalog |
+Contains per-machine configuration documents |
+
User Catalog |
+%AppData%\Microsoft\AppV\Client\Catalog |
+Contains per-user configuration documents |
+
Shortcut Backups |
+%AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups |
+Stores previous integration points that enable restore on package unpublish |
+
Copy on Write (COW) Roaming |
+%AppData%\Microsoft\AppV\Client\VFS |
+Writeable roaming location for package modification |
+
Copy on Write (COW) Local |
+%LocalAppData%\Microsoft\AppV\Client\VFS |
+Writeable non-roaming location for package modification |
+
Machine Registry |
+HKLM\Software\Microsoft\AppV |
+Contains package state information, including VReg for machine or globally published packages (Machine hive) |
+
User Registry |
+HKCU\Software\Microsoft\AppV |
+Contains user package state information including VReg |
+
User Registry Classes |
+HKCU\Software\Classes\AppV |
+Contains additional user package state information |
+
Description |
+Stores package documents that are available to users on the machine, when packages are added and published. However, if a package is “global” at publishing time, the integrations are available to all users. +If a package is non-global, the integrations are published only for specific users, but there are still global resources that are modified and visible to anyone on the client computer (e.g., the package directory is in a shared disk location). +If a package is available to a user on the computer (global or non-global), the manifest is stored in the Machine Catalog. When a package is published globally, there is a Dynamic Configuration file, stored in the Machine Catalog; therefore, the determination of whether a package is global is defined according to whether there is a policy file (UserDeploymentConfiguration file) in the Machine Catalog. |
+
Default storage location |
+
This location is not the same as the Package Store location. The Package Store is the golden or pristine copy of the package files. |
+
Files in the machine catalog |
+
|
+
Additional machine catalog location, used when the package is part of a connection group |
+The following location is in addition to the specific package location mentioned above: +
|
+
Additional files in the machine catalog when the package is part of a connection group |
+
|
+
Description |
+Created during the publishing process. Contains information used for publishing the package, and also used at launch to ensure that a package is provisioned to a specific user. Created in a roaming location and includes user-specific publishing information. +When a package is published for a user, the policy file is stored in the User Catalog. At the same time, a copy of the manifest is also stored in the User Catalog. When a package entitlement is removed for a user, the relevant package files are removed from the User Catalog. Looking at the user catalog, an administrator can view the presence of a Dynamic Configuration file, which indicates that the package is entitled for that user. +For roaming users, the User Catalog needs to be in a roaming or shared location to preserve the legacy App-V behavior of targeting users by default. Entitlement and policy are tied to a user, not a computer, so they should roam with the user once they are provisioned. |
+
Default storage location |
+
|
+
Files in the user catalog |
+
|
+
Additional user catalog location, used when the package is part of a connection group |
+The following location is in addition to the specific package location mentioned above: +
|
+
Additional file in the machine catalog when the package is part of a connection group |
+
|
+
Registry.dat from Package Store |
+> |
+%ProgramData%\Microsoft\AppV\Client\Vreg\{VersionGuid}.dat |
+
Location |
+Description |
+
COW |
+
|
+
Package |
+
|
+
Native |
+
|
+
Location |
+Description |
+
COW |
+
|
+
Package |
+
|
+
Native |
+
|
+
Policy | +Description | +
---|---|
AllowHighCostLaunch |
+On Windows 8 it allows streaming over 3G and cellular networks |
+
AutoLoad |
+Specifies the Background Load setting: +0 - Disabled +1 – Previously Used Packages only +2 – All Packages |
+
PackageInstallationRoot |
+The root folder for the package store in the local machine |
+
PackageSourceRoot |
+The root override where packages should be streamed from |
+
SharedContentStoreMode |
+Enables the use of Shared Content Store for VDI scenarios |
+
Scenario | +Description | +
---|---|
Applications that are run as standard users |
+When a standard user launches an App-V application, both HKLM and HKCU for App-V applications are stored in the HKCU hive on the machine. This presents as two distinct paths: +
The locations are enabled for roaming based on the operating system settings. |
+
Applications that are run with elevation |
+When an application is launched with elevation: +
In this scenario, these settings are not roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following location: +
|
+
VFS directory in package | +Mapped location of backing store | +
---|---|
ProgramFilesX86 |
+C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\ProgramFilesX86 |
+
SystemX86 |
+C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\SystemX86 |
+
Windows |
+C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\Windows |
+
appv_ROOT |
+C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\appv_ROOT |
+
AppData |
+C:\users\jsmith\AppData\Roaming\Microsoft\AppV\Client\VFS\<GUID>\AppData |
+
VFS directory in package | +Mapped location of backing store | +
---|---|
ProgramFilesX86 |
+C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\ProgramFilesX86 |
+
SystemX86 |
+C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\SystemX86 |
+
Windows |
+C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\Windows |
+
appv_ROOT |
+C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\appv_ROOT |
+
AppData |
+\\Fileserver\users\jsmith\roaming\Microsoft\AppV\Client\VFS\<GUID>\AppData |
+
Task type | +Applicable rule | +
---|---|
User-based task, e.g., publishing a package to a user |
+The pending task will be performed after the user logs off and then logs back on. |
+
Globally based task, e.g., enabling a connection group globally |
+The pending task will be performed when the computer is shut down and then restarted. |
+
User-based or globally based task | +Where the registry key is generated | +
---|---|
User-based tasks |
+KEY_CURRENT_USER\Software\Microsoft\AppV\Client\PendingTasks |
+
Globally based tasks |
+HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\PendingTasks |
+
Task | +Details | +
---|---|
Add the package to the computer |
+This task is computer specific and you can perform it at any time by completing the steps in the Package Add section above. |
+
Publish the package |
+See the Package Publishing section above for steps. This process requires that you update extension points on the system. End users cannot be using the application when you complete this task. |
+
Scenario | +Requirements | +
---|---|
App-V package is not in use when you try to upgrade |
+None of the following components of the package can be in use: virtual application, COM server, or shell extensions. +The administrator publishes a newer version of the package and the upgrade works the next time a component or application inside the package is launched. The new version of the package is streamed and run. Nothing has changed in this scenario in App-V 5 SP2 from previous releases of App-V 5. |
+
App-V package is in use when the administrator publishes a newer version of the package |
+The upgrade operation is set to pending by the App-V Client, which means that it is queued and carried out later when the package is not in use. +If the package application is in use, the user shuts down the virtual application, after which the upgrade can occur. +If the package has shell extensions (Office 2013), which are permanently loaded by Windows Explorer, the user cannot be logged in. Users must log off and the log back in to initiate the App-V package upgrade. |
+
Handler | +Description | +
---|---|
Context menu handler |
+Adds menu items to the context menu. It is called before the context menu is displayed. |
+
Drag-and-drop handler |
+Controls the action upon right-click drag-and-drop and modifies the context menu that appears. |
+
Drop target handler |
+Controls the action after a data object is dragged-and-dropped over a drop target such as a file. |
+
Data object handler |
+Controls the action after a file is copied to the clipboard or dragged-and-dropped over a drop target. It can provide additional clipboard formats to the drop target. |
+
Property sheet handler |
+Replaces or adds pages to the property sheet dialog box of an object. |
+
Infotip handler |
+Allows retrieving flags and infotip information for an item and displaying it inside a popup tooltip upon mouse- hover. |
+
Column handler |
+Allows creating and displaying custom columns in Windows Explorer Details view. It can be used to extend sorting and grouping. |
+
Preview handler |
+Enables a preview of a file to be displayed in the Windows Explorer Preview Pane. |
+
Virtual Extension | +Requires target OS Sequencing | +Requires Global Publishing | +
---|---|---|
Shortcut |
++ | + |
File Type Association |
++ | + |
URL Protocols |
+X |
++ |
AppPaths |
+X |
++ |
COM Mode |
++ | + |
Software Client |
+X |
++ |
Application Capabilities |
+X |
+X |
+
Context Menu Handler |
+X |
+X |
+
Drag-and-drop Handler |
+X |
++ |
Data Object Handler |
+X |
++ |
Property Sheet Handler |
+X |
++ |
Infotip Handler |
+X |
++ |
Column Handler |
+X |
++ |
Shell Extensions |
+X |
++ |
Browser Helper Object |
+X |
+X |
+
Active X Object |
+X |
+X |
+
File | +Description | +
---|---|
.appv |
+
|
+
.MSI |
+Executable deployment wrapper that you can use to deploy .appv files manually or by using a third-party deployment platform. |
+
_DeploymentConfig.XML |
+File used to customize the default publishing parameters for all applications in a package that is deployed globally to all users on a computer that is running the App-V client. |
+
_UserConfig.XML |
+File used to customize the publishing parameters for all applications in a package that is a deployed to a specific user on a computer that is running the App-V client. |
+
Report.xml |
+Summary of messages resulting from the sequencing process, including omitted drivers, files, and registry locations. |
+
.CAB |
+Optional: Package accelerator file used to automatically rebuild a previously sequenced virtual application package. |
+
.appvt |
+Optional: Sequencer template file used to retain commonly reused Sequencer settings. |
+
Name | +Type | +Description | +
---|---|---|
Root |
+File folder |
+Directory that contains the file system for the virtualized application that is captured during sequencing. |
+
[Content_Types].xml |
+XML File |
+List of the core content types in the appv file (e.g. DLL, EXE, BIN). |
+
AppxBlockMap.xml |
+XML File |
+Layout of the appv file, which uses File, Block, and BlockMap elements that enable location and validation of files in the App-V package. |
+
AppxManifest.xml |
+XML File |
+Metadata for the package that contains the required information for adding, publishing, and launching the package. Includes extension points (file type associations and shortcuts) and the names and GUIDs associated with the package. |
+
FilesystemMetadata.xml |
+XML File |
+List of the files captured during sequencing, including attributes (e.g., directories, files, opaque directories, empty directories,and long and short names). |
+
PackageHistory.xml |
+XML File |
+Information about the sequencing computer (operating system version, Internet Explorer version, .Net Framework version) and process (upgrade, package version). |
+
Registry.dat |
+DAT File |
+Registry keys and values captured during the sequencing process for the package. |
+
StreamMap.xml |
+XML File |
+List of files for the primary and publishing feature block. The publishing feature block contains the ICO files and required portions of files (EXE and DLL) for publishing the package. When present, the primary feature block includes files that have been optimized for streaming during the sequencing process. |
+
Name | +Location | +Description | +
---|---|---|
Package Store |
+%ProgramData%\App-V |
+Default location for read only package files |
+
Machine Catalog |
+%ProgramData%\Microsoft\AppV\Client\Catalog |
+Contains per-machine configuration documents |
+
User Catalog |
+%AppData%\Microsoft\AppV\Client\Catalog |
+Contains per-user configuration documents |
+
Shortcut Backups |
+%AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups |
+Stores previous integration points that enable restore on package unpublish |
+
Copy on Write (COW) Roaming |
+%AppData%\Microsoft\AppV\Client\VFS |
+Writeable roaming location for package modification |
+
Copy on Write (COW) Local |
+%LocalAppData%\Microsoft\AppV\Client\VFS |
+Writeable non-roaming location for package modification |
+
Machine Registry |
+HKLM\Software\Microsoft\AppV |
+Contains package state information, including VReg for machine or globally published packages (Machine hive) |
+
User Registry |
+HKCU\Software\Microsoft\AppV |
+Contains user package state information including VReg |
+
User Registry Classes |
+HKCU\Software\Classes\AppV |
+Contains additional user package state information |
+
Description |
+Stores package documents that are available to users on the machine, when packages are added and published. However, if a package is “global” at publishing time, the integrations are available to all users. +If a package is non-global, the integrations are published only for specific users, but there are still global resources that are modified and visible to anyone on the client computer (e.g., the package directory is in a shared disk location). +If a package is available to a user on the computer (global or non-global), the manifest is stored in the Machine Catalog. When a package is published globally, there is a Dynamic Configuration file, stored in the Machine Catalog; therefore, the determination of whether a package is global is defined according to whether there is a policy file (UserDeploymentConfiguration file) in the Machine Catalog. |
+
Default storage location |
+
This location is not the same as the Package Store location. The Package Store is the golden or pristine copy of the package files. |
+
Files in the machine catalog |
+
|
+
Additional machine catalog location, used when the package is part of a connection group |
+The following location is in addition to the specific package location mentioned above: +
|
+
Additional files in the machine catalog when the package is part of a connection group |
+
|
+
Description |
+Created during the publishing process. Contains information used for publishing the package, and also used at launch to ensure that a package is provisioned to a specific user. Created in a roaming location and includes user-specific publishing information. +When a package is published for a user, the policy file is stored in the User Catalog. At the same time, a copy of the manifest is also stored in the User Catalog. When a package entitlement is removed for a user, the relevant package files are removed from the User Catalog. Looking at the user catalog, an administrator can view the presence of a Dynamic Configuration file, which indicates that the package is entitled for that user. +For roaming users, the User Catalog needs to be in a roaming or shared location to preserve the legacy App-V behavior of targeting users by default. Entitlement and policy are tied to a user, not a computer, so they should roam with the user once they are provisioned. |
+
Default storage location |
+
|
+
Files in the user catalog |
+
|
+
Additional user catalog location, used when the package is part of a connection group |
+The following location is in addition to the specific package location mentioned above: +
|
+
Additional file in the machine catalog when the package is part of a connection group |
+
|
+
Registry.dat from Package Store |
+> |
+%ProgramData%\Microsoft\AppV\Client\Vreg\{VersionGuid}.dat |
+
Location |
+Description |
+
COW |
+
|
+
Package |
+
|
+
Native |
+
|
+
Location |
+Description |
+
COW |
+
|
+
Package |
+
|
+
Native |
+
|
+
Policy | +Description | +
---|---|
AllowHighCostLaunch |
+On Windows 8 and later, it allows streaming over 3G and cellular networks |
+
AutoLoad |
+Specifies the Background Load setting: +0 - Disabled +1 – Previously Used Packages only +2 – All Packages |
+
PackageInstallationRoot |
+The root folder for the package store in the local machine |
+
PackageSourceRoot |
+The root override where packages should be streamed from |
+
SharedContentStoreMode |
+Enables the use of Shared Content Store for VDI scenarios |
+
Scenario | +Description | +
---|---|
Applications that are run as standard users |
+When a standard user launches an App-V application, both HKLM and HKCU for App-V applications are stored in the HKCU hive on the machine. This presents as two distinct paths: +
The locations are enabled for roaming based on the operating system settings. |
+
Applications that are run with elevation |
+When an application is launched with elevation: +
In this scenario, these settings are not roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following location: +
|
+
VFS directory in package | +Mapped location of backing store | +
---|---|
ProgramFilesX86 |
+C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\ProgramFilesX86 |
+
SystemX86 |
+C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\SystemX86 |
+
Windows |
+C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\Windows |
+
appv_ROOT |
+C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\appv_ROOT |
+
AppData |
+C:\users\jsmith\AppData\Roaming\Microsoft\AppV\Client\VFS\<GUID>\AppData |
+
VFS directory in package | +Mapped location of backing store | +
---|---|
ProgramFilesX86 |
+C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\ProgramFilesX86 |
+
SystemX86 |
+C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\SystemX86 |
+
Windows |
+C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\Windows |
+
appv_ROOT |
+C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\appv_ROOT |
+
AppData |
+\\Fileserver\users\jsmith\roaming\Microsoft\AppV\Client\VFS\<GUID>\AppData |
+
Task type | +Applicable rule | +
---|---|
User-based task, e.g., publishing a package to a user |
+The pending task will be performed after the user logs off and then logs back on. |
+
Globally based task, e.g., enabling a connection group globally |
+The pending task will be performed when the computer is shut down and then restarted. |
+
User-based or globally based task | +Where the registry key is generated | +
---|---|
User-based tasks |
+KEY_CURRENT_USER\Software\Microsoft\AppV\Client\PendingTasks |
+
Globally based tasks |
+HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\PendingTasks |
+
Task | +Details | +
---|---|
Add the package to the computer |
+This task is computer specific and you can perform it at any time by completing the steps in the Package Add section above. |
+
Publish the package |
+See the Package Publishing section above for steps. This process requires that you update extension points on the system. End users cannot be using the application when you complete this task. |
+
Scenario | +Requirements | +
---|---|
App-V package is not in use when you try to upgrade |
+None of the following components of the package can be in use: virtual application, COM server, or shell extensions. +The administrator publishes a newer version of the package and the upgrade works the next time a component or application inside the package is launched. The new version of the package is streamed and run. Nothing has changed in this scenario in App-V 5 SP2 from previous releases of App-V 5. |
+
App-V package is in use when the administrator publishes a newer version of the package |
+The upgrade operation is set to pending by the App-V Client, which means that it is queued and carried out later when the package is not in use. +If the package application is in use, the user shuts down the virtual application, after which the upgrade can occur. +If the package has shell extensions (Office 2013), which are permanently loaded by Windows Explorer, the user cannot be logged in. Users must log off and the log back in to initiate the App-V package upgrade. |
+
Handler | +Description | +
---|---|
Context menu handler |
+Adds menu items to the context menu. It is called before the context menu is displayed. |
+
Drag-and-drop handler |
+Controls the action upon right-click drag-and-drop and modifies the context menu that appears. |
+
Drop target handler |
+Controls the action after a data object is dragged-and-dropped over a drop target such as a file. |
+
Data object handler |
+Controls the action after a file is copied to the clipboard or dragged-and-dropped over a drop target. It can provide additional clipboard formats to the drop target. |
+
Property sheet handler |
+Replaces or adds pages to the property sheet dialog box of an object. |
+
Infotip handler |
+Allows retrieving flags and infotip information for an item and displaying it inside a popup tooltip upon mouse- hover. |
+
Column handler |
+Allows creating and displaying custom columns in Windows Explorer Details view. It can be used to extend sorting and grouping. |
+
Preview handler |
+Enables a preview of a file to be displayed in the Windows Explorer Preview Pane. |
+
Virtual Extension | +Requires target OS Sequencing | +Requires Global Publishing | +
---|---|---|
Shortcut |
++ | + |
File Type Association |
++ | + |
URL Protocols |
+X |
++ |
AppPaths |
+X |
++ |
COM Mode |
++ | + |
Software Client |
+X |
++ |
Application Capabilities |
+X |
+X |
+
Context Menu Handler |
+X |
+X |
+
Drag-and-drop Handler |
+X |
++ |
Data Object Handler |
+X |
++ |
Property Sheet Handler |
+X |
++ |
Infotip Handler |
+X |
++ |
Column Handler |
+X |
++ |
Shell Extensions |
+X |
++ |
Browser Helper Object |
+X |
+X |
+
Active X Object |
+X |
+X |
+
Handler | +Description | +
---|---|
Context menu handler |
+Adds menu items to the context menu. It is called before the context menu is displayed. |
+
Drag-and-drop handler |
+Controls the action where right-click, drag and drop and modifies the context menu that appears. |
+
Drop target handler |
+Controls the action after a data object is dragged and dropped over a drop target such as a file. |
+
Data object handler |
+Controls the action after a file is copied to the clipboard or dragged and dropped over a drop target. It can provide additional clipboard formats to the drop target. |
+
Property sheet handler |
+Replaces or adds pages to the property sheet dialog box of an object. |
+
Infotip handler |
+Allows retrieving flags and infotip information for an item and displaying it inside a pop-up tooltip upon mouse hover. |
+
Column handler |
+Allows creating and displaying custom columns in Windows Explorer Details view. It can be used to extend sorting and grouping. |
+
Preview handler |
+Enables a preview of a file to be displayed in the Windows Explorer Preview pane. |
+
Handler | +Description | +
---|---|
Context menu handler |
+Adds menu items to the context menu. It is called before the context menu is displayed. |
+
Drag-and-drop handler |
+Controls the action where right-click, drag and drop and modifies the context menu that appears. |
+
Drop target handler |
+Controls the action after a data object is dragged and dropped over a drop target such as a file. |
+
Data object handler |
+Controls the action after a file is copied to the clipboard or dragged and dropped over a drop target. It can provide additional clipboard formats to the drop target. |
+
Property sheet handler |
+Replaces or adds pages to the property sheet dialog box of an object. |
+
Infotip handler |
+Allows retrieving flags and infotip information for an item and displaying it inside a pop-up tooltip upon mouse hover. |
+
Column handler |
+Allows creating and displaying custom columns in Windows Explorer Details view. It can be used to extend sorting and grouping. |
+
Preview handler |
+Enables a preview of a file to be displayed in the Windows Explorer Preview pane. |
+
Supported item | +Level of support | +
---|---|
Supported App-V versions |
+
|
+
Package creation |
+
|
+
Supported licensing |
+Volume Licensing |
+
Supported deployments |
+
|
+
Extension Point | +Description | +Office 2010 | +
---|---|---|
Lync meeting Join Plug-in for Firefox and Chrome |
+User can join Lync meetings from Firefox and Chrome |
++ |
Sent to OneNote Print Driver |
+User can print to OneNote |
+Yes |
+
OneNote Linked Notes |
+OneNote Linked Notes |
++ |
Send to OneNote Internet Explorer Add-In |
+User can send to OneNote from IE |
++ |
Firewall Exception for Lync and Outlook |
+Firewall Exception for Lync and Outlook |
++ |
MAPI Client |
+Native apps and add-ins can interact with virtual Outlook through MAPI |
++ |
SharePoint Plugin for Firefox |
+User can use SharePoint features in Firefox |
++ |
Mail Control Panel Applet |
+User gets the mail control panel applet in Outlook |
+Yes |
+
Primary Interop Assemblies |
+Support managed add-ins |
++ |
Office Document Cache Handler |
+Allows Document Cache for Office applications |
++ |
Outlook Protocol Search handler |
+User can search in outlook |
+Yes |
+
Active X Controls: |
+For more information on ActiveX controls, refer to [ActiveX Control API Reference](http://go.microsoft.com/fwlink/p/?LinkId=331361). |
++ |
Groove.SiteClient |
+Active X Control |
++ |
PortalConnect.PersonalSite |
+Active X Control |
++ |
SharePoint.openDocuments |
+Active X Control |
++ |
SharePoint.ExportDatabase |
+Active X Control |
++ |
SharePoint.SpreadSheetLauncher |
+Active X Control |
++ |
SharePoint.StssyncHander |
+Active X Control |
++ |
SharePoint.DragUploadCtl |
+Active X Control |
++ |
SharePoint.DragDownloadCtl |
+Active X Control |
++ |
Sharpoint.OpenXMLDocuments |
+Active X Control |
++ |
Sharepoint.ClipboardCtl |
+Active X control |
++ |
WinProj.Activator |
+Active X Control |
++ |
Name.NameCtrl |
+Active X Control |
++ |
STSUPld.CopyCtl |
+Active X Control |
++ |
CommunicatorMeetingJoinAx.JoinManager |
+Active X Control |
++ |
LISTNET.Listnet |
+Active X Control |
++ |
OneDrive Pro Browser Helper |
+Active X Control] |
++ |
OneDrive Pro Icon Overlays |
+Windows explorer shell icon overlays when users look at folders OneDrive Pro folders |
++ |
Supported item | +Level of support | +
---|---|
Supported App-V versions |
+
|
+
Package creation |
+
|
+
Supported licensing |
+Volume Licensing |
+
Supported deployments |
+
|
+
Extension Point | +Description | +Office 2010 | +
---|---|---|
Lync meeting Join Plug-in for Firefox and Chrome |
+User can join Lync meetings from Firefox and Chrome |
++ |
Sent to OneNote Print Driver |
+User can print to OneNote |
+Yes |
+
OneNote Linked Notes |
+OneNote Linked Notes |
++ |
Send to OneNote Internet Explorer Add-In |
+User can send to OneNote from IE |
++ |
Firewall Exception for Lync and Outlook |
+Firewall Exception for Lync and Outlook |
++ |
MAPI Client |
+Native apps and add-ins can interact with virtual Outlook through MAPI |
++ |
SharePoint Plugin for Firefox |
+User can use SharePoint features in Firefox |
++ |
Mail Control Panel Applet |
+User gets the mail control panel applet in Outlook |
+Yes |
+
Primary Interop Assemblies |
+Support managed add-ins |
++ |
Office Document Cache Handler |
+Allows Document Cache for Office applications |
++ |
Outlook Protocol Search handler |
+User can search in outlook |
+Yes |
+
Active X Controls: |
+For more information on ActiveX controls, refer to [ActiveX Control API Reference](http://go.microsoft.com/fwlink/p/?LinkId=331361). |
++ |
Groove.SiteClient |
+Active X Control |
++ |
PortalConnect.PersonalSite |
+Active X Control |
++ |
SharePoint.openDocuments |
+Active X Control |
++ |
SharePoint.ExportDatabase |
+Active X Control |
++ |
SharePoint.SpreadSheetLauncher |
+Active X Control |
++ |
SharePoint.StssyncHander |
+Active X Control |
++ |
SharePoint.DragUploadCtl |
+Active X Control |
++ |
SharePoint.DragDownloadCtl |
+Active X Control |
++ |
Sharpoint.OpenXMLDocuments |
+Active X Control |
++ |
Sharepoint.ClipboardCtl |
+Active X control |
++ |
WinProj.Activator |
+Active X Control |
++ |
Name.NameCtrl |
+Active X Control |
++ |
STSUPld.CopyCtl |
+Active X Control |
++ |
CommunicatorMeetingJoinAx.JoinManager |
+Active X Control |
++ |
LISTNET.Listnet |
+Active X Control |
++ |
OneDrive Pro Browser Helper |
+Active X Control] |
++ |
OneDrive Pro Icon Overlays |
+Windows explorer shell icon overlays when users look at folders OneDrive Pro folders |
++ |
Information to review | +Description | +
---|---|
[Planning for Using App-V with Office](planning-for-using-app-v-with-office.md#bkmk-office-vers-supp-appv) |
+
|
+
[Planning for Using App-V with Office](planning-for-using-app-v-with-office.md#bkmk-plan-coexisting) |
+Considerations for installing different versions of Office on the same computer |
+
Task | +Requirement | +
---|---|
Packaging |
+
|
+
Publishing |
+
|
+
Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services: +
|
+You must enable [shared computer activation](http://technet.microsoft.com/library/dn782860.aspx). +You don’t use shared computer activation if you’re deploying a volume licensed product, such as: +
|
+
Task | +Details | +
---|---|
Use the ExcludeApp setting when you create the package by using the Office Deployment Tool. |
+
|
+
Modify the DeploymentConfig.xml file |
+
|
+
Prerequisite | +Description | +
---|---|
Prerequisite software |
+.Net Framework 4 |
+
Supported operating systems |
+
|
+
Input | +Description | +Example | +
---|---|---|
Add element |
+ Specifies the products and languages to include in the package. |
+ N/A |
+
OfficeClientEdition (attribute of Add element) |
+ Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value. |
+ OfficeClientEdition="32" +OfficeClientEdition="64" |
+
Product element |
+ Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications. |
+
|
+
Language element |
+ Specifies the language supported in the applications |
+
|
+
Version (attribute of Add element) |
+ Optional. Specifies a build to use for the package +Defaults to latest advertised build (as defined in v32.CAB at the Office source). |
+
|
+
SourcePath (attribute of Add element) |
+ Specifies the location in which the applications will be saved to. |
+
|
+
\\server\Office2013 |
+ is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml. |
+
Setup.exe |
+ is the Office Deployment Tool. |
+
/download |
+ downloads the Office 2013 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2013 App-V package with Volume Licensing. |
+
\\server\Office2013\Customconfig.xml |
+ passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \\Server\Office2013. |
+
Product ID | +Volume Licensing | +Subscription Licensing | +
---|---|---|
Office 2013 |
+ProPlusVolume |
+O365ProPlusRetail |
+
Office 2013 with Visio 2013 |
+ProPlusVolume +VisioProVolume |
+O365ProPlusRetail +VisioProRetail |
+
Office 2013 with Visio 2013 and Project 2013 |
+ProPlusVolume +VisioProVolume +ProjectProVolume |
+O365ProPlusRetail +VisioProRetail +ProjectProRetail |
+
Parameter | +What to change the value to | +||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
SourcePath |
+ Point to the Office applications downloaded earlier. |
+ ||||||||||||
ProductID |
+ Specify the type of licensing, as shown in the following examples: +
|
+ ||||||||||||
ExcludeApp (optional) |
+ Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath. |
+ ||||||||||||
PACKAGEGUID (optional) |
+ By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server. +An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users. +
+ Note
+
+ Even if you use unique package IDs, you can still deploy only one App-V package to a single device. +
+
+ |
+
\\server\Office2013 |
+ is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml. |
+
Setup.exe |
+ is the Office Deployment Tool. |
+
/packager |
+ creates the Office 2013 App-V package with Volume Licensing as specified in the customConfig.xml file. |
+
\\server\Office2013\Customconfig.xml |
+ passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage. |
+
\\server\share\Office 2013AppV |
+ specifies the location of the newly created Office App-V package. |
+
Prerequisite or requirement | +Details | +
---|---|
Enable PowerShell scripting on the App-V clients |
+To publish Office 2013 packages, you must run a script. +Package scripts are disabled by default on App-V clients. To enable scripting, run the following PowerShell command: +
|
+
Publish the Office 2013 package globally |
+Extension points in the Office App-V package require installation at the computer level. +When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2013 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages. |
+
Task | +Details | +||||||
---|---|---|---|---|---|---|---|
How do I package and publish Visio 2013 and Project 2013 with Office? |
+You must include Visio 2013 and Project 2013 in the same package with Office. +If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow the [Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0](../solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md#bkmk-pkg-pub-reqs). |
+||||||
How can I deploy Visio 2013 and Project 2013 to specific users? |
+Use one of the following methods: +
|
+
Information to review | +Description | +
---|---|
[Planning for Using App-V with Office](planning-for-using-app-v-with-office51.md#bkmk-office-vers-supp-appv) |
+
|
+
[Planning for Using App-V with Office](planning-for-using-app-v-with-office51.md#bkmk-plan-coexisting) |
+Considerations for installing different versions of Office on the same computer |
+
Task | +Requirement | +
---|---|
Packaging |
+
|
+
Publishing |
+
|
+
Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services: +
|
+You must enable [shared computer activation](http://technet.microsoft.com/library/dn782860.aspx). +You don’t use shared computer activation if you’re deploying a volume licensed product, such as: +
|
+
Task | +Details | +
---|---|
Use the ExcludeApp setting when you create the package by using the Office Deployment Tool. |
+
|
+
Modify the DeploymentConfig.xml file |
+
|
+
Prerequisite | +Description | +
---|---|
Prerequisite software |
+.Net Framework 4 |
+
Supported operating systems |
+
|
+
Input | +Description | +Example | +
---|---|---|
Add element |
+ Specifies the products and languages to include in the package. |
+ N/A |
+
OfficeClientEdition (attribute of Add element) |
+ Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value. |
+ OfficeClientEdition="32" +OfficeClientEdition="64" |
+
Product element |
+ Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications. |
+
|
+
Language element |
+ Specifies the language supported in the applications |
+
|
+
Version (attribute of Add element) |
+ Optional. Specifies a build to use for the package +Defaults to latest advertised build (as defined in v32.CAB at the Office source). |
+
|
+
SourcePath (attribute of Add element) |
+ Specifies the location in which the applications will be saved to. |
+
|
+
\\server\Office2013 |
+ is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml. |
+
Setup.exe |
+ is the Office Deployment Tool. |
+
/download |
+ downloads the Office 2013 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2013 App-V package with Volume Licensing. |
+
\\server\Office2013\Customconfig.xml |
+ passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \\Server\Office2013. |
+
Product ID | +Volume Licensing | +Subscription Licensing | +
---|---|---|
Office 2013 |
+ProPlusVolume |
+O365ProPlusRetail |
+
Office 2013 with Visio 2013 |
+ProPlusVolume +VisioProVolume |
+O365ProPlusRetail +VisioProRetail |
+
Office 2013 with Visio 2013 and Project 2013 |
+ProPlusVolume +VisioProVolume +ProjectProVolume |
+O365ProPlusRetail +VisioProRetail +ProjectProRetail |
+
Parameter | +What to change the value to | +||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
SourcePath |
+ Point to the Office applications downloaded earlier. |
+ ||||||||||||
ProductID |
+ Specify the type of licensing, as shown in the following examples: +
|
+ ||||||||||||
ExcludeApp (optional) |
+ Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath. |
+ ||||||||||||
PACKAGEGUID (optional) |
+ By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server. +An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users. +
+ Note
+
+ Even if you use unique package IDs, you can still deploy only one App-V package to a single device. +
+
+ |
+
\\server\Office2013 |
+ is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml. |
+
Setup.exe |
+ is the Office Deployment Tool. |
+
/packager |
+ creates the Office 2013 App-V package with Volume Licensing as specified in the customConfig.xml file. |
+
\\server\Office2013\Customconfig.xml |
+ passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage. |
+
\\server\share\Office 2013AppV |
+ specifies the location of the newly created Office App-V package. |
+
Prerequisite or requirement | +Details | +
---|---|
Enable PowerShell scripting on the App-V clients |
+To publish Office 2013 packages, you must run a script. +Package scripts are disabled by default on App-V clients. To enable scripting, run the following PowerShell command: +
|
+
Publish the Office 2013 package globally |
+Extension points in the Office App-V package require installation at the computer level. +When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2013 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages. |
+
Task | +Details | +||||||
---|---|---|---|---|---|---|---|
How do I package and publish Visio 2013 and Project 2013 with Office? |
+You must include Visio 2013 and Project 2013 in the same package with Office. +If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow the [Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0](../solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md#bkmk-pkg-pub-reqs). |
+||||||
How can I deploy Visio 2013 and Project 2013 to specific users? |
+Use one of the following methods: +
|
+
Element | +Description | +
---|---|
App-V Management Server |
+
|
+
App-V Publishing Server |
+
|
+
App-V Desktop Client |
+
|
+
App-V Remote Desktop Services (RDS) Client |
+Enables Remote Desktop Session Host servers to use the capabilities of the App-V Desktop Client for shared desktop sessions. |
+
App-V Sequencer |
+
|
+
Element | +Description | +
---|---|
App-V Management Server |
+
|
+
App-V Publishing Server |
+
|
+
App-V Desktop Client |
+
|
+
App-V Remote Desktop Services (RDS) Client |
+Enables Remote Desktop Session Host servers to use the capabilities of the App-V Desktop Client for shared desktop sessions. |
+
App-V Sequencer |
+
|
+
Element | +More information | +
---|---|
App-V 5.0 Management Server |
+The App-V 5.0 Management server provides overall management functionality for the App-V 5.0 infrastructure. Additionally, you can install more than one instance of the management server in your environment which provides the following benefits: +
|
+
App-V 5.0 Publishing Server |
+The App-V 5.0 publishing server provides functionality for virtual application hosting and streaming. The publishing server does not require a database connection and supports the following protocols: +
You can also help increase App-V 5.0 availability by installing the Publishing server on multiple computers. A network load balancer should also be considered so that server requests are balanced. |
+
App-V 5.0 Reporting Server |
+The App-V 5.0 Reporting server enables authorized users to run and view existing App-V 5.0 reports and ad hoc reports that can help them manage the App-V 5.0 infrastructure. The Reporting server requires a connection to the App-V 5.0 reporting database. You can also help increase App-V 5.0 availability by installing the Reporting server on multiple computers. A network load balancer should also be considered so that server requests are balanced. |
+
App-V 5.0 Client |
+The App-V 5.0 client enables packages created using App-V 5.0 to run on target computers. |
+
Element | +More information | +
---|---|
App-V 5.1 Management Server |
+The App-V 5.1 Management server provides overall management functionality for the App-V 5.1 infrastructure. Additionally, you can install more than one instance of the management server in your environment which provides the following benefits: +
|
+
App-V 5.1 Publishing Server |
+The App-V 5.1 publishing server provides functionality for virtual application hosting and streaming. The publishing server does not require a database connection and supports the following protocols: +
You can also help increase App-V 5.1 availability by installing the Publishing server on multiple computers. A network load balancer should also be considered so that server requests are balanced. |
+
App-V 5.1 Reporting Server |
+The App-V 5.1 Reporting server enables authorized users to run and view existing App-V 5.1 reports and ad hoc reports that can help them manage the App-V 5.1 infrastructure. The Reporting server requires a connection to the App-V 5.1 reporting database. You can also help increase App-V 5.1 availability by installing the Reporting server on multiple computers. A network load balancer should also be considered so that server requests are balanced. |
+
App-V 5.1 Client |
+The App-V 5.1 client enables packages created using App-V 5.1 to run on target computers. |
+
Method | +Steps | +
---|---|
Group Policy setting |
+Enable the “Require publish as administrator” Group Policy setting, which is located in the following Group Policy Object node: +Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing |
+
PowerShell cmdlet |
+Run the Set-AppvClientConfiguration cmdlet with the –RequirePublishAsAdmin parameter. +Parameter values: +
Example:: Set-AppvClientConfiguration –RequirePublishAsAdmin1 |
+
Method | +Steps | +
---|---|
Group Policy setting |
+Enable the “Require publish as administrator” Group Policy setting, which is located in the following Group Policy Object node: +Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing |
+
PowerShell cmdlet |
+Run the Set-AppvClientConfiguration cmdlet with the –RequirePublishAsAdmin parameter. +Parameter values: +
Example:: Set-AppvClientConfiguration –RequirePublishAsAdmin1 |
+
Unsupported scenarios and potential issues | +Result | +
---|---|
You cannot include user-published packages in globally entitled connection groups. |
+The connection group will fail. |
+
If you publish a package globally and then create a user-published connection group in which you’ve made that package non-optional, you can still run Unpublish-AppvClientPackage <package> -global to unpublish the package, even when that package is being used in another connection group. |
+If any other connection groups are using that package, the package will fail in those connection groups. +To avoid inadvertently unpublishing a non-optional package that is being used in another connection group, we recommend that you track the connection groups in which you’ve used a non-optional package. |
+
Unsupported scenarios and potential issues | +Result | +
---|---|
You cannot include user-published packages in globally entitled connection groups. |
+The connection group will fail. |
+
If you publish a package globally and then create a user-published connection group in which you’ve made that package non-optional, you can still run Unpublish-AppvClientPackage <package> -global to unpublish the package, even when that package is being used in another connection group. |
+If any other connection groups are using that package, the package will fail in those connection groups. +To avoid inadvertently unpublishing a non-optional package that is being used in another connection group, we recommend that you track the connection groups in which you’ve used a non-optional package. |
+
Method | +Description | +
---|---|
Functionality provided by a third-party ESD |
+Use the functionality in a third-party ESD. |
+
Stand-alone Windows Installer |
+Install the application on the target client computer by using the associated Windows Installer (.msi) file that is created when you initially sequence an application. The Windows Installer file contains the associated App-V 5.0 package file information used to configure a package and copies the required package files to the client. |
+
PowerShell |
+Use PowerShell cmdlets to deploy virtualized applications. For more information about using PowerShell and App-V 5.0, see [Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md). |
+
Method | +Description | +
---|---|
Functionality provided by a third-party ESD |
+Use the functionality in a third-party ESD. |
+
Stand-alone Windows Installer |
+Install the application on the target client computer by using the associated Windows Installer (.msi) file that is created when you initially sequence an application. The Windows Installer file contains the associated App-V 5.1 package file information used to configure a package and copies the required package files to the client. |
+
PowerShell |
+Use PowerShell cmdlets to deploy virtualized applications. For more information about using PowerShell and App-V 5.1, see [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md). |
+
Component | +Description | +
---|---|
Management server |
+ Provides overall management functionality for the App-V infrastructure. |
+
Management database |
+ Facilitates database predeployments for App-V management. |
+
Publishing server |
+ Provides hosting and streaming functionality for virtual applications. |
+
Reporting server |
+ Provides App-V 5.0 reporting services. |
+
Reporting database |
+ Facilitates database predeployments for App-V reporting. |
+
Method | +What you need to do | +
---|---|
You are using a custom Microsoft SQL Server instance. |
+ Select Use the custom instance, and type the name of the instance. +Use the format INSTANCENAME. The assumed installation location is the local computer. +Not supported: A server name using the format ServerName\INSTANCE. |
+
You are using a custom database name. |
+ Select Custom configuration and type the database name. +The database name must be unique, or the installation will fail. |
+
Method | +What you need to do | +
---|---|
You are using a custom Microsoft SQL Server instance. |
+ Select Use the custom instance, and type the name of the instance. +Use the format INSTANCENAME. The assumed installation location is the local computer. +Not supported: A server name using the format ServerName\INSTANCE. |
+
You are using a custom database name. |
+ Select Custom configuration and type the database name. +The database name must be unique, or the installation will fail. |
+
Item to configure | +Description and examples | +
---|---|
Type the AD group with sufficient permissions to manage the App-V environment. |
+ Example: MyDomain\MyUser +After installation, you can add additional users or groups by using the Management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups are required to perform this action. |
+
Website name: Specify the custom name that will be used to run the publishing service. |
+ If you do not have a custom name, do not make any changes. |
+
Port binding: Specify a unique port number that will be used by App-V. |
+ Example: 12345 +Ensure that the port specified is not being used by another website. |
+
Item to configure | +Description and examples | +
---|---|
Specify the URL for the management service. |
+ Example: http://localhost:12345 |
+
Website name: Specify the custom name that will be used to run the publishing service. |
+ If you do not have a custom name, do not make any changes. |
+
Port binding: Specify a unique port number that will be used by App-V. |
+ Example: 54321 +Ensure that the port specified is not being used by another website. |
+
Item to configure | +Description and examples | +
---|---|
Website name: Specify the custom name that will be used to run the Reporting Service. |
+ If you do not have a custom name, do not make any changes. |
+
Port binding: Specify a unique port number that will be used by App-V. |
+ Example: 55555 +Ensure that the port specified is not being used by another website. |
+
To Install the Management server and Management database on a local machine. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use the following parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/MANAGEMENT_SERVER +/MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup” +/MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service” +/MANAGEMENT_WEBSITE_PORT=”8080” +/DB_PREDEPLOY_MANAGEMENT +/MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName” +/MANAGEMENT_DB_NAME=”AppVManagement” |
+
To Install the Management server using an existing Management database on a local machine. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/MANAGEMENT_SERVER +/MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup” +/MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service” +/MANAGEMENT_WEBSITE_PORT=”8080” +/EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL +/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName” +/EXISTING_MANAGEMENT_DB_NAME =”AppVManagement” |
+
To install the Management server using an existing Management database on a remote machine. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/MANAGEMENT_SERVER +/MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup” +/MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service” +/MANAGEMENT_WEBSITE_PORT=”8080” +/EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME=”SqlServermachine.domainName” +/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName” +/EXISTING_MANAGEMENT_DB_NAME =”AppVManagement” |
+
To Install the Management database and the Management Server on the same computer. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/DB_PREDEPLOY_MANAGEMENT +/MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName” +/MANAGEMENT_DB_NAME=”AppVManagement” +/MANAGEMENT_SERVER_MACHINE_USE_LOCAL +/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount” |
+
To install the Management database on a different computer than the Management server. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/DB_PREDEPLOY_MANAGEMENT +/MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName” +/MANAGEMENT_DB_NAME=”AppVManagement” +/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount” +/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount” |
+
To Install the publishing server. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/PUBLISHING_SERVER +/PUBLISHING_MGT_SERVER=”http://ManagementServerName:ManagementPort” +/PUBLISHING_WEBSITE_NAME=”Microsoft AppV Publishing Service” +/PUBLISHING_WEBSITE_PORT=”8081” |
+
To Install the Reporting server and Reporting database on a local machine. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +
|
+
To Install the Reporting server and using an existing Reporting database on a local machine. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/REPORTING_SERVER +/REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service” +/REPORTING_WEBSITE_PORT=”8082” +/EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL +/EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName” +/EXITING_REPORTING_DB_NAME=”AppVReporting” |
+
To Install the Reporting server using an existing Reporting database on a remote machine. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/REPORTING_SERVER +/REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service” +/REPORTING_WEBSITE_PORT=”8082” +/EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME=”SqlServerMachine.DomainName” +/EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName” +/EXITING_REPORTING_DB_NAME=”AppVReporting” |
+
To install the Reporting database on the same computer as the Reporting server. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/DB_PREDEPLOY_REPORTING +/REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName” +/REPORTING_DB_NAME=”AppVReporting” +/REPORTING_SERVER_MACHINE_USE_LOCAL +/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount” |
+
To install the Reporting database on a different computer than the Reporting server. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/DB_PREDEPLOY_REPORTING +/REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName” +/REPORTING_DB_NAME=”AppVReporting” +/REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount” +/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount” |
+
Parameter | +Information | +
---|---|
/QUIET |
+ Specifies silent install. |
+
/UNINSTALL |
+ Specifies an uninstall. |
+
/LAYOUT |
+ Specifies layout action. This extracts the MSIs and script files to a folder without actually installing the product. No value is expected. |
+
/LAYOUTDIR |
+ Specifies the layout directory. Takes a string. For example, /LAYOUTDIR=”C:\Application Virtualization Server” |
+
/INSTALLDIR |
+ Specifies the installation directory. Takes a string. E.g. /INSTALLDIR=”C:\Program Files\Application Virtualization\Server” |
+
/MUOPTIN |
+ Enables Microsoft Update. No value is expected |
+
/ACCEPTEULA |
+ Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1. |
+
Parameter | +Information | +
---|---|
/MANAGEMENT_SERVER |
+ Specifies that the management server will be installed. No value is expected |
+
/MANAGEMENT_ADMINACCOUNT |
+ Specifies the account that will be allowed to Administrator access to the management server This account can be an individual user account or a group. Example usage: /MANAGEMENT_ADMINACCOUNT=”mydomain\admin”. If /MANAGEMENT_SERVER is not specified, this will be ignored. Specifies the account that will be allowed to Administrator access to the management server. This can be a user account or a group. For example, /MANAGEMENT_ADMINACCOUNT="mydomain\admin". |
+
/MANAGEMENT_WEBSITE_NAME |
+ Specifies name of the website that will be created for the management service. For example, /MANAGEMENT_WEBSITE_NAME=”Microsoft App-V Management Service” |
+
MANAGEMENT_WEBSITE_PORT |
+ Specifies the port number that will be used by the management service will use. For example, /MANAGEMENT_WEBSITE_PORT=82. |
+
Parameter | +Information | +
---|---|
/DB_PREDEPLOY_MANAGEMENT |
+ Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected |
+
/MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT |
+ Indicates that the default SQL instance should be used. No value is expected. |
+
/MANAGEMENT_DB_ CUSTOM_SQLINSTANCE |
+ Specifies the name of the custom SQL instance that should be used to create a new database. Example usage: /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”MYSQLSERVER”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored. |
+
/MANAGEMENT_DB_NAME |
+ Specifies the name of the new management database that should be created. Example usage: /MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored. |
+
/MANAGEMENT_SERVER_MACHINE_USE_LOCAL |
+ Indicates if the management server that will be accessing the database is installed on the local server. Switch parameter so no value is expected. |
+
/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT |
+ Specifies the machine account of the remote machine that the management server will be installed on. Example usage: /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”domain\computername” |
+
/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT |
+ Indicates the Administrator account that will be used to install the management server. Example usage: /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT =”domain\alias” |
+
Parameter | +Information | +
---|---|
/PUBLISHING_SERVER |
+ Specifies that the Publishing Server will be installed. No value is expected |
+
/PUBLISHING_MGT_SERVER |
+ Specifies the URL to Management Service the Publishing server will connect to. Example usage: http://<management server name>:<Management server port number>. If /PUBLISHING_SERVER is not used, this parameter will be ignored |
+
/PUBLISHING_WEBSITE_NAME |
+ Specifies name of the website that will be created for the publishing service. For example, /PUBLISHING_WEBSITE_NAME=”Microsoft App-V Publishing Service” |
+
/PUBLISHING_WEBSITE_PORT |
+ Specifies the port number used by the publishing service. For example, /PUBLISHING_WEBSITE_PORT=83 |
+
Parameter | +Information | +
---|---|
/REPORTING_SERVER |
+ Specifies that the Reporting Server will be installed. No value is expected |
+
/REPORTING_WEBSITE_NAME |
+ Specifies name of the website that will be created for the Reporting Service. E.g. /REPORTING_WEBSITE_NAME="Microsoft App-V ReportingService" |
+
/REPORTING_WEBSITE_PORT |
+ Specifies the port number that the Reporting Service will use. E.g. /REPORTING_WEBSITE_PORT=82 |
+
Parameter | +Information | +
---|---|
/EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL |
+ Indicates that the Microsoft SQL Server is installed on the local server. Switch parameter so no value is expected. |
+
/EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME |
+ Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_REPORTING_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1" |
+
/EXISTING_ REPORTING _DB_SQLINSTANCE_USE_DEFAULT |
+ Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. |
+
/EXISTING_ REPORTING_DB_CUSTOM_SQLINSTANCE |
+ Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER" |
+
/EXISTING_ REPORTING _DB_NAME |
+ Specifies the name of the existing Reporting database that should be used. Takes a string. E.g. /EXISITING_REPORTING_DB_NAME="AppVReporting" |
+
Parameter | +Information | +
---|---|
/DB_PREDEPLOY_REPORTING |
+ Specifies that the Reporting Database will be installed. DBA permissions are required for this installation. No value is expected |
+
/REPORTING_DB_SQLINSTANCE_USE_DEFAULT |
+ Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER" |
+
/REPORTING_DB_NAME |
+ Specifies the name of the new Reporting database that should be created. Takes a string. E.g. /REPORTING_DB_NAME="AppVMgmtDB" |
+
/REPORTING_SERVER_MACHINE_USE_LOCAL |
+ Indicates that the Reporting server that will be accessing the database is installed on the local server. Switch parameter so no value is expected. |
+
/REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT |
+ Specifies the machine account of the remote machine that the Reporting server will be installed on. Takes a string. E.g. /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT = "domain\computername" |
+
/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT |
+ Indicates the Administrator account that will be used to install the App-V Reporting Server. Takes a string. E.g. /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT = "domain\alias" |
+
Parameter | +Information | +
---|---|
/EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL |
+ Indicates that the SQL Server is installed on the local server. Switch parameter so no value is expected.If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored. |
+
/EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME |
+ Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_MANAGEMENT_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1" |
+
/EXISTING_ MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT |
+ Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored. |
+
/EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE |
+ Specifies the name of the custom SQL instance that will be used. Example usage /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”AppVManagement”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored. |
+
/EXISTING_MANAGEMENT_DB_NAME |
+ Specifies the name of the existing management database that should be used. Example usage: /EXISITING_MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored. + +Got a suggestion for App-V? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). Got an App-V issue? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). |
+
To Install the Management server and Management database on a local machine. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use the following parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/MANAGEMENT_SERVER +/MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup” +/MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service” +/MANAGEMENT_WEBSITE_PORT=”8080” +/DB_PREDEPLOY_MANAGEMENT +/MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName” +/MANAGEMENT_DB_NAME=”AppVManagement” |
+
To Install the Management server using an existing Management database on a local machine. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/MANAGEMENT_SERVER +/MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup” +/MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service” +/MANAGEMENT_WEBSITE_PORT=”8080” +/EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL +/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName” +/EXISTING_MANAGEMENT_DB_NAME =”AppVManagement” |
+
To install the Management server using an existing Management database on a remote machine. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/MANAGEMENT_SERVER +/MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup” +/MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service” +/MANAGEMENT_WEBSITE_PORT=”8080” +/EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME=”SqlServermachine.domainName” +/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName” +/EXISTING_MANAGEMENT_DB_NAME =”AppVManagement” |
+
To Install the Management database and the Management Server on the same computer. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/DB_PREDEPLOY_MANAGEMENT +/MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName” +/MANAGEMENT_DB_NAME=”AppVManagement” +/MANAGEMENT_SERVER_MACHINE_USE_LOCAL +/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount” |
+
To install the Management database on a different computer than the Management server. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/DB_PREDEPLOY_MANAGEMENT +/MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName” +/MANAGEMENT_DB_NAME=”AppVManagement” +/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount” +/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount” |
+
To Install the publishing server. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/PUBLISHING_SERVER +/PUBLISHING_MGT_SERVER=”http://ManagementServerName:ManagementPort” +/PUBLISHING_WEBSITE_NAME=”Microsoft AppV Publishing Service” +/PUBLISHING_WEBSITE_PORT=”8081” |
+
To Install the Reporting server and Reporting database on a local machine. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +
|
+
To Install the Reporting server and using an existing Reporting database on a local machine. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/REPORTING_SERVER +/REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service” +/REPORTING_WEBSITE_PORT=”8082” +/EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL +/EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName” +/EXITING_REPORTING_DB_NAME=”AppVReporting” |
+
To Install the Reporting server using an existing Reporting database on a remote machine. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/REPORTING_SERVER +/REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service” +/REPORTING_WEBSITE_PORT=”8082” +/EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME=”SqlServerMachine.DomainName” +/EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName” +/EXITING_REPORTING_DB_NAME=”AppVReporting” |
+
To install the Reporting database on the same computer as the Reporting server. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/DB_PREDEPLOY_REPORTING +/REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName” +/REPORTING_DB_NAME=”AppVReporting” +/REPORTING_SERVER_MACHINE_USE_LOCAL +/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount” |
+
To install the Reporting database on a different computer than the Reporting server. |
+ To use the default instance of Microsoft SQL Server, use the following parameters: +
To use a custom instance of Microsoft SQL Server, use these parameters: +
Using a custom instance of Microsoft SQL Server example: +/appv_server_setup.exe /QUIET +/DB_PREDEPLOY_REPORTING +/REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName” +/REPORTING_DB_NAME=”AppVReporting” +/REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount” +/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount” |
+
Parameter | +Information | +
---|---|
/QUIET |
+ Specifies silent install. |
+
/UNINSTALL |
+ Specifies an uninstall. |
+
/LAYOUT |
+ Specifies layout action. This extracts the MSIs and script files to a folder without actually installing the product. No value is expected. |
+
/LAYOUTDIR |
+ Specifies the layout directory. Takes a string. For example, /LAYOUTDIR=”C:\Application Virtualization Server” |
+
/INSTALLDIR |
+ Specifies the installation directory. Takes a string. E.g. /INSTALLDIR=”C:\Program Files\Application Virtualization\Server” |
+
/MUOPTIN |
+ Enables Microsoft Update. No value is expected |
+
/ACCEPTEULA |
+ Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1. |
+
Parameter | +Information | +
---|---|
/MANAGEMENT_SERVER |
+ Specifies that the management server will be installed. No value is expected |
+
/MANAGEMENT_ADMINACCOUNT |
+ Specifies the account that will be allowed to Administrator access to the management server This account can be an individual user account or a group. Example usage: /MANAGEMENT_ADMINACCOUNT=”mydomain\admin”. If /MANAGEMENT_SERVER is not specified, this will be ignored. Specifies the account that will be allowed to Administrator access to the management server. This can be a user account or a group. For example, /MANAGEMENT_ADMINACCOUNT="mydomain\admin". |
+
/MANAGEMENT_WEBSITE_NAME |
+ Specifies name of the website that will be created for the management service. For example, /MANAGEMENT_WEBSITE_NAME=”Microsoft App-V Management Service” |
+
MANAGEMENT_WEBSITE_PORT |
+ Specifies the port number that will be used by the management service will use. For example, /MANAGEMENT_WEBSITE_PORT=82. |
+
Parameter | +Information | +
---|---|
/DB_PREDEPLOY_MANAGEMENT |
+ Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected |
+
/MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT |
+ Indicates that the default SQL instance should be used. No value is expected. |
+
/MANAGEMENT_DB_ CUSTOM_SQLINSTANCE |
+ Specifies the name of the custom SQL instance that should be used to create a new database. Example usage: /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”MYSQLSERVER”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored. |
+
/MANAGEMENT_DB_NAME |
+ Specifies the name of the new management database that should be created. Example usage: /MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored. |
+
/MANAGEMENT_SERVER_MACHINE_USE_LOCAL |
+ Indicates if the management server that will be accessing the database is installed on the local server. Switch parameter so no value is expected. |
+
/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT |
+ Specifies the machine account of the remote machine that the management server will be installed on. Example usage: /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”domain\computername” |
+
/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT |
+ Indicates the Administrator account that will be used to install the management server. Example usage: /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT =”domain\alias” |
+
Parameter | +Information | +
---|---|
/PUBLISHING_SERVER |
+ Specifies that the Publishing Server will be installed. No value is expected |
+
/PUBLISHING_MGT_SERVER |
+ Specifies the URL to Management Service the Publishing server will connect to. Example usage: http://<management server name>:<Management server port number>. If /PUBLISHING_SERVER is not used, this parameter will be ignored |
+
/PUBLISHING_WEBSITE_NAME |
+ Specifies name of the website that will be created for the publishing service. For example, /PUBLISHING_WEBSITE_NAME=”Microsoft App-V Publishing Service” |
+
/PUBLISHING_WEBSITE_PORT |
+ Specifies the port number used by the publishing service. For example, /PUBLISHING_WEBSITE_PORT=83 |
+
Parameter | +Information | +
---|---|
/REPORTING_SERVER |
+ Specifies that the Reporting Server will be installed. No value is expected |
+
/REPORTING_WEBSITE_NAME |
+ Specifies name of the website that will be created for the Reporting Service. E.g. /REPORTING_WEBSITE_NAME="Microsoft App-V ReportingService" |
+
/REPORTING_WEBSITE_PORT |
+ Specifies the port number that the Reporting Service will use. E.g. /REPORTING_WEBSITE_PORT=82 |
+
Parameter | +Information | +
---|---|
/EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL |
+ Indicates that the Microsoft SQL Server is installed on the local server. Switch parameter so no value is expected. |
+
/EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME |
+ Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_REPORTING_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1" |
+
/EXISTING_ REPORTING _DB_SQLINSTANCE_USE_DEFAULT |
+ Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. |
+
/EXISTING_ REPORTING_DB_CUSTOM_SQLINSTANCE |
+ Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER" |
+
/EXISTING_ REPORTING _DB_NAME |
+ Specifies the name of the existing Reporting database that should be used. Takes a string. E.g. /EXISITING_REPORTING_DB_NAME="AppVReporting" |
+
Parameter | +Information | +
---|---|
/DB_PREDEPLOY_REPORTING |
+ Specifies that the Reporting Database will be installed. DBA permissions are required for this installation. No value is expected |
+
/REPORTING_DB_SQLINSTANCE_USE_DEFAULT |
+ Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER" |
+
/REPORTING_DB_NAME |
+ Specifies the name of the new Reporting database that should be created. Takes a string. E.g. /REPORTING_DB_NAME="AppVMgmtDB" |
+
/REPORTING_SERVER_MACHINE_USE_LOCAL |
+ Indicates that the Reporting server that will be accessing the database is installed on the local server. Switch parameter so no value is expected. |
+
/REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT |
+ Specifies the machine account of the remote machine that the Reporting server will be installed on. Takes a string. E.g. /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT = "domain\computername" |
+
/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT |
+ Indicates the Administrator account that will be used to install the App-V Reporting Server. Takes a string. E.g. /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT = "domain\alias" |
+
Parameter | +Information | +
---|---|
/EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL |
+ Indicates that the SQL Server is installed on the local server. Switch parameter so no value is expected.If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored. |
+
/EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME |
+ Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_MANAGEMENT_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1" |
+
/EXISTING_ MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT |
+ Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored. |
+
/EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE |
+ Specifies the name of the custom SQL instance that will be used. Example usage /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”AppVManagement”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored. |
+
/EXISTING_MANAGEMENT_DB_NAME |
+ Specifies the name of the existing management database that should be used. Example usage: /EXISITING_MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored. + +Got a suggestion for App-V? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). Got an App-V issue? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). |
+
Component | +Description | +
---|---|
Management server |
+ Provides overall management functionality for the App-V infrastructure. |
+
Management database |
+ Facilitates database predeployments for App-V management. |
+
Publishing server |
+ Provides hosting and streaming functionality for virtual applications. |
+
Reporting server |
+ Provides App-V 5.1 reporting services. |
+
Reporting database |
+ Facilitates database predeployments for App-V reporting. |
+
Method | +What you need to do | +
---|---|
You are using a custom Microsoft SQL Server instance. |
+ Select Use the custom instance, and type the name of the instance. +Use the format INSTANCENAME. The assumed installation location is the local computer. +Not supported: A server name using the format ServerName\INSTANCE. |
+
You are using a custom database name. |
+ Select Custom configuration and type the database name. +The database name must be unique, or the installation will fail. |
+
Method | +What you need to do | +
---|---|
You are using a custom Microsoft SQL Server instance. |
+ Select Use the custom instance, and type the name of the instance. +Use the format INSTANCENAME. The assumed installation location is the local computer. +Not supported: A server name using the format ServerName\INSTANCE. |
+
You are using a custom database name. |
+ Select Custom configuration and type the database name. +The database name must be unique, or the installation will fail. |
+
Item to configure | +Description and examples | +
---|---|
Type the AD group with sufficient permissions to manage the App-V environment. |
+ Example: MyDomain\MyUser +After installation, you can add additional users or groups by using the Management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups are required to perform this action. |
+
Website name: Specify the custom name that will be used to run the publishing service. |
+ If you do not have a custom name, do not make any changes. |
+
Port binding: Specify a unique port number that will be used by App-V. |
+ Example: 12345 +Ensure that the port specified is not being used by another website. |
+
Item to configure | +Description and examples | +
---|---|
Specify the URL for the management service. |
+ Example: http://localhost:12345 |
+
Website name: Specify the custom name that will be used to run the publishing service. |
+ If you do not have a custom name, do not make any changes. |
+
Port binding: Specify a unique port number that will be used by App-V. |
+ Example: 54321 +Ensure that the port specified is not being used by another website. |
+
Item to configure | +Description and examples | +
---|---|
Website name: Specify the custom name that will be used to run the Reporting Service. |
+ If you do not have a custom name, do not make any changes. |
+
Port binding: Specify a unique port number that will be used by App-V. |
+ Example: 55555 +Ensure that the port specified is not being used by another website. |
+
Deploying coexisting App-V clients |
+ [Planning for the App-V 5.1 Sequencer and Client Deployment](planning-for-the-app-v-51-sequencer-and-client-deployment.md) |
+
Unsupported or limited installation scenarios |
+ See the client section in [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md) |
+
Client registry information |
+
|
+
Client log files |
+
|
+
Client installation troubleshooting information |
+See the error log in the %temp% folder. To review the log files, click Start, type %temp%, and then look for the appv_ log. |
+
Client type | +File to use | +
---|---|
Standard version of the client |
+ appv_client_setup.exe |
+
Remote Desktop Services version of the client |
+ appv_client_setup_rds.exe |
+
/INSTALLDIR |
+ Specifies the installation directory. Example usage: /INSTALLDIR=C:\Program Files\AppV Client |
+
/CEIPOPTIN |
+ Enables participation in the Customer Experience Improvement Program. Example usage: /CEIPOPTIN=[0|1] |
+
/MUOPTIN |
+ Enables Microsoft Update. Example usage: /MUOPTIN=[0|1] |
+
/PACKAGEINSTALLATIONROOT |
+ Specifies the directory in which to install all new applications and updates. Example usage: /PACKAGEINSTALLATIONROOT='C:\App-V Packages' |
+
/PACKAGESOURCEROOT |
+ Overrides the source location for downloading package content. Example usage: /PACKAGESOURCEROOT='http://packageStore' |
+
/AUTOLOAD |
+ Specifies how new packages will be loaded by App-V 5.1 on a specific computer. The following options are enabled: [1]; automatically load all packages [2]; or automatically load no packages [0].Example usage: /AUTOLOAD=[0|1|2] |
+
/SHAREDCONTENTSTOREMODE |
+ Specifies that streamed package contents will be not be saved to the local hard disk. Example usage: /SHAREDCONTENTSTOREMODE=[0|1] |
+
/MIGRATIONMODE |
+ Allows the App-V 5.1 client to modify the shortcuts and FTAs that are associated with the packages that are created with a previous version. Example usage: /MIGRATIONMODE=[0|1] |
+
/ENABLEPACKAGESCRIPTS |
+ Enables the scripts that are defined in the package manifest file or configuration files that should run. Example usage: /ENABLEPACKAGESCRIPTS=[0|1] |
+
/ROAMINGREGISTRYEXCLUSIONS |
+ Specifies the registry paths that will not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\classes;software\clients |
+
/ROAMINGFILEEXCLUSIONS |
+ Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /ROAMINGFILEEXCLUSIONS 'desktop;my pictures' |
+
/S[1-5]PUBLISHINGSERVERNAME |
+ Displays the name of the publishing server. Example usage: /S2PUBLISHINGSERVERNAME=MyPublishingServer |
+
/S[1-5]PUBLISHINGSERVERURL |
+ Displays the URL of the publishing server. Example usage: /S2PUBLISHINGSERVERURL=\\pubserver |
+
/S[1-5]GLOBALREFRESHENABLED - |
+ Enables a global publishing refresh. Example usage: /S2GLOBALREFRESHENABLED=[0|1] |
+
/S[1-5]GLOBALREFRESHONLOGON |
+ Initiates a global publishing refresh when a user logs on. Example usage: /S2LOGONREFRESH=[0|1] |
+
/S[1-5]GLOBALREFRESHINTERVAL - |
+ Specifies the publishing refresh interval, where 0 indicates do not periodically refresh. Example usage: /S2PERIODICREFRESHINTERVAL=[0-744] |
+
/S[1-5]GLOBALREFRESHINTERVALUNIT |
+ Specifies the interval unit (Hours[0], Days[1]). Example usage: /S2GLOBALREFRESHINTERVALUNIT=[0|1] |
+
/S[1-5]USERREFRESHENABLED |
+ Enables user publishing refresh. Example usage: /S2USERREFRESHENABLED=[0|1] |
+
/S[1-5]USERREFRESHONLOGON |
+ Initiates a user publishing refresh when a user logs on. Example usage: /S2LOGONREFRESH=[0|1] |
+
/S[1-5]USERREFRESHINTERVAL - |
+ Specifies the publishing refresh interval, where 0 indicates do not periodically refresh. Example usage: /S2PERIODICREFRESHINTERVAL=[0-744] |
+
/S[1-5]USERREFRESHINTERVALUNIT |
+ Specifies the interval unit (Hours[0], Days[1]). Example usage: /S2USERREFRESHINTERVALUNIT=[0|1] |
+
/Log |
+ Specifies a location where the log information is saved. The default location is %Temp%. Example usage: /log C:\logs\log.log |
+
/q |
+ Specifies an unattended installation. |
+
/REPAIR |
+ Repairs a previous client installation. |
+
/NORESTART |
+ Prevents the computer from rebooting after the client installation. +The parameter prevents the end-user computer from rebooting after each update is installed and lets you schedule the reboot at your convenience. For example, you can install App-V 5.1 and then install Hotfix Package Y without rebooting after the Service Pack installation. After the installation, you must reboot before you start using App-V. |
+
/UNINSTALL |
+ Uninstalls the client. |
+
/ACCEPTEULA |
+ Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1. |
+
/LAYOUT |
+ Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V 5.1. No value is expected. |
+
/LAYOUTDIR |
+ Specifies the layout directory. Requires a string value. Example usage: /LAYOUTDIR=”C:\Application Virtualization Client”. |
+
/?, /h, /help |
+ Requests help about the previous installation parameters. |
+
Type of deployment | +Deploy this file | +
---|---|
Computer is running a 32-bit Microsoft Windows operating system |
+ appv_client_MSI_x86.msi |
+
Computer is running a 64-bit Microsoft Windows operating system |
+ appv_client_MSI_x64.msi |
+
You are deploying the App-V 5.1 Remote Desktop Services client |
+ appv_client_rds_MSI_x64.msi |
+
Type of deployment | +Deploy this file | +
---|---|
Computer is running a 32-bit Microsoft Windows operating system |
+ appv_client_LP_xxxx_ x86.msi |
+
Computer is running a 64-bit Microsoft Windows operating system |
+ appv_client_LP_xxxx_ x64.msi |
+
Deploying coexisting App-V clients |
+ [Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md) |
+
Unsupported or limited installation scenarios |
+ See the client section in [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md) |
+
Client registry information |
+
|
+
Client log files |
+
|
+
Client installation troubleshooting information |
+See the error log in the %temp% folder. To review the log files, click Start, type %temp%, and then look for the appv_ log. |
+
Client type | +File to use | +
---|---|
Standard version of the client |
+ appv_client_setup.exe |
+
Remote Desktop Services version of the client |
+ appv_client_setup_rds.exe |
+
/INSTALLDIR |
+ Specifies the installation directory. Example usage: /INSTALLDIR=C:\Program Files\AppV Client |
+
/CEIPOPTIN |
+ Enables participation in the Customer Experience Improvement Program. Example usage: /CEIPOPTIN=[0|1] |
+
/MUOPTIN |
+ Enables Microsoft Update. Example usage: /MUOPTIN=[0|1] |
+
/PACKAGEINSTALLATIONROOT |
+ Specifies the directory in which to install all new applications and updates. Example usage: /PACKAGEINSTALLATIONROOT='C:\App-V Packages' |
+
/PACKAGESOURCEROOT |
+ Overrides the source location for downloading package content. Example usage: /PACKAGESOURCEROOT='http://packageStore' |
+
/AUTOLOAD |
+ Specifies how new packages will be loaded by App-V 5.0 on a specific computer. The following options are enabled: [1]; automatically load all packages [2]; or automatically load no packages [0].Example usage: /AUTOLOAD=[0|1|2] |
+
/SHAREDCONTENTSTOREMODE |
+ Specifies that streamed package contents will be not be saved to the local hard disk. Example usage: /SHAREDCONTENTSTOREMODE=[0|1] |
+
/MIGRATIONMODE |
+ Allows the App-V 5.0 client to modify the shortcuts and FTAs that are associated with the packages that are created with a previous version. Example usage: /MIGRATIONMODE=[0|1] |
+
/ENABLEPACKAGESCRIPTS |
+ Enables the scripts that are defined in the package manifest file or configuration files that should run. Example usage: /ENABLEPACKAGESCRIPTS=[0|1] |
+
/ROAMINGREGISTRYEXCLUSIONS |
+ Specifies the registry paths that will not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\classes;software\clients |
+
/ROAMINGFILEEXCLUSIONS |
+ Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /ROAMINGFILEEXCLUSIONS 'desktop;my pictures' |
+
/S[1-5]PUBLISHINGSERVERNAME |
+ Displays the name of the publishing server. Example usage: /S2PUBLISHINGSERVERNAME=MyPublishingServer |
+
/S[1-5]PUBLISHINGSERVERURL |
+ Displays the URL of the publishing server. Example usage: /S2PUBLISHINGSERVERURL=\\pubserver |
+
/S[1-5]GLOBALREFRESHENABLED - |
+ Enables a global publishing refresh. Example usage: /S2GLOBALREFRESHENABLED=[0|1] |
+
/S[1-5]GLOBALREFRESHONLOGON |
+ Initiates a global publishing refresh when a user logs on. Example usage: /S2LOGONREFRESH=[0|1] |
+
/S[1-5]GLOBALREFRESHINTERVAL - |
+ Specifies the publishing refresh interval, where 0 indicates do not periodically refresh. Example usage: /S2PERIODICREFRESHINTERVAL=[0-744] |
+
/S[1-5]GLOBALREFRESHINTERVALUNIT |
+ Specifies the interval unit (Hours[0], Days[1]). Example usage: /S2GLOBALREFRESHINTERVALUNIT=[0|1] |
+
/S[1-5]USERREFRESHENABLED |
+ Enables user publishing refresh. Example usage: /S2USERREFRESHENABLED=[0|1] |
+
/S[1-5]USERREFRESHONLOGON |
+ Initiates a user publishing refresh when a user logs on. Example usage: /S2LOGONREFRESH=[0|1] |
+
/S[1-5]USERREFRESHINTERVAL - |
+ Specifies the publishing refresh interval, where 0 indicates do not periodically refresh. Example usage: /S2PERIODICREFRESHINTERVAL=[0-744] |
+
/S[1-5]USERREFRESHINTERVALUNIT |
+ Specifies the interval unit (Hours[0], Days[1]). Example usage: /S2USERREFRESHINTERVALUNIT=[0|1] |
+
/Log |
+ Specifies a location where the log information is saved. The default location is %Temp%. Example usage: /log C:\logs\log.log |
+
/q |
+ Specifies an unattended installation. |
+
/REPAIR |
+ Repairs a previous client installation. |
+
/NORESTART |
+ Prevents the computer from rebooting after the client installation. +The parameter prevents the end-user computer from rebooting after each update is installed and lets you schedule the reboot at your convenience. For example, you can install App-V 5.0 SPX and then install Hotfix Package Y without rebooting after the Service Pack installation. After the installation, you must reboot before you start using App-V. |
+
/UNINSTALL |
+ Uninstalls the client. |
+
/ACCEPTEULA |
+ Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1. |
+
/LAYOUT |
+ Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V 5.0. No value is expected. |
+
/LAYOUTDIR |
+ Specifies the layout directory. Requires a string value. Example usage: /LAYOUTDIR=”C:\Application Virtualization Client”. |
+
/?, /h, /help |
+ Requests help about the previous installation parameters. |
+
Type of deployment | +Deploy this file | +
---|---|
Computer is running a 32-bit Microsoft Windows operating system |
+ appv_client_MSI_x86.msi |
+
Computer is running a 64-bit Microsoft Windows operating system |
+ appv_client_MSI_x64.msi |
+
You are deploying the App-V 5.0 Remote Desktop Services client |
+ appv_client_rds_MSI_x64.msi |
+
Type of deployment | +Deploy this file | +
---|---|
Computer is running a 32-bit Microsoft Windows operating system |
+ appv_client_LP_xxxx_ x86.msi |
+
Computer is running a 64-bit Microsoft Windows operating system |
+ appv_client_LP_xxxx_ x64.msi |
+
Database | +Location of Readme.txt file to use | +
---|---|
Management database |
+ ManagementDatabase subfolder +
+ Important
+
+ If you are upgrading to or installing the App-V 5.0 SP3 Management database, see [SQL scripts to install or upgrade the App-V 5.0 SP3 Management Server database fail](http://support.microsoft.com/kb/3031340). +
+
+ |
+
Reporting database |
+ ReportingDatabase subfolder |
+
Database | +Location of Readme.txt file to use | +
---|---|
Management database |
+ ManagementDatabase subfolder |
+
Reporting database |
+ ReportingDatabase subfolder |
+
Setting | +Description | +
---|---|
ReportingEnabled |
+ Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client. |
+
ReportingServerURL |
+ Specifies the location on the reporting server where client information is saved. For example, http://<reportingservername>:<reportingportnumber>. +
+ Note
+
+ This is the port number that was assigned during the Reporting Server setup +
+
+ |
+
Reporting Start Time |
+ This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23. |
+
ReportingRandomDelay |
+ Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data. |
+
ReportingInterval |
+ Specifies the retry interval that the client will use to resend data to the reporting server. |
+
ReportingDataCacheLimit |
+ Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. |
+
ReportingDataBlockSize |
+ Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. |
+
Setting | +Description | +
---|---|
ReportingEnabled |
+ Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client. |
+
ReportingServerURL |
+ Specifies the location on the reporting server where client information is saved. For example, http://<reportingservername>:<reportingportnumber>. +
+ Note
+
+ This is the port number that was assigned during the Reporting Server setup +
+
+ |
+
Reporting Start Time |
+ This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23. |
+
ReportingRandomDelay |
+ Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data. |
+
ReportingInterval |
+ Specifies the retry interval that the client will use to resend data to the reporting server. |
+
ReportingDataCacheLimit |
+ Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. |
+
ReportingDataBlockSize |
+ Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. |
+
Command | +Description | +
---|---|
/INSTALLDIR |
+Specifies the installation directory. |
+
/CEIPOPTIN |
+Enables participation in the Microsoft Customer Experience Improvement Program. |
+
/Log |
+Specifies where the installation log will be saved, the default location is %Temp%. For example, C:\ Logs \ log.log. |
+
/q |
+Specifies a quiet or silent installation. |
+
/Uninstall |
+Specifies the removal of the sequencer. |
+
/ACCEPTEULA |
+Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1. |
+
/LAYOUT |
+Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V 5.1. No value is expected. |
+
/LAYOUTDIR |
+Specifies the layout directory. Requires a string value. Example usage: /LAYOUTDIR=”C:\Application Virtualization Client”. |
+
/? Or /h or /help |
+Displays associated help. |
+
Command | +Description | +
---|---|
/INSTALLDIR |
+Specifies the installation directory. |
+
/CEIPOPTIN |
+Enables participation in the Microsoft Customer Experience Improvement Program. |
+
/Log |
+Specifies where the installation log will be saved, the default location is %Temp%. For example, C:\ Logs \ log.log. |
+
/q |
+Specifies a quiet or silent installation. |
+
/Uninstall |
+Specifies the removal of the sequencer. |
+
/ACCEPTEULA |
+Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1. |
+
/LAYOUT |
+Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V 5.0. No value is expected. |
+
/LAYOUTDIR |
+Specifies the layout directory. Requires a string value. Example usage: /LAYOUTDIR=”C:\Application Virtualization Client”. |
+
/? Or /h or /help |
+Displays associated help. |
+
Requirement | +Details | +||||||
---|---|---|---|---|---|---|---|
Users can run App-V Server cmdlets only if you grant them access by using one of the following methods: |
+
|
+||||||
Cmdlets that require an elevated command prompt |
+
|
+||||||
Cmdlets that end users can run, unless you configure them to require an elevated command prompt |
+
To configure these cmdlets to require an elevated command prompt, use one of the following methods: +
|
+
App-V component | +Command to type | +
---|---|
App-V Server |
+Import-Module AppvServer |
+
App-V Sequencer |
+Import-Module AppvSequencer |
+
App-V Client |
+Import-Module AppvClient |
+
Format | +Description | +||||||||
---|---|---|---|---|---|---|---|---|---|
As a downloadable module |
+To download the latest help after downloading the cmdlet module: +
|
+||||||||
On TechNet as web pages |
+See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](http://technet.microsoft.com/library/dn520245.aspx). |
+
Requirement | +Details | +||||||
---|---|---|---|---|---|---|---|
Users can run App-V Server cmdlets only if you grant them access by using one of the following methods: |
+
|
+||||||
Cmdlets that require an elevated command prompt |
+
|
+||||||
Cmdlets that end users can run, unless you configure them to require an elevated command prompt |
+
To configure these cmdlets to require an elevated command prompt, use one of the following methods: +
|
+
App-V component | +Command to type | +
---|---|
App-V Server |
+Import-Module AppvServer |
+
App-V Sequencer |
+Import-Module AppvSequencer |
+
App-V Client |
+Import-Module AppvClient |
+
Format | +Description | +||||||||
---|---|---|---|---|---|---|---|---|---|
As a downloadable module |
+To download the latest help after downloading the cmdlet module: +
|
+||||||||
On TechNet as web pages |
+See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](http://technet.microsoft.com/library/dn520245.aspx). |
+
Task description with App-V 5.0 SP3 | +How to perform the task with App-V 5.0 SP3 | +||||||
---|---|---|---|---|---|---|---|
You can configure a connection group to accept any version of a package, which enables you to upgrade the package without having to disable the connection group. +How the feature works: +
|
+
|
+
Task description with App-V 5.1 | +How to perform the task with App-V 5.1 | +||||||
---|---|---|---|---|---|---|---|
You can configure a connection group to accept any version of a package, which enables you to upgrade the package without having to disable the connection group. +How the feature works: +
|
+
|
+
Publishing method | +Cmdlet and example | +
---|---|
Publishing to the user |
+Cmdlet: Publish-AppvClientPackage +Example: Publish-AppvClientPackage “ContosoApplication” |
+
Publishing globally |
+Cmdlet: Publish-AppvClientPackage +Example: Publish-AppvClientPackage “ContosoApplication” -Global |
+
Cmdlet |
+Set-AppvClientConfiguration |
+
Parameter |
+-RequirePublishAsAdmin +Parameter values: +
Example:: Set-AppvClientConfiguration –RequirePublishAsAdmin1 |
+
Cmdlet output item | +Description | +
---|---|
UserPending |
+Indicates whether the listed package has a pending task that is being applied to the user: +
|
+
GlobalPending |
+Indicates whether the listed package has a pending task that is being applied globally to the computer: +
|
+
Task type | +Applicable rule | +
---|---|
User-based task, e.g., publishing a package to a user |
+The pending task will be performed after the user logs off and then logs back on. |
+
Globally based task, e.g., enabling a connection group globally |
+The pending task will be performed when the computer is shut down and then restarted. |
+
Publishing method | +Cmdlet and example | +
---|---|
Publishing to the user |
+Cmdlet: Publish-AppvClientPackage +Example: Publish-AppvClientPackage “ContosoApplication” |
+
Publishing globally |
+Cmdlet: Publish-AppvClientPackage +Example: Publish-AppvClientPackage “ContosoApplication” -Global |
+
Cmdlet |
+Set-AppvClientConfiguration |
+
Parameter |
+-RequirePublishAsAdmin +Parameter values: +
Example:: Set-AppvClientConfiguration –RequirePublishAsAdmin1 |
+
Cmdlet output item | +Description | +
---|---|
UserPending |
+Indicates whether the listed package has a pending task that is being applied to the user: +
|
+
GlobalPending |
+Indicates whether the listed package has a pending task that is being applied globally to the computer: +
|
+
Task type | +Applicable rule | +
---|---|
User-based task, e.g., publishing a package to a user |
+The pending task will be performed after the user logs off and then logs back on. |
+
Globally based task, e.g., enabling a connection group globally |
+The pending task will be performed when the computer is shut down and then restarted. |
+
Cmdlet | +Examples | +
---|---|
Enable-AppVClientConnectionGroup |
+ Enable-AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345 |
+
Disable -AppVClientConnectionGroup |
+ Disable -AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345 |
+
Cmdlet | +Parameter and values | +Example | +
---|---|---|
Set-AppvClientConfiguration |
+ –RequirePublishAsAdmin +
|
+ Set-AppvClientConfiguration –RequirePublishAsAdmin1 |
+
Cmdlet | +Examples | +
---|---|
Enable-AppVClientConnectionGroup |
+ Enable-AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345 |
+
Disable -AppVClientConnectionGroup |
+ Disable -AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345 |
+
Cmdlet | +Parameter and values | +Example | +
---|---|---|
Set-AppvClientConfiguration |
+ –RequirePublishAsAdmin +
|
+ Set-AppvClientConfiguration –RequirePublishAsAdmin1 |
+
Application type | +Description | +
---|---|
Standard |
+ Creates a package that contains an application or a suite of applications. This is the preferred option for most application types. |
+
Add-on or plug-in |
+ Creates a package that extends the functionality of a standard application, for example, a plug-in for Microsoft Excel. Additionally, you can use plug-ins for natively installed applications, or for another package that is linked by using connection groups. |
+
Middleware |
+ Creates a package that is required by a standard application, for example, Java. Middleware packages are used for linking to other packages by using connection groups. |
+
Application type | +Description | +
---|---|
Standard |
+ Creates a package that contains an application or a suite of applications. This is the preferred option for most application types. |
+
Add-on or plug-in |
+ Creates a package that extends the functionality of a standard application, for example, a plug-in for Microsoft Excel. Additionally, you can use plug-ins for natively installed applications, or for another package that is linked by using connection groups. |
+
Middleware |
+ Creates a package that is required by a standard application, for example, Java. Middleware packages are used for linking to other packages by using connection groups. |
+
Link to instructions | +Task | +
---|---|
[Use one connection group, with optional packages, for multiple users who have different packages entitled to them](#bkmk-apps-plugs-optional) |
+Use a single connection group to make different groups of applications and plug-ins available to different end users. +For example, you want to distribute Microsoft Office to all end users, but distribute different plug-ins to different subsets of users. |
+
[Unpublish or delete an optional package, or unpublish an optional package and republish it later, without changing the connection group](#bkmk-unpub-del-optl-pkg) |
+Unpublish, delete, or republish an optional package without having to disable, remove, edit, add, and re-enable the connection group on the App-V Client. +You can also unpublish the optional package and republish it later without having to disable or republish the connection group. |
+
Task description | +How to perform the task | +||||||||
---|---|---|---|---|---|---|---|---|---|
With App-V 5.0 SP3 +You can add optional packages to connection groups, which enables you to provide different combinations of applications and plug-ins to different end users. +Example: You want to distribute Microsoft Office to your end users, but enable a certain plug-in for only a subset of users. +To do this, create a connection group that contains a package with Office, and another package with Office plug-ins, and then make the plug-ins package optional. +End users who are not entitled to the plug-in package will still be able to run Office. |
+
|
+||||||||
With versions earlier than App-V 5.0 SP3 |
+You had to create many connection groups to make specific application and plug-in combinations available to specific users. |
+
Task description | +How to perform the task | +||||||
---|---|---|---|---|---|---|---|
With App-V 5.0 SP3 +You can unpublish, delete, or republish an optional package, which is in a connection group, without having to disable or re-enable the connection group on the App-V Client. +You can also unpublish an optional package and republish it later without having to disable or republish the connection group. +Example: If you publish an optional package that contains a Microsoft Office plug-in, and you want to remove the plug-in, you can unpublish the package without having to disable the connection group. |
+
|
+||||||
With versions earlier than App-V 5.0 SP3 |
+You had to: +
|
+
Requirement | +Details | +
---|---|
Connection groups must contain at least one non-optional package. |
+
|
+
|
+Globally published connection groups must contain packages that are published globally to ensure that the packages will be available when starting the connection group’s virtual environment. +If you try to add or enable globally published connection groups that contain user-published packages, the connection group will fail. |
+
You must publish all non-optional packages before publishing the connection group that contains those packages. |
+A connection group’s virtual environment cannot start if any non-optional packages are missing. +The App-V Client fails to add or enable a connection group if any non-optional packages have not been published. |
+
Before you unpublish a globally published package, ensure that the connection groups that are entitled to all the users on that computer no longer require the package. |
+The system does not check whether the package is part of another user’s connection group. Unpublishing a global package will make it unavailable to every user on that computer, so make sure that each user’s connection groups no longer contain the package, or alternatively make the package optional. |
+
Link to instructions | +Task | +
---|---|
[Use one connection group, with optional packages, for multiple users who have different packages entitled to them](#bkmk-apps-plugs-optional) |
+Use a single connection group to make different groups of applications and plug-ins available to different end users. +For example, you want to distribute Microsoft Office to all end users, but distribute different plug-ins to different subsets of users. |
+
[Unpublish or delete an optional package, or unpublish an optional package and republish it later, without changing the connection group](#bkmk-unpub-del-optl-pkg) |
+Unpublish, delete, or republish an optional package without having to disable, remove, edit, add, and re-enable the connection group on the App-V Client. +You can also unpublish the optional package and republish it later without having to disable or republish the connection group. |
+
Task description | +How to perform the task | +||||||||
---|---|---|---|---|---|---|---|---|---|
With App-V 5.0 SP3 and App-V 5.1 +You can add optional packages to connection groups, which enables you to provide different combinations of applications and plug-ins to different end users. +Example: You want to distribute Microsoft Office to your end users, but enable a certain plug-in for only a subset of users. +To do this, create a connection group that contains a package with Office, and another package with Office plug-ins, and then make the plug-ins package optional. +End users who are not entitled to the plug-in package will still be able to run Office. |
+
|
+||||||||
With versions earlier than App-V 5.0 SP3 |
+You had to create many connection groups to make specific application and plug-in combinations available to specific users. |
+
Task description | +How to perform the task | +||||||
---|---|---|---|---|---|---|---|
With App-V 5.0 SP3 and App-V 5.1 +You can unpublish, delete, or republish an optional package, which is in a connection group, without having to disable or re-enable the connection group on the App-V Client. +You can also unpublish an optional package and republish it later without having to disable or republish the connection group. +Example: If you publish an optional package that contains a Microsoft Office plug-in, and you want to remove the plug-in, you can unpublish the package without having to disable the connection group. |
+
|
+||||||
With versions earlier than App-V 5.0 SP3 |
+You had to: +
|
+
Requirement | +Details | +
---|---|
Connection groups must contain at least one non-optional package. |
+
|
+
|
+Globally published connection groups must contain packages that are published globally to ensure that the packages will be available when starting the connection group’s virtual environment. +If you try to add or enable globally published connection groups that contain user-published packages, the connection group will fail. |
+
You must publish all non-optional packages before publishing the connection group that contains those packages. |
+A connection group’s virtual environment cannot start if any non-optional packages are missing. +The App-V Client fails to add or enable a connection group if any non-optional packages have not been published. |
+
Before you unpublish a globally published package, ensure that the connection groups that are entitled to all the users on that computer no longer require the package. |
+The system does not check whether the package is part of another user’s connection group. Unpublishing a global package will make it unavailable to every user on that computer, so make sure that each user’s connection groups no longer contain the package, or alternatively make the package optional. |
+
[About the Connection Group Virtual Environment](about-the-connection-group-virtual-environment.md) |
+Describes the connection group virtual environment. |
+
[About the Connection Group File](about-the-connection-group-file.md) |
+Describes the connection group file. |
+
[How to Create a Connection Group](how-to-create-a-connection-group.md) |
+Explains how to create a new connection group. |
+
[How to Create a Connection Group with User-Published and Globally Published Packages](how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md) |
+Explains how to create a new connection group that contains a mix of packages that are published to the user and published globally. |
+
[How to Delete a Connection Group](how-to-delete-a-connection-group.md) |
+Explains how to delete a connection group. |
+
[How to Publish a Connection Group](how-to-publish-a-connection-group.md) |
+Explains how to publish a connection group. |
+
[About the Connection Group Virtual Environment](about-the-connection-group-virtual-environment51.md) |
+Describes the connection group virtual environment. |
+
[About the Connection Group File](about-the-connection-group-file51.md) |
+Describes the connection group file. |
+
[How to Create a Connection Group](how-to-create-a-connection-group51.md) |
+Explains how to create a new connection group. |
+
[How to Create a Connection Group with User-Published and Globally Published Packages](how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md) |
+Explains how to create a new connection group that contains a mix of packages that are published to the user and published globally. |
+
[How to Delete a Connection Group](how-to-delete-a-connection-group51.md) |
+Explains how to delete a connection group. |
+
[How to Publish a Connection Group](how-to-publish-a-connection-group51.md) |
+Explains how to publish a connection group. |
+
Issue | +Workaround | +
---|---|
Package scripts are not converted. |
+Test the converted package. If necessary convert the script. |
+
Package registry setting overrides are not converted. |
+Test the converted package. If necessary, re-add registry overrides. |
+
Virtual packages using DSC are not linked after conversion. |
+Link the packages using connection groups. See [Managing Connection Groups](managing-connection-groups.md). |
+
Environment variable conflicts are detected during conversion. |
+Resolve any conflicts in the associated .osd file. |
+
Hard-coded paths are detected during conversion. |
+Hard-coded paths are difficult to convert correctly. The package converter will detect and return packages with files that contain hard-coded paths. View the file with the hard-coded path, and determine whether the package requires the file. If so, it is recommended to re-sequence the package. |
+
Task | +More Information | +
---|---|
Upgrade your environment to App-V 4.6 SP2 |
+[Application Virtualization Deployment and Upgrade Considerations](../appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md). |
+
Install the App-V 5.0 client with co-existence enabled. |
+[How to Deploy the App-V 4.6.x and the App-V 5.0 Client on the Same Computer](how-to-deploy-the-app-v-46x-and-the-app-v--50-client-on-the-same-computer.md). |
+
Sequence and roll out App-V 5.0 packages. As needed, unpublish App-V 4.6 packages. |
+[How to Sequence a New Application with App-V 5.0](how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md). |
+
Task | +More Information | +
---|---|
Upgrade your environment to App-V 4.6 SP2. |
+[Application Virtualization Deployment and Upgrade Considerations](../appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md). |
+
Deploy App-V 5.0 version of the client. |
+[How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md). |
+
Install App-V 5.0 server. |
+[How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md). |
+
Migrate existing packages. |
+See the Converting packages created using a prior version of App-V section of this article. |
+
New in App-V 5.1 | +Prior to App-V 5.1 | +
---|---|
New .xml files are created corresponding to the .osd files associated with a package; these files include the following information: +
You can now choose to add information from a subset of the .osd files in the source directory to the package using the |
+Registry information and scripts included in .osd files associated with a package were not included in package converter output. +The package converter would populate the new package with information from all of the .osd files in the source directory. |
+
These Source directory files… | +…are converted to these Destination directory files… | +…and will contain these items | +Description | +
---|---|---|---|
|
+
|
+
|
+Each .osd file is converted to a separate, corresponding .xml file that contains the items listed here in App-V 5.1 deployment configuration format. These items can then be copied from these .xml files and placed in the deployment configuration or user configuration files as desired. +In this example, there are three .xml files, corresponding with the three .osd files in the source directory. Each .xml file contains the environment variables, shortcuts, file type associations, registry information, and scripts in its corresponding .osd file. |
+
|
+
|
+
|
+The information from the .osd files specified in the In this example, environment variables, shortcuts, and file type associations included in X.osd and Y.osd were converted and placed in the App-V package, and some of this information was also included in the deployment configuration and user configuration files. X.osd and Y.osd were used because they were included as arguments to the |
+
Issue | +Workaround | +
---|---|
Virtual packages using DSC are not linked after conversion. |
+Link the packages using connection groups. See [Managing Connection Groups](managing-connection-groups51.md). |
+
Environment variable conflicts are detected during conversion. |
+Resolve any conflicts in the associated .osd file. |
+
Hard-coded paths are detected during conversion. |
+Hard-coded paths are difficult to convert correctly. The package converter will detect and return packages with files that contain hard-coded paths. View the file with the hard-coded path, and determine whether the package requires the file. If so, it is recommended to re-sequence the package. |
+
Task | +More Information | +
---|---|
Upgrade your environment to App-V 4.6 SP2 |
+[Application Virtualization Deployment and Upgrade Considerations](../appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md). |
+
Install the App-V 5.1 client with co-existence enabled. |
+[How to Deploy the App-V 4.6.x and the App-V 5.1 Client on the Same Computer](how-to-deploy-the-app-v-46x-and-the-app-v--51-client-on-the-same-computer.md). |
+
Sequence and roll out App-V 5.1 packages. As needed, unpublish App-V 4.6 packages. |
+[How to Sequence a New Application with App-V 5.1](how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md). |
+
Task | +More Information | +
---|---|
Upgrade your environment to App-V 4.6 SP2. |
+[Application Virtualization Deployment and Upgrade Considerations](../appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md). |
+
Deploy App-V 5.1 version of the client. |
+[How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md). |
+
Install App-V 5.1 server. |
+[How to Deploy the App-V 5.1 Server](how-to-deploy-the-app-v-51-server.md). |
+
Migrate existing packages. |
+See the Converting packages created using a prior version of App-V section of this article. |
+
![]() |
+Non-Persistent VDI or RDSH. |
+
![]() |
+User Experience Virtualization (UE-V), other UPM solutions or User Profile Disks (UPD). |
+
![]() |
+User Experience Virtualization (UE-V) with the App-V user state template enabled or User Profile Management (UPM) software. Non-UE-V UPM software must be capable of triggering on Login or Process/Application Start and Logoff. |
+
![]() |
+App-V Shared Content Store (SCS) is configured or can be configured. |
+
![]() |
+Admin may need to update the VM base image regularly to ensure optimal performance or Admin may need to manage multiple images for different user groups. |
+
Optimized for Performance | +Optimized for Storage | +
---|---|
To provide the most optimal user experience, this approach leverages the capabilities of a UPM solution and requires additional image preparation and can incur some additional image management overhead. +The following describes many performance improvements in stateful non-persistent deployments. For more information, see the Sequencing Steps to Optimize Packages for Publishing Performance and reference to App-V 5.0 Sequencing Guide in the See Also section of this document. |
+The general expectations of the previous scenario still apply here. However, keep in mind that VM images are typically stored in very costly arrays; a slight alteration has been made to the approach. Do not pre-configure user-targeted virtual application packages in the base image. +The impact of this alteration is detailed in the User Experience Walkthrough section of this document. |
+
Optimized for Performance | +Optimized for Storage | +
---|---|
+
|
+
+
|
+
Configuration Setting | +What does this do? | +How should I use it? | +
---|---|---|
Shared Content Store (SCS) Mode +
|
+When running the shared content store only publishing data is maintained on hard disk; other virtual application assets are maintained in memory (RAM). +This helps to conserve local storage and minimize disk I/O per second (IOPS). |
+This is recommended when low-latency connections are available between the App-V Client endpoint and the SCS content server, SAN. |
+
PreserveUserIntegrationsOnLogin +
|
+If you have not pre-configured (Add-AppvClientPackage) a specific package and this setting is not configured, the App-V Client will de-integrate* the persisted user integrations, then re-integrate*. +For every package that meets the above conditions, effectively twice the work will be done during publishing/refresh. |
+If you don’t plan to pre-configure every available user package in the base image, use this setting. |
+
MaxConcurrentPublishingRefresh +
|
+This setting determines the number of users that can perform a publishing refresh/sync at the same time. The default setting is no limit. |
+Limiting the number of concurrent publishing refreshes prevents excessive CPU usage that could impact computer performance. This limit is recommended in an RDS environment, where multiple users can log in to the same computer at the same time and perform a publishing refresh sync. +If the concurrent publishing refresh threshold is reached, the time required to publish new applications and make them available to end users after they log in could take an indeterminate amount of time. |
+
Optimized for Performance | +Optimized for Storage | +
---|---|
After implementing this approach in the VDI/RDSH environment, on first login, +
On subsequent logins: +
¹ The publishing operation (Publish-AppVClientPackage) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps. |
+After implementing this approach in the VDI/RDSH environment, on first login, +
On subsequent logins: +
|
+
Outcome | +Outcome | +
---|---|
+
|
+Because the add/refresh must re-configure all the virtual applications to the VM, the publishing refresh time on every login will be extended. |
+
Step | +Consideration | +Benefits | +Tradeoffs | +
---|---|---|---|
No Feature Block 1 (FB1, also known as Primary FB) |
+No FB1 means the application will launch immediately and stream fault (application requires file, DLL and must pull down over the network) during launch.If there are network limitations, FB1 will: +
|
+Stream faulting decreases the launch time. |
+Virtual application packages with FB1 configured will need to be re-sequenced. |
+
Step | +Considerations | +Benefits | +Tradeoffs | +
---|---|---|---|
No SXS Install at Publish (Pre-Install SxS assemblies) |
+Virtual Application packages do not need to be re-sequenced. SxS Assemblies can remain in the virtual application package. |
+The SxS Assembly dependencies will not install at publishing time. |
+SxS Assembly dependencies must be pre-installed. |
+
Step | +Considerations | +Benefits | +Tradeoffs | +
---|---|---|---|
Selectively Employ Dynamic Configuration files |
+The App-V 5.0 client must parse and process these Dynamic Configuration files. +Be conscious of size and complexity (script execution, VREG inclusions/exclusions) of the file. +Numerous virtual application packages may already have User- or computer–specific dynamic configurations files. |
+Publishing times will improve if these files are used selectively or not at all. |
+Virtual application packages would need to be reconfigured individually or via the App-V server management console to remove associated Dynamic Configuration files. |
+
Step | +Considerations | +Benefits | +Tradeoffs | +
---|---|---|---|
Account for Synchronous Script Execution during Package Lifecycle. |
+If script collateral is embedded in the package, Add (Powershell) may be significantly slower. +Running of scripts during virtual application launch (StartVirtualEnvironment, StartProcess) and/or Add+Publish will impact the perceived performance during one or more of these lifecycle operations. |
+Use of Asynchronous (Non-Blocking) Scripts will ensure that the lifecycle operations complete efficiently. |
+This step requires working knowledge of all virtual application packages with embedded script collateral, which have associated dynamic configurations files and which reference and run scripts synchronously. |
+
Remove Extraneous Virtual Fonts from Package. |
+The majority of applications investigated by the App-V product team contained a small number of fonts, typically fewer than 20. |
+Virtual Fonts impact publishing refresh performance. |
+Desired fonts will need to be enabled/installed natively. For instructions, see Install or uninstall fonts. |
+
![]() |
+Non-Persistent VDI or RDSH. |
+
![]() |
+User Experience Virtualization (UE-V), other UPM solutions or User Profile Disks (UPD). |
+
![]() |
+User Experience Virtualization (UE-V) with the App-V user state template enabled or User Profile Management (UPM) software. Non-UE-V UPM software must be capable of triggering on Login or Process/Application Start and Logoff. |
+
![]() |
+App-V Shared Content Store (SCS) is configured or can be configured. |
+
![]() |
+Admin may need to update the VM base image regularly to ensure optimal performance or Admin may need to manage multiple images for different user groups. |
+
Optimized for Performance | +Optimized for Storage | +
---|---|
To provide the most optimal user experience, this approach leverages the capabilities of a UPM solution and requires additional image preparation and can incur some additional image management overhead. +The following describes many performance improvements in stateful non-persistent deployments. For more information, see the Sequencing Steps to Optimize Packages for Publishing Performance and reference to App-V Sequencing Guide in the See Also section of this document. |
+The general expectations of the previous scenario still apply here. However, keep in mind that VM images are typically stored in very costly arrays; a slight alteration has been made to the approach. Do not pre-configure user-targeted virtual application packages in the base image. +The impact of this alteration is detailed in the User Experience Walkthrough section of this document. |
+
Optimized for Performance | +Optimized for Storage | +
---|---|
+
|
+
+
|
+
Configuration Setting | +What does this do? | +How should I use it? | +
---|---|---|
Shared Content Store (SCS) Mode +
|
+When running the shared content store only publishing data is maintained on hard disk; other virtual application assets are maintained in memory (RAM). +This helps to conserve local storage and minimize disk I/O per second (IOPS). |
+This is recommended when low-latency connections are available between the App-V Client endpoint and the SCS content server, SAN. |
+
PreserveUserIntegrationsOnLogin +
|
+If you have not pre-configured (Add-AppvClientPackage) a specific package and this setting is not configured, the App-V Client will de-integrate* the persisted user integrations, then re-integrate*. +For every package that meets the above conditions, effectively twice the work will be done during publishing/refresh. |
+If you don’t plan to pre-configure every available user package in the base image, use this setting. |
+
MaxConcurrentPublishingRefresh +
|
+This setting determines the number of users that can perform a publishing refresh/sync at the same time. The default setting is no limit. |
+Limiting the number of concurrent publishing refreshes prevents excessive CPU usage that could impact computer performance. This limit is recommended in an RDS environment, where multiple users can log in to the same computer at the same time and perform a publishing refresh sync. +If the concurrent publishing refresh threshold is reached, the time required to publish new applications and make them available to end users after they log in could take an indeterminate amount of time. |
+
Optimized for Performance | +Optimized for Storage | +
---|---|
After implementing this approach in the VDI/RDSH environment, on first login, +
On subsequent logins: +
¹ The publishing operation (Publish-AppVClientPackage) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps. |
+After implementing this approach in the VDI/RDSH environment, on first login, +
On subsequent logins: +
|
+
Outcome | +Outcome | +
---|---|
+
|
+Because the add/refresh must re-configure all the virtual applications to the VM, the publishing refresh time on every login will be extended. |
+
Step | +Consideration | +Benefits | +Tradeoffs | +
---|---|---|---|
No Feature Block 1 (FB1, also known as Primary FB) |
+No FB1 means the application will launch immediately and stream fault (application requires file, DLL and must pull down over the network) during launch.If there are network limitations, FB1 will: +
|
+Stream faulting decreases the launch time. |
+Virtual application packages with FB1 configured will need to be re-sequenced. |
+
Step | +Considerations | +Benefits | +Tradeoffs | +
---|---|---|---|
No SXS Install at Publish (Pre-Install SxS assemblies) |
+Virtual Application packages do not need to be re-sequenced. SxS Assemblies can remain in the virtual application package. |
+The SxS Assembly dependencies will not install at publishing time. |
+SxS Assembly dependencies must be pre-installed. |
+
Step | +Considerations | +Benefits | +Tradeoffs | +
---|---|---|---|
Selectively Employ Dynamic Configuration files |
+The App-V 5.1 client must parse and process these Dynamic Configuration files. +Be conscious of size and complexity (script execution, VREG inclusions/exclusions) of the file. +Numerous virtual application packages may already have User- or computer–specific dynamic configurations files. |
+Publishing times will improve if these files are used selectively or not at all. |
+Virtual application packages would need to be reconfigured individually or via the App-V server management console to remove associated Dynamic Configuration files. |
+
Step | +Considerations | +Benefits | +Tradeoffs | +
---|---|---|---|
Account for Synchronous Script Execution during Package Lifecycle. |
+If script collateral is embedded in the package, Add (Powershell) may be significantly slower. +Running of scripts during virtual application launch (StartVirtualEnvironment, StartProcess) and/or Add+Publish will impact the perceived performance during one or more of these lifecycle operations. |
+Use of Asynchronous (Non-Blocking) Scripts will ensure that the lifecycle operations complete efficiently. |
+This step requires working knowledge of all virtual application packages with embedded script collateral, which have associated dynamic configurations files and which reference and run scripts synchronously. |
+
Remove Extraneous Virtual Fonts from Package. |
+The majority of applications investigated by the App-V product team contained a small number of fonts, typically fewer than 20. |
+Virtual Fonts impact publishing refresh performance. |
+Desired fonts will need to be enabled/installed natively. For instructions, see Install or uninstall fonts. |
+
App-V 4.6.x client type | +App-V 5.0 client type | +
---|---|
App-V 4.6 SP2 |
+App-V 5.0 |
+
App-V 4.6 SP2 RDS |
+App-V 5.0 RDS |
+
App-V 4.6 SP3 |
+App-V 5.0 |
+
App-V 4.6 SP3 RDS |
+App-V 5.0 RDS |
+
App-V version | +Link to download the client | +Link to TechNet documentation | +
---|---|---|
App-V 4.6 SP2 |
+[Microsoft Application Virtualization 4.6 Service Pack 2](http://www.microsoft.com/download/details.aspx?id=35513) |
+[About Microsoft Application Virtualization 4.6 SP2](http://technet.microsoft.com/library/jj680847.aspx) |
+
App-V 4.6 SP3 |
+[Microsoft Application Virtualization 4.6 Service Pack 3](http://www.microsoft.com/download/details.aspx?id=41187) |
+[About Microsoft Application Virtualization 4.6 SP3](http://technet.microsoft.com/library/dn511019.aspx) |
+
App-V 4.6.x client type | +App-V 5.1 client type | +
---|---|
App-V 4.6 SP2 |
+App-V 5.1 |
+
App-V 4.6 SP2 RDS |
+App-V 5.1 RDS |
+
App-V 4.6 SP3 |
+App-V 5.1 |
+
App-V 4.6 SP3 RDS |
+App-V 5.1 RDS |
+
App-V version | +Link to download the client | +Link to TechNet documentation | +
---|---|---|
App-V 4.6 SP2 |
+[Microsoft Application Virtualization 4.6 Service Pack 2](http://www.microsoft.com/download/details.aspx?id=35513) |
+[About Microsoft Application Virtualization 4.6 SP2](http://technet.microsoft.com/library/jj680847.aspx) |
+
App-V 4.6 SP3 |
+[Microsoft Application Virtualization 4.6 Service Pack 3](http://www.microsoft.com/download/details.aspx?id=41187) |
+[About Microsoft Application Virtualization 4.6 SP3](http://technet.microsoft.com/library/dn511019.aspx) |
+
Server Type | +Protocols | +External Features Needed | +Reporting | ++ |
---|---|---|---|---|
IIS server |
+HTTP +HTTPS |
+This server-protocol combination requires a mechanism to synchronize the content between the Management Server and the Streaming Server. When using HTTP or HTTPS, use an IIS server and a firewall to protect the server from exposure to the Internet. |
+Internal |
++ |
File |
+SMB |
+This server-protocol combination requires support to synchronize the content between the Management Server and the Streaming Server. Use a client computer with file sharing or streaming capability. |
+Internal |
++ |
Server Type | +Protocols | +External Features Needed | +Reporting | ++ |
---|---|---|---|---|
IIS server |
+HTTP +HTTPS |
+This server-protocol combination requires a mechanism to synchronize the content between the Management Server and the Streaming Server. When using HTTP or HTTPS, use an IIS server and a firewall to protect the server from exposure to the Internet. |
+Internal |
++ |
File |
+SMB |
+This server-protocol combination requires support to synchronize the content between the Management Server and the Streaming Server. Use a client computer with file sharing or streaming capability. |
+Internal |
++ |
Supported Office Version | +Supported App-V Versions | +Package Creation | +Supported Licensing | +Supported Deployments | +
---|---|---|---|---|
Office 365 ProPlus +Also supported: +
|
+
|
+Office Deployment Tool |
+Subscription |
+
|
+
Office Professional Plus 2013 +Also supported: +
|
+
|
+Office Deployment Tool |
+Volume Licensing |
+
|
+
Office version | +Link to guidance | +
---|---|
Office 2013 |
+[Information about how to use Office 2013 suites and programs (MSI deployment) on a computer that is running another version of Office](http://support.microsoft.com/kb/2784668) |
+
Office 2010 |
+[Information about how to use Office 2010 suites and programs on a computer that is running another version of Office](http://support.microsoft.com/kb/2121447) |
+
+ | Mode in which App-V can sequence this version of Office | +
---|---|
Office 2007 |
+Always non-integrated. App-V does not offer any operating system integrations with a virtualized version of Office 2007. |
+
Office 2010 |
+Integrated and non-integrated mode. |
+
Office 2013 |
+Always integrated. Windows operating system integrations cannot be disabled. |
+
Extension Point | +Description | +
---|---|
Lync meeting Join Plug-in for Firefox and Chrome |
+User can join Lync meetings from Firefox and Chrome |
+
Sent to OneNote Print Driver |
+User can print to OneNote |
+
OneNote Linked Notes |
+OneNote Linked Notes |
+
Send to OneNote Internet Explorer Add-In |
+User can send to OneNote from IE |
+
Firewall Exception for Lync and Outlook |
+Firewall Exception for Lync and Outlook |
+
MAPI Client |
+Native apps and add-ins can interact with virtual Outlook through MAPI |
+
SharePoint Plug-in for Firefox |
+User can use SharePoint features in Firefox |
+
Mail Control Panel Applet |
+User gets the mail control panel applet in Outlook |
+
Primary Interop Assemblies |
+Support managed add-ins |
+
Office Document Cache Handler |
+Allows Document Cache for Office applications |
+
Outlook Protocol Search handler |
+User can search in outlook |
+
Active X Controls: |
+For more information on ActiveX controls, refer to [ActiveX Control API Reference](http://go.microsoft.com/fwlink/p/?LinkId=331361). |
+
Groove.SiteClient |
+Active X Control |
+
PortalConnect.PersonalSite |
+Active X Control |
+
SharePoint.openDocuments |
+Active X Control |
+
SharePoint.ExportDatabase |
+Active X Control |
+
SharePoint.SpreadSheetLauncher |
+Active X Control |
+
SharePoint.StssyncHander |
+Active X Control |
+
SharePoint.DragUploadCtl |
+Active X Control |
+
SharePoint.DragDownloadCtl |
+Active X Control |
+
Sharepoint.OpenXMLDocuments |
+Active X Control |
+
Sharepoint.ClipboardCtl |
+Active X control |
+
WinProj.Activator |
+Active X Control |
+
Name.NameCtrl |
+Active X Control |
+
STSUPld.CopyCtl |
+Active X Control |
+
CommunicatorMeetingJoinAx.JoinManager |
+Active X Control |
+
LISTNET.Listnet |
+Active X Control |
+
OneDrive Pro Browser Helper |
+Active X Control] |
+
OneDrive Pro Icon Overlays |
+Windows Explorer shell icon overlays when users look at folders OneDrive Pro folders |
+
Shell extensions |
++ |
Shortcuts |
++ |
Windows Search |
++ |
Supported Office Version | +Supported App-V Versions | +Package Creation | +Supported Licensing | +Supported Deployments | +
---|---|---|---|---|
Office 365 ProPlus +Also supported: +
|
+
|
+Office Deployment Tool |
+Subscription |
+
|
+
Office Professional Plus 2013 +Also supported: +
|
+
|
+Office Deployment Tool |
+Volume Licensing |
+
|
+
Office version | +Link to guidance | +
---|---|
Office 2013 |
+[Information about how to use Office 2013 suites and programs (MSI deployment) on a computer that is running another version of Office](http://support.microsoft.com/kb/2784668) |
+
Office 2010 |
+[Information about how to use Office 2010 suites and programs on a computer that is running another version of Office](http://support.microsoft.com/kb/2121447) |
+
+ | Mode in which App-V can sequence this version of Office | +
---|---|
Office 2007 |
+Always non-integrated. App-V does not offer any operating system integrations with a virtualized version of Office 2007. |
+
Office 2010 |
+Integrated and non-integrated mode. |
+
Office 2013 |
+Always integrated. Windows operating system integrations cannot be disabled. |
+
Extension Point | +Description | +
---|---|
Lync meeting Join Plug-in for Firefox and Chrome |
+User can join Lync meetings from Firefox and Chrome |
+
Sent to OneNote Print Driver |
+User can print to OneNote |
+
OneNote Linked Notes |
+OneNote Linked Notes |
+
Send to OneNote Internet Explorer Add-In |
+User can send to OneNote from IE |
+
Firewall Exception for Lync and Outlook |
+Firewall Exception for Lync and Outlook |
+
MAPI Client |
+Native apps and add-ins can interact with virtual Outlook through MAPI |
+
SharePoint Plug-in for Firefox |
+User can use SharePoint features in Firefox |
+
Mail Control Panel Applet |
+User gets the mail control panel applet in Outlook |
+
Primary Interop Assemblies |
+Support managed add-ins |
+
Office Document Cache Handler |
+Allows Document Cache for Office applications |
+
Outlook Protocol Search handler |
+User can search in outlook |
+
Active X Controls: |
+For more information on ActiveX controls, refer to [ActiveX Control API Reference](http://go.microsoft.com/fwlink/p/?LinkId=331361). |
+
Groove.SiteClient |
+Active X Control |
+
PortalConnect.PersonalSite |
+Active X Control |
+
SharePoint.openDocuments |
+Active X Control |
+
SharePoint.ExportDatabase |
+Active X Control |
+
SharePoint.SpreadSheetLauncher |
+Active X Control |
+
SharePoint.StssyncHander |
+Active X Control |
+
SharePoint.DragUploadCtl |
+Active X Control |
+
SharePoint.DragDownloadCtl |
+Active X Control |
+
Sharepoint.OpenXMLDocuments |
+Active X Control |
+
Sharepoint.ClipboardCtl |
+Active X control |
+
WinProj.Activator |
+Active X Control |
+
Name.NameCtrl |
+Active X Control |
+
STSUPld.CopyCtl |
+Active X Control |
+
CommunicatorMeetingJoinAx.JoinManager |
+Active X Control |
+
LISTNET.Listnet |
+Active X Control |
+
OneDrive Pro Browser Helper |
+Active X Control] |
+
OneDrive Pro Icon Overlays |
+Windows Explorer shell icon overlays when users look at folders OneDrive Pro folders |
+
Shell extensions |
++ |
Shortcuts |
++ |
Windows Search |
++ |
Deployment requirement or option | +Description | +
---|---|
The App-V Management server, Management database, and Publishing server are not required. |
+These functions are handled by the implemented ESD solution. |
+
You can deploy the App-V Reporting server and Reporting database side by side with the ESD. |
+The side-by-side deployment lets you to collect data and generate reports. +If you enable the App-V client to send report information, and you are not using the App-V Reporting server, the reporting data is stored in associated .xml files. |
+
Deployment requirement or option | +Description | +
---|---|
The App-V Management server, Management database, and Publishing server are not required. |
+These functions are handled by the implemented ESD solution. |
+
You can deploy the App-V Reporting server and Reporting database side by side with the ESD. |
+The side-by-side deployment lets you to collect data and generate reports. +If you enable the App-V client to send report information, and you are not using the App-V Reporting server, the reporting data is stored in associated .xml files. |
+
Requirements |
+To use %AppData% folder redirection, you must: +
|
+||||||
Unsupported scenarios |
+
|
+
Virtual environment state | +Action that occurs | +
---|---|
When the virtual environment starts |
+The virtual file system (VFS) AppData folder is mapped to the local AppData folder (%LocalAppData%) instead of to the user’s roaming AppData folder (%AppData%). +
+Note
+
+The App-V client folder redirection sometimes fails to move files from %AppData% to %LocalAppData%. See [Release Notes for App-V 5.0 SP2](release-notes-for-app-v-50-sp2.md#bkmk-folderredirection). +
+
+ |
+
When the virtual environment shuts down |
+The local cached data in AppData (roaming) is zipped up and copied to the “real” roaming AppData folder in %AppData%. A time stamp, which indicates the last known upload, is simultaneously saved as a registry key under: +
To provide redundancy, App-V 5.0 keeps the three most recent copies of the compressed data under %AppData%. |
+
Purpose |
+Enables end users to work with files, which have been redirected to another folder, as if the files still existed on the local drive. |
+
Description |
+Folder redirection allows users and administrators to redirect the path of a folder to a network location. The documents in the folder are available to the user from any computer on the network. +
|
+
Usage example |
+You can redirect the Documents folder, which is usually stored on the computer's local hard disk, to a network location. The user can access the documents in the folder from any computer on the network. |
+
More resources |
+[Folder redirection overview](http://technet.microsoft.com/library/cc778976.aspx) |
+
Requirements |
+To use %AppData% folder redirection, you must: +
|
+||||||
Unsupported scenarios |
+
|
+
Virtual environment state | +Action that occurs | +
---|---|
When the virtual environment starts |
+The virtual file system (VFS) AppData folder is mapped to the local AppData folder (%LocalAppData%) instead of to the user’s roaming AppData folder (%AppData%). +
+Note
+
+The App-V client folder redirection sometimes fails to move files from %AppData% to %LocalAppData%. See [Release Notes for App-V 5.0 SP2](release-notes-for-app-v-50-sp2.md#bkmk-folderredirection). +
+
+ |
+
When the virtual environment shuts down |
+The local cached data in AppData (roaming) is zipped up and copied to the “real” roaming AppData folder in %AppData%. A time stamp, which indicates the last known upload, is simultaneously saved as a registry key under: +
To provide redundancy, App-V keeps the three most recent copies of the compressed data under %AppData%. |
+
Purpose |
+Enables end users to work with files, which have been redirected to another folder, as if the files still existed on the local drive. |
+
Description |
+Folder redirection allows users and administrators to redirect the path of a folder to a network location. The documents in the folder are available to the user from any computer on the network. +
|
+
Usage example |
+You can redirect the Documents folder, which is usually stored on the computer's local hard disk, to a network location. The user can access the documents in the folder from any computer on the network. |
+
More resources |
+[Folder redirection overview](http://technet.microsoft.com/library/cc778976.aspx) |
+
App-V version | +Supported publishing methods | +
---|---|
App-V 5.0 SP3 |
+Published globally or to the user |
+
App-V 5.0 through App-V 5.0 SP2 |
+Published globally only |
+
Package publishing method | +Where to create the registry key | +
---|---|
Published globally |
+ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual +Example: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe |
+
Published to the user |
+ HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual +Example: HKEY_CURRENT_USER \SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe |
+
Connection group can contain: +
|
+ Either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER key, but all of the following must be true: +
|
+
App-V version | +Supported publishing methods | +
---|---|
App-V 5.0 SP3 and App-V 5.1 |
+Published globally or to the user |
+
App-V 5.0 through App-V 5.0 SP2 |
+Published globally only |
+
Package publishing method | +Where to create the registry key | +
---|---|
Published globally |
+ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual +Example: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe |
+
Published to the user |
+ HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual +Example: HKEY_CURRENT_USER \SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe |
+
Connection group can contain: +
|
+ Either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER key, but all of the following must be true: +
|
+
Tab | +Description | +
---|---|
Overview |
+The Overview tab contains the following elements: +
|
+
Virtual Apps |
+The VIRTUAL APPS tab displays all of the packages that have been published to the user. You can also click a specific package and see all of the applications that are part of that package. This displays information about packages that are currently in use and how much of each package has been downloaded to the computer. You can also start and stop package downloads. Additionally, you can repair the user state. A repair will delete all user data that is associated with a package. + |
+
App Connection Groups |
+The APP CONNECTION GROUPS tab displays all of the connection groups that are available to the current user. Click a specific connection group to see all of the packages that are part of the selected group. This displays information about connection groups that are already in use and how much of the connection group contents have been downloaded to the computer. Additionally, you can start and stop connection group downloads. You can use this section to initiate a repair. A repair will remove all of the user state that is associated a connection group. +(Associated PowerShell cmdlets: Download - Mount-AppvClientConnectionGroup. Repair -AppvClientConnectionGroup.) + |
+
Tab | +Description | +
---|---|
Overview |
+The Overview tab contains the following elements: +
|
+
Virtual Apps |
+The VIRTUAL APPS tab displays all of the packages that have been published to the user. You can also click a specific package and see all of the applications that are part of that package. This displays information about packages that are currently in use and how much of each package has been downloaded to the computer. You can also start and stop package downloads. Additionally, you can repair the user state. A repair will delete all user data that is associated with a package. + |
+
App Connection Groups |
+The APP CONNECTION GROUPS tab displays all of the connection groups that are available to the current user. Click a specific connection group to see all of the packages that are part of the selected group. This displays information about connection groups that are already in use and how much of the connection group contents have been downloaded to the computer. Additionally, you can start and stop connection group downloads. You can use this section to initiate a repair. A repair will remove all of the user state that is associated a connection group. +(Associated PowerShell cmdlets: Download - Mount-AppvClientConnectionGroup. Repair -AppvClientConnectionGroup.) + |
+
Value | +Additional details | +
---|---|
ClientVersion |
+If you omit the ClientVersion parameter from the query, the metadata excludes the new App-V 5.0 SP3 features. |
+
ClientOS |
+You have to provide this value only if you select specific client operating systems when you sequence the package. If you select the default (all operating systems), do not specify this value in the query. +If you omit the ClientOS parameter from the query, only the packages that were sequenced to support any operating system appear in the metadata. |
+
Version of App-V | +Query syntax | +Parameter descriptions | +Example | +||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
App-V 5.0 SP3 |
+
|
+
+ To get the name of the Publishing server and the port number (http://<PubServer>:<Publishing Port#>) from the App-V Client, look at the URL configuration of the Get-AppvPublishingServer PowerShell cmdlet. |
+
In the example: +
|
+||||||||||
App-V 5.0 through App-V 5.0 SP2 |
+
+Note
+
+ClientVersion and ClientOS are supported only in App-V 5.0 SP3. +
+
+ |
+See the information for App-V 5.0 SP3. |
+
In the example, A Windows Server 2012 R2 named “pubsvr01” hosts the Management and Publishing services. |
+
Operating system | +Architecture | +Operating string string value | +
---|---|---|
Windows 8.1 |
+64-bit |
+WindowsClient_6.2_x64 |
+
Windows 8.1 |
+32-bit |
+WindowsClient_6.2_x86 |
+
Windows 8 |
+64-bit |
+WindowsClient_6.2_x64 |
+
Windows 8 |
+32-bit |
+WindowsClient_6.2_x86 |
+
Windows Server 2012 R2 |
+64-bit |
+WindowsServer_6.2_x64 |
+
Windows Server 2012 R2 |
+32-bit |
+WindowsServer_6.2_x86 |
+
Windows Server 2012 |
+64-bit |
+WindowsServer_6.2_x64 |
+
Windows Server 2012 |
+32-bit |
+WindowsServer_6.2_x86 |
+
Windows 7 |
+64-bit |
+WindowsClient_6.1_x64 |
+
Windows 7 |
+32-bit |
+WindowsClient_6.1_x86 |
+
Windows Server 2008 R2 |
+64-bit |
+WindowsServer_6.1_x64 |
+
Windows Server 2008 R2 |
+32-bit |
+WindowsServer_6.1_x86 |
+
Value | +Additional details | +
---|---|
ClientVersion |
+If you omit the ClientVersion parameter from the query, the metadata excludes the features that were new in App-V 5.0 SP3. |
+
ClientOS |
+You have to provide this value only if you select specific client operating systems when you sequence the package. If you select the default (all operating systems), do not specify this value in the query. +If you omit the ClientOS parameter from the query, only the packages that were sequenced to support any operating system appear in the metadata. |
+
Version of App-V | +Query syntax | +Parameter descriptions | +Example | +||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
App-V 5.0 SP3 and App-V 5.1 |
+
|
+
+ To get the name of the Publishing server and the port number (http://<PubServer>:<Publishing Port#>) from the App-V Client, look at the URL configuration of the Get-AppvPublishingServer PowerShell cmdlet. |
+
In the example: +
|
+||||||||||
App-V 5.0 through App-V 5.0 SP2 |
+
+Note
+
+ClientVersion and ClientOS are supported only in App-V 5.0 SP3 and App-V 5.1. +
+
+ |
+See the information for App-V 5.0 SP3 and App-V 5.1. |
+
In the example, A Windows Server 2012 R2 named “pubsvr01” hosts the Management and Publishing services. |
+
Operating system | +Architecture | +Operating string string value | +
---|---|---|
Windows 10 |
+64-bit |
+WindowsClient_10.0_x64 |
+
Windows 10 |
+32-bit |
+WindowsClient_10.0_x86 |
+
Windows 8.1 |
+64-bit |
+WindowsClient_6.2_x64 |
+
Windows 8.1 |
+32-bit |
+WindowsClient_6.2_x86 |
+
Windows 8 |
+64-bit |
+WindowsClient_6.2_x64 |
+
Windows 8 |
+32-bit |
+WindowsClient_6.2_x86 |
+
Windows Server 2012 R2 |
+64-bit |
+WindowsServer_6.2_x64 |
+
Windows Server 2012 R2 |
+32-bit |
+WindowsServer_6.2_x86 |
+
Windows Server 2012 |
+64-bit |
+WindowsServer_6.2_x64 |
+
Windows Server 2012 |
+32-bit |
+WindowsServer_6.2_x86 |
+
Windows 7 |
+64-bit |
+WindowsClient_6.1_x64 |
+
Windows 7 |
+32-bit |
+WindowsClient_6.1_x86 |
+
Windows Server 2008 R2 |
+64-bit |
+WindowsServer_6.1_x64 |
+
Windows Server 2008 R2 |
+32-bit |
+WindowsServer_6.1_x86 |
+
Sequencer Feature | +App-V 5.0 Sequencer Functionality | +
---|---|
Reboot processing |
+When an application prompts for a restart, you should allow the application to restart the computer running the sequencer. The computer running the sequencer will restart and the sequencer will resume in monitoring mode. |
+
Specifying the virtual application directory |
+Virtual Application Directory is a mandatory parameter. For best results, it should match the installation directory of the application installer. This results in more optimal performance and application compatibility. |
+
Editing shortcuts/FTAs |
+The Shortcuts/FTA page is on the Advanced editing page after the sequencing wizard has completed. |
+
Change History Tab |
+The Change History tab has been removed for App-V 5.0. |
+
OSD Tab |
+The OSD tab has been removed for App-V 5.0. |
+
Virtual Services Tab |
+The virtual services tab has been removed for App-V 5.0. |
+
Files/Virtual File System Tab |
+These tabs are combined and allow you to modify package files. |
+
Deployment Tab |
+There are no longer options to configure the server URL in the packages. You should configure this now using deployment configuration, or the management server. |
+
Package Converter Tool |
+You can now use PowerShell to convert packages created in previous versions. |
+
Add-on/Middleware |
+You can expand parent packages when you are sequencing an Add-On or Middleware application. Add-ons and Middleware packages must be connected using connection groups in App-V 5.0. |
+
Files output |
+The following files are created with App-V 5.0, Windows Installer (.msi), .appv, deployment configuration, user configuration, and the Report.XML. |
+
Compression/Security descriptors/MSI packages |
+Compression and the creation of a Windows Installer (.msi) file are automatic for all packages and you can no longer override security descriptors. |
+
Tools / Options |
+The Diagnostics window has been removed as well as several other settings. |
+
Installation Drive |
+An installation drive is no longer required when you install an application. |
+
OOS Streaming |
+If no stream optimization is performed, packages are stream faulted when they are requested by computers running the App-V 5.0 client until they can launch. |
+
Q:\ |
+App-V 5.0 uses the native file system and no longer requires a Q:\. |
+
Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.) +20 Roszel Road +Princeton, NJ 08540 |
++ |
Telephone number from within the United States: |
+(800) 221-4792 |
+
Telephone number from outside the United States and Canada: |
+(609) 452-0606 |
+
Fax: |
+(609) 987-8116 |
+
[http://www.learningally.org/](http://go.microsoft.com/fwlink/?linkid=239) |
+Web addresses can change, so you might be unable to connect to the website or sites mentioned here. |
+
Release Date | +Changes | +
---|---|
Month dd, yyyy |
+Original release of this guide. |
+
+ | Task | +References | +
---|---|---|
![]() |
+Decide on the best DaRT 10 deployment option for your requirements and deploy it. |
+[Deploying DaRT 10 to Administrator Computers](deploying-dart-10-to-administrator-computers.md) |
+
![]() |
+Use the DaRT Recovery Image wizard to create the DaRT recovery image ISO. |
+[Creating the DaRT 10 Recovery Image](creating-the-dart-10-recovery-image.md) |
+
![]() |
+Decide on the best DaRT 10 recovery image deployment option for your requirements and deploy it. |
+[Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-10.md) |
+
+ | Task | +References | +
---|---|---|
![]() |
+Review the DaRT 10 Supported Configurations information to confirm that the computers you have selected for client or feature installation meet the minimum hardware and operating system requirements. |
+[DaRT 10 Supported Configurations](dart-10-supported-configurations.md) |
+
![]() |
+Understand the deployment prerequisites and decide which tools to include on the DaRT recovery image. |
+[Planning to Create the DaRT 10 Recovery Image](planning-to-create-the-dart-10-recovery-image.md) |
+
![]() |
+Determine which method, or methods, you will use to deploy the DaRT recovery image. |
+[Planning How to Save and Deploy the DaRT 10 Recovery Image](planning-how-to-save-and-deploy-the-dart-10-recovery-image.md) |
+
Prerequisite | +Details | +
---|---|
Windows Assessment and Development Kit (ADK) |
+Required for the DaRT Recovery Image wizard. Contains the Deployment Tools, which are used to customize, deploy, and service Windows images, and contains the Windows Preinstallation Environment (Windows PE). The ADK is not required if you are installing only the Remote Connection Viewer and/or Crash Analyzer. |
+
Windows Development Kit OR Software Development Kit (optional) |
+Crash Analyzer requires the Windows 10 Debugging Tools from the Windows Driver Kit to analyze memory dump files. |
+
Windows 10 64-bit or 32-bit ISO image |
+DaRT requires the Windows Recovery Environment (Windows RE) image from the Windows 10 media. Download the 32-bit or 64-bit version of Windows 10, depending on the type of DaRT recovery image you want to create. If you support both system types in your environment, download both versions of Windows 10. |
+
Prerequisite | +Details | +
---|---|
DaRT 10 Remote Connection Viewer |
+Must be installed on a Windows 10 operating system. |
+
Debugging Tools for Windows |
+Required only if you are installing the Crash Analyzer tool |
+
Operating System | +Edition | +Service Pack | +System Architecture | +Operating System Requirements | +RAM Requirement for Running DaRT | +
---|---|---|---|---|---|
Windows 10 |
+All editions |
+N/A |
+64-bit |
+2 GB |
+2.5 GB |
+
Windows 10 |
+All editions |
+N/A |
+32-bit |
+1 GB |
+1.5 GB |
+
Operating System | +Edition | +Service Pack | +System Architecture | +Operating System Requirements | +RAM Requirements for Running DaRT | +
---|---|---|---|---|---|
Windows 10 |
+All editions |
+N/A |
+64-bit |
+2 GB |
+2.5 GB |
+
Windows 10 (with Remote Connection Viewer 10.0 only) |
+All editions |
+N/A |
+32-bit |
+1 GB |
+1.5 GB |
+
Windows 8 |
+All editions |
+N/A |
+64-bit |
+2 GB |
+2.5 GB |
+
Windows 8 (with Remote Connection Viewer 8.0 only) |
+All editions |
+N/A |
+32-bit |
+1 GB |
+1.5 GB |
+
Windows 7 (with Remote Connection Viewer 7.0 only) |
+All editions |
+SP1, SP2 |
+64-bit or 32-bit |
+1 GB |
+N/A |
+
Windows Server 2012 |
+Standard, Enterprise, Data Center |
+N/A |
+64-bit |
+2 GB |
+1.0 GB |
+
Windows Server 2012 R2 |
+Standard, Enterprise, Data Center |
+N/A |
+64-bit |
+2 GB |
+1.0 GB |
+
Operating System | +Edition | +Service Pack | +System Architecture | +Operating System Requirements | +RAM Requirements | +
---|---|---|---|---|---|
Windows 10 |
+All editions |
+N/A |
+64-bit |
+2 GB |
+2.5 GB |
+
Windows 10 |
+All editions |
+N/A |
+32-bit |
+1 GB |
+1.5 GB |
+
Name | +Description | +
---|---|
Copy-DartImage |
+Burns an ISO to a CD, DVD, or USB drive. |
+
Export-DartImage |
+Allows the source WIM file, which contains a DaRT image, to be converted into an ISO file. |
+
New-DartConfiguration |
+Creates a DaRT configuration object that is needed to apply a DaRT toolset to a Windows Image. |
+
Set-DartImage |
+Applies a DartConfiguration object to a mounted Windows Image. This includes adding all files, configuration, and package dependencies. |
+
Parameter |
+ Description |
+
-network |
+ Initializes the network services. |
+
-remount |
+ Remaps the drive letters. |
+
-prompt |
+ Displays messages that ask the end user to specify whether to initialize the network and remap the drives. +
+ Warning
+
+ The end user’s response to the prompt overrides the –network and –remount switches. +
+
+ |
+
Command | +Parameter | +Description | +
---|---|---|
RemoteRecovery.exe |
+ -nomessage |
+ Specifies that the confirmation prompt is not displayed. Remote Connection continues just as if the end user had responded "Yes" to the confirmation prompt. |
+
WaitForConnection.exe |
+ none |
+ Prevents a custom script from continuing until either Remote Connection is not running or a valid connection is established with the end-user computer. +
+ Important
+
+ This command serves no function if it is specified independently. It must be specified in a script to function correctly. +
+
+ |
+
Parameter | +Description | +
---|---|
-ticket=<ticketnumber> |
+ Where <ticketnumber> is the ticket number, including the dashes, that is generated by Remote Connection. |
+
-ipaddress=<ipaddress> |
+ Where <ipaddress> is the IP address that is generated by Remote Connection. |
+
-port=<port> |
+ Where <port> is the port that corresponds to the specified IP address. |
+
Method to Boot into DaRT | +Advantages | +Disadvantages | +
---|---|---|
Removable Media +The recovery image is written to a CD, DVD, or USB drive to enable support staff to take the recovery tools with them to the unstable computer. |
+Supports scenarios in which the master boot record (MBR) is corrupted and you cannot access the hard disk and supports cases in which there is no network connection. +Enables you to create multiple recovery images with different tools to provide different levels of support. +Provides a built-in tool for burning recovery images to removable media. |
+Requires that support staff are physically at the end-user computer to boot into DaRT. +Requires time and maintenance to create multiple media with different configurations for 32-bit and 64-bit computers. |
+
From a remote (network) partition +The recovery image is hosted on a network boot server like Windows Deployment Services (Windows DS), which allows users or support staff to stream it to computers on demand. |
+Available to all computers that have access to the network boot server. +Recovery images are hosted on a central server, which enables centralized updates. +Centralized help desk staff can provide repairs by using remote connectivity. +No local storage requirement on the clients. +Ability to create multiple recovery images with different tools for specific support levels. |
+The need to secure Windows DS infrastructure to ensure that regular users can start only the DaRT recovery image and not the full operating system imaging process. + + +Requires that the end-user computer is connected to the network at runtime. +Requires that the recovery image is brought across the network. |
+
From a recovery partition on the local hard drive +The recovery image is installed on a local hard drive either manually or by using electronic software distribution systems like System Center Configuration Manager. |
+The recovery image is always available because it is pre-staged on the computer. +Centralized help desk staff can provide support by using Remote Connection. +The recovery image is centrally managed and deployed. +Additional recovery key requests on computers that are protected by Windows BitLocker drive encryption are eliminated. |
+Local storage is required. +A dedicated, unencrypted partition for recovery image placement is recommended to reduce the risk of a failed boot partition. +When updating DaRT, you must update all computers in your enterprise instead of just one partition (on the network) or removable device. +Additional consideration is required if you deploy the recovery image after BitLocker has been enabled. |
+
Prerequisite |
+Details |
+
Windows 10 source files |
+Required to create the DaRT recovery image. Provide the path of a Windows 10 DVD or of Windows 10 source files. |
+
Windows Debugging Tools for your platform |
+Required when you run the Crash Analyzer to determine the cause of a computer failure. We recommend that you specify the path of the Windows Debugging Tools at the time that you create the DaRT recovery image. You can download the Windows Debugging Tools here: [Download and Install Debugging Tools for Windows](http://go.microsoft.com/fwlink/?LinkId=99934). |
+
Optional: Windows symbols files for use with Crash Analyzer |
+Typically, debugging information is stored in a symbol file that is separate from the program. You must have access to the symbol information when you debug an application that has stopped responding, for example, if it stopped working. For more information, see [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer-dart-10.md). |
+
Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.) +20 Roszel Road +Princeton, NJ 08540 |
++ |
Telephone number from within the United States: |
+(800) 221-4792 |
+
Telephone number from outside the United States and Canada: |
+(609) 452-0606 |
+
Fax: |
+(609) 987-8116 |
+
[http://www.learningally.org/](http://go.microsoft.com/fwlink/?linkid=239) |
+Web addresses can change, so you might be unable to connect to the website or sites mentioned here. |
+
+ | Task | +References | +
---|---|---|
![]() |
+Decide on the best DaRT 7 deployment option for your requirements and deploy it. |
+[Deploying DaRT 7.0 to Administrator Computers](deploying-dart-70-to-administrator-computers-dart-7.md) |
+
![]() |
+Use the DaRT Recovery Image Wizard to create the DaRT recovery image ISO. |
+[Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md) |
+
![]() |
+Decide on the best DaRT 7 recovery image deployment option for your requirements and deploy it. |
+[Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md) |
+
+ | Task | +References | +
---|---|---|
![]() |
+Review the DaRT 7 Supported Configurations information to confirm that the computers you have selected for client or feature installation meet the minimum hardware and operating system requirements. |
+[DaRT 7.0 Supported Configurations](dart-70-supported-configurations-dart-7.md) |
+
![]() |
+Understand the deployment prerequisites and decide which tools to include on the DaRT recovery image. |
+[Planning to Create the DaRT 7.0 Recovery Image](planning-to-create-the-dart-70-recovery-image.md) |
+
![]() |
+Determine which method, or methods, you will use to deploy the DaRT recovery image. |
+[Planning How to Save and Deploy the DaRT 7.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-70-recovery-image.md) |
+
Platform and DaRT Version | +Recovery Image Requirements | +
---|---|
64-Bit DaRT 7.0 |
+Create and use a 64-Bit DaRT recovery image. |
+
32-Bit DaRT 7.0 |
+Create and use a 32-Bit DaRT recovery image. |
+
Operating System | +System Requirements for DaRT | +
---|---|
Windows 7 64-Bit (2GB) |
+2.5GB of system memory |
+
Windows 7 32-Bit (1GB) |
+1.5GB of system memory |
+
Windows Server 2008 R2 (512MB) |
+1GB of system memory |
+
Parameter | +Description | +
---|---|
-network |
+ Initializes the network services. |
+
-remount |
+ Remaps the drive letters. |
+
-prompt |
+ Displays messages asking the end user to specify whether to initialize the network and remap the drives. +
+ Important
+
+ The end user’s response to the prompts overrides the -network and -remount switches. +
+
+ |
+
Command | +Parameter | +Description | +
---|---|---|
RemoteRecovery.exe |
+ -nomessage |
+ Specifies that the confirmation prompt is not displayed. Remote Connection continues just as if the end user had responded "Yes" to the confirmation prompt. |
+
WaitForConnection.exe |
+ none |
+ Prevents a custom script from continuing until either Remote Connection is not running or a valid connection is established with the end-user computer. +
+ Important
+
+ This command serves no function if it is specified independently. It must be specified in a script to function correctly. +
+
+ |
+
Parameter | +Description | +
---|---|
-ticket=<ticketnumber> |
+ Where <ticketnumber> is the ticket number, including the dashes, that is generated by Remote Connection. |
+
-ipaddress=<ipaddress> |
+ Where <ipaddress> is the IP address that is generated by Remote Connection. |
+
-port=<port> |
+ Where <port> is the port that corresponds to the specified IP address. |
+
Method to Boot into DaRT | +Advantages | +Disadvantages | +
---|---|---|
From a CD or DVD |
+Supports scenarios in which the master boot record (MBR) is corrupted and you cannot access the hard disk. Also supports cases in which there is no network connection. +This is most familiar to users of earlier versions of DaRT, and a CD or DVD can be burned directly from the DaRT Recovery Image Wizard. |
+Requires that someone with access to the CD or DVD is physically at the end-user computer to boot into DaRT. |
+
From a USB flash drive (UFD) |
+Provides same advantages as booting from a CD or DVD and also provides support to computers that have no CD or DVD drive. |
+Requires you to format the UFD before you can use it to boot into DaRT. Also requires that someone with access to the UFD is physically at the end-user computer to boot into DaRT. |
+
From a remote (network) partition |
+Lets you boot into DaRT without needing a CD, DVD, or UFD. Also allows for easy upgrades of DaRT because there is only one file location to update. |
+Does not work if the end-user computer is not connected to the network. +Widely available to end users and might require additional security considerations when you are creating the recovery image. |
+
From a recovery partition |
+Lets you boot into DaRT without needing a CD, DVD, or UFD that includes instances in which there is no network connectivity. +Also, can be implemented and managed as part of your standard Windows image process by using automated distribution tools, such as System Center Configuration Manager. |
+When updating DaRT, requires you to update all computers in your enterprise instead of just one partition (on the network) or device (CD, DVD, or UFD). |
+
Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.) +20 Roszel Road +Princeton, NJ 08540 |
++ |
Telephone number from within the United States: |
+(800) 221-4792 |
+
Telephone number from outside the United States and Canada: |
+(609) 452-0606 |
+
Fax: |
+(609) 987-8116 |
+
[http://www.learningally.org/](http://go.microsoft.com/fwlink/?linkid=239) |
+Web addresses can change, so you might be unable to connect to the website or sites mentioned here. |
+
+ | Task | +References | +
---|---|---|
![]() |
+Decide on the best DaRT 8.0 deployment option for your requirements and deploy it. |
+[Deploying DaRT 8.0 to Administrator Computers](deploying-dart-80-to-administrator-computers-dart-8.md) |
+
![]() |
+Use the DaRT Recovery Image wizard to create the DaRT recovery image ISO. |
+[Creating the DaRT 8.0 Recovery Image](creating-the-dart-80-recovery-image-dart-8.md) |
+
![]() |
+Decide on the best DaRT 8.0 recovery image deployment option for your requirements and deploy it. |
+[Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-8.md) |
+
+ | Task | +References | +
---|---|---|
![]() |
+Review the DaRT 8.0 Supported Configurations information to confirm that the computers you have selected for client or feature installation meet the minimum hardware and operating system requirements. |
+[DaRT 8.0 Supported Configurations](dart-80-supported-configurations-dart-8.md) |
+
![]() |
+Understand the deployment prerequisites and decide which tools to include on the DaRT recovery image. |
+[Planning to Create the DaRT 8.0 Recovery Image](planning-to-create-the-dart-80-recovery-image-dart-8.md) |
+
![]() |
+Determine which method, or methods, you will use to deploy the DaRT recovery image. |
+[Planning How to Save and Deploy the DaRT 8.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md) |
+
Prerequisite | +Details | +
---|---|
Windows Assessment and Development Kit (ADK) |
+Required for the DaRT Recovery Image wizard. Contains the Deployment Tools, which are used to customize, deploy, and service Windows images, and contains the Windows Preinstallation Environment (Windows PE). The ADK is not required if you are installing only the Remote Connection Viewer and/or Crash Analyzer. |
+
.NET Framework 4.5 |
+Required by the DaRT Recovery Image wizard. |
+
Windows Development Kit OR Software Development Kit (optional) |
+Crash Analyzer requires the Windows 8 Debugging Tools from the Windows Driver Kit to analyze memory dump files. |
+
Windows 8 64-bit ISO image |
+DaRT requires the Windows Recovery Environment (Windows RE) image from the Windows 8 media. Download the 32-bit or 64-bit version of Windows 8, depending on the type of DaRT recovery image you want to create. If you support both system types in your environment, download both versions of Windows 8. |
+
Prerequisite | +Details | +
---|---|
DaRT 8.0 Remote Connection Viewer |
+Must be installed on a Windows 8 operating system. |
+
NET Framework 4.5 |
+Required by the DaRT Recovery Image wizard |
+
Debugging Tools for Windows |
+Required only if you are installing the Crash Analyzer tool |
+
Operating System | +Edition | +Service Pack | +System Architecture | +Operating System Requirements | +RAM Requirement for Running DaRT | +
---|---|---|---|---|---|
Windows 8 |
+All editions |
+N/A |
+64-bit |
+2 GB |
+2.5 GB |
+
Windows 8 |
+All editions |
+N/A |
+32-bit |
+1 GB |
+1.5 GB |
+
Windows Server 2012 |
+Standard, Enterprise, Data Center |
+N/A |
+64-bit |
+512 MB |
+1 .0 GB |
+
Operating System | +Edition | +Service Pack | +System Architecture | +Operating System Requirements | +RAM Requirements for Running DaRT | +
---|---|---|---|---|---|
Windows 8 |
+All editions |
+N/A |
+64-bit |
+2 GB |
+2.5 GB |
+
Windows 8 (with Remote Connection Viewer 8.0 only) |
+All editions |
+N/A |
+32-bit |
+1 GB |
+1.5 GB |
+
Windows 7 (with Remote Connection Viewer 7.0 only) |
+All editions |
+SP1, SP2 |
+64-bit or 32-bit |
+1 GB |
+N/A |
+
Windows Server 2012 |
+Standard, Enterprise, Data Center |
+N/A |
+64-bit |
+51 |
+1.0 GB |
+
Operating System | +Edition | +Service Pack | +System Architecture | +Operating System Requirements | +RAM Requirements | +
---|---|---|---|---|---|
Windows 8 |
+All editions |
+N/A |
+64-bit |
+2 GB |
+2.5 GB |
+
Windows 8 |
+All editions |
+N/A |
+32-bit |
+1 GB |
+1.5 GB |
+
Windows Server 2012 |
+Standard, Enterprise, Data Center |
+N/A |
+64-bit |
+512 MB |
+1.0 GB |
+
Name | +Description | +
---|---|
Copy-DartImage |
+Burns an ISO to a CD, DVD, or USB drive. |
+
Export-DartImage |
+Allows the source WIM file, which contains a DaRT image, to be converted into an ISO file. |
+
New-DartConfiguration |
+Creates a DaRT configuration object that is needed to apply a DaRT toolset to a Windows Image. |
+
Set-DartImage |
+Applies a DartConfiguration object to a mounted Windows Image. This includes adding all files, configuration, and package dependencies. |
+
Parameter |
+ Description |
+
-network |
+ Initializes the network services. |
+
-remount |
+ Remaps the drive letters. |
+
-prompt |
+ Displays messages that ask the end user to specify whether to initialize the network and remap the drives. +
+ Warning
+
+ The end user’s response to the prompt overrides the –network and –remount switches. +
+
+ |
+
Command | +Parameter | +Description | +
---|---|---|
RemoteRecovery.exe |
+ -nomessage |
+ Specifies that the confirmation prompt is not displayed. Remote Connection continues just as if the end user had responded "Yes" to the confirmation prompt. |
+
WaitForConnection.exe |
+ none |
+ Prevents a custom script from continuing until either Remote Connection is not running or a valid connection is established with the end-user computer. +
+ Important
+
+ This command serves no function if it is specified independently. It must be specified in a script to function correctly. +
+
+ |
+
Parameter | +Description | +
---|---|
-ticket=<ticketnumber> |
+ Where <ticketnumber> is the ticket number, including the dashes, that is generated by Remote Connection. |
+
-ipaddress=<ipaddress> |
+ Where <ipaddress> is the IP address that is generated by Remote Connection. |
+
-port=<port> |
+ Where <port> is the port that corresponds to the specified IP address. |
+
Method to Boot into DaRT | +Advantages | +Disadvantages | +
---|---|---|
Removable Media +The recovery image is written to a CD, DVD, or USB drive to enable support staff to take the recovery tools with them to the unstable computer. |
+Supports scenarios in which the master boot record (MBR) is corrupted and you cannot access the hard disk and supports cases in which there is no network connection. +Enables you to create multiple recovery images with different tools to provide different levels of support. +Provides a built-in tool for burning recovery images to removable media. |
+Requires that support staff are physically at the end-user computer to boot into DaRT. +Requires time and maintenance to create multiple media with different configurations for 32-bit and 64-bit computers. |
+
From a remote (network) partition +The recovery image is hosted on a network boot server like Windows Deployment Services (Windows DS), which allows users or support staff to stream it to computers on demand. |
+Available to all computers that have access to the network boot server. +Recovery images are hosted on a central server, which enables centralized updates. +Centralized help desk staff can provide repairs by using remote connectivity. +No local storage requirement on the clients. +Ability to create multiple recovery images with different tools for specific support levels. |
+The need to secure Windows DS infrastructure to ensure that regular users can start only the DaRT recovery image and not the full operating system imaging process. + + +Requires that the end-user computer is connected to the network at runtime. +Requires that the recovery image is brought across the network. |
+
From a recovery partition on the local hard drive +The recovery image is installed on a local hard drive either manually or by using electronic software distribution systems like System Center Configuration Manager. |
+The recovery image is always available because it is pre-staged on the computer. +Centralized help desk staff can provide support by using Remote Connection. +The recovery image is centrally managed and deployed. +Additional recovery key requests on computers that are protected by Windows BitLocker drive encryption are eliminated. |
+Local storage is required. +A dedicated, unencrypted partition for recovery image placement is recommended to reduce the risk of a failed boot partition. +When updating DaRT, you must update all computers in your enterprise instead of just one partition (on the network) or removable device. +Additional consideration is required if you deploy the recovery image after BitLocker has been enabled. |
+
Prerequisite |
+Details |
+
Windows 8 source files |
+Required to create the DaRT recovery image. Provide the path of a Windows 8 DVD or of Windows 8 source files. |
+
Windows Debugging Tools for your platform |
+Required when you run the Crash Analyzer to determine the cause of a computer failure. We recommend that you specify the path of the Windows Debugging Tools at the time that you create the DaRT recovery image. You can download the Windows Debugging Tools here: [Download and Install Debugging Tools for Windows](http://go.microsoft.com/fwlink/?LinkId=99934). |
+
Optional: Defender definitions |
+The latest definitions for Defender are required when you run Defender. Although you can download the definitions when you run Defender, we recommend that you download the latest definitions at the time you create the DaRT recovery image so that you can still run the tool with the latest definitions even if the problem computer does not have network connectivity. |
+
Optional: Windows symbols files for use with Crash Analyzer |
+Typically, debugging information is stored in a symbol file that is separate from the program. You must have access to the symbol information when you debug an application that has stopped responding, for example, if it stopped working. For more information, see [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md). |
+
Microsoft Advanced Group Policy Management (AGPM) extends the capabilities of the Group Policy Management Console (GPMC) to provide change control and improved management. +AGPM 4.0 SP3 – Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Vista SP1, Windows Server 2012, Windows Server 2012 R2, Windows Server 2008, Windows Server 2008 R2 +AGPM 4.0 SP2 - Windows 8.1, Windows 8, Windows 7, Windows Vista SP1, Windows Server 2012, Windows Server 2008, Windows Server 2008 R2 +AGPM 4.0 SP1 - Windows 8, Windows 7, Windows Vista SP1, Windows Server 2012, Windows Server 2008, Windows Server 2008 R2 +AGPM 4.0 - Windows Vista SP1, Windows 7, Windows Server 2008, Windows Server 2008 R2 +AGPM 3.0- Windows Vista SP1, Windows Server 2008 +AGPM 2.5 - Windows Vista, Windows Server 2003 |
+[Overview of Microsoft Advanced Group Policy Management](http://go.microsoft.com/fwlink/p/?LinkId=232980)(http://go.microsoft.com/fwlink/p/?LinkId=232980) +[AGPM 4.0 SP3](https://technet.microsoft.com/library/mt346468.aspx) (https://technet.microsoft.com/library/mt346468.aspx) +[AGPM 4.0 SP2](http://go.microsoft.com/fwlink/p/?LinkId=325035) (http://go.microsoft.com/fwlink/p/?LinkId=325035) +[AGPM 4.0 SP1](http://go.microsoft.com/fwlink/p/?LinkId=286715) (http://go.microsoft.com/fwlink/p/?LinkId=286715) +[AGPM 4.0](http://go.microsoft.com/fwlink/p/?LinkId=232964) (http://go.microsoft.com/fwlink/p/?LinkId=232964) +[AGPM 3.0](http://go.microsoft.com/fwlink/p/?LinkId=232967) (http://go.microsoft.com/fwlink/p/?LinkId=232967) +[AGPM 2.5](http://go.microsoft.com/fwlink/p/?LinkId=232969) (http://go.microsoft.com/fwlink/p/?LinkId=232969) +[AGPM Whitepapers on the Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkId=232275) (http://go.microsoft.com/fwlink/p/?LinkId=232275) |
+
Microsoft Application Virtualization (App-V) lets you make applications available to end user computers without installing the applications directly on those computers. |
+[Microsoft Application Virtualization 5.1 Administrator's Guide](../appv-v5/microsoft-application-virtualization-51-administrators-guide.md) +[About App-V 5.0 SP3](../appv-v5/about-app-v-50-sp3.md) +[About App-V 5.0 SP2](../appv-v5/about-app-v-50-sp2.md) +[About App-V 5.0 SP1](../appv-v5/about-app-v-50-sp1.md) +[Microsoft Application Virtualization 5.0 Administrator's Guide](../appv-v5/microsoft-application-virtualization-50-administrators-guide.md) +[About Microsoft Application Virtualization 4.6 SP3](../appv-v4/about-microsoft-application-virtualization-46-sp3.md) +[About Microsoft Application Virtualization 4.6 SP2](../appv-v4/about-microsoft-application-virtualization-46-sp2.md) +[About Microsoft Application Virtualization 4.6 SP1](../appv-v4/about-microsoft-application-virtualization-46-sp1.md) +[About Microsoft Application Virtualization 4.6](../appv-v4/about-microsoft-application-virtualization-46.md) +[About Microsoft Application Virtualization 4.5](../appv-v4/about-microsoft-application-virtualization-45.md) +[SoftGrid](http://go.microsoft.com/fwlink/p/?LinkId=232981) (http://go.microsoft.com/fwlink/p/?LinkId=232981) +[App-V Whitepapers on the Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkId=231902) (http://go.microsoft.com/fwlink/p/?LinkId=231902) +[App-V 5.0 eBooks](http://go.microsoft.com/fwlink/p/?LinkId=309570) (http://go.microsoft.com/fwlink/p/?LinkId=309570) |
+
Microsoft BitLocker Administration and Monitoring (MBAM) provides an administrative interface to enterprise-wide BitLocker drive encryption. |
+[Microsoft BitLocker Administration and Monitoring 2.5](../mbam-v25/microsoft-bitlocker-administration-and-monitoring-25.md) +[MBAM 2.5 Video Demonstration: Deploying MBAM 2.5](http://go.microsoft.com/fwlink/?LinkId=518206) (http://go.microsoft.com/fwlink/?LinkId=518206) +[About MBAM 2.5 SP1](../mbam-v25/about-mbam-25-sp1.md) +[About MBAM 2.0 SP1](../mbam-v2/about-mbam-20-sp1.md) +[Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide](../mbam-v2/microsoft-bitlocker-administration-and-monitoring-2-administrators-guide.md) +[Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide](../mbam-v1/microsoft-bitlocker-administration-and-monitoring-1-administrators-guide.md) +[MBAM Whitepapers on the Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkId=231905) (http://go.microsoft.com/fwlink/p/?LinkId=231905) +[MBAM 1.0 eBooks](http://go.microsoft.com/fwlink/p/?LinkId=309571) (http://go.microsoft.com/fwlink/p/?LinkId=309571) |
+
Microsoft Diagnostics and Recovery Toolset (DaRT) helps troubleshoot and repair Windows-based computers. +DaRT 10 - Windows 10 +DaRT 8.1 - Windows 8.1, Windows Server 2012 R2 +DaRT 8.0 SP1 - Windows 8, Windows Server 2012 +DaRT 8.0 - Windows 8, Windows Server 2012 +DaRT 7.0 - Windows 7, Windows Server 2008 R2 +DaRT 6.5 - Windows 7, Windows Server 2008 R2 +DaRT 6.0 - Windows Vista, Windows Server 2008 +DaRT 5.0 - Windows 2000, Windows XP, Windows Server 2003 |
+[Diagnostics and Recovery Toolset 10](../dart-v10/diagnostics-and-recovery-toolset-10.md) +[About DaRT 8.1](../dart-v8/about-dart-81.md) +[About DaRT 8.0 SP1](../dart-v8/about-dart-80-sp1.md) +[Diagnostics and Recovery Toolset 8 Administrator's Guide](../dart-v8/diagnostics-and-recovery-toolset-8-administrators-guide.md) +[Diagnostics and Recovery Toolset 7 Administrator's Guide](../dart-v7/diagnostics-and-recovery-toolset-7-administrators-guide.md) +[DaRT 6.5](http://go.microsoft.com/fwlink/p/?LinkId=232983) (http://go.microsoft.com/fwlink/p/?LinkId=232983) +[DaRT Whitepapers on the Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkId=232274) (http://go.microsoft.com/fwlink/p/?LinkId=232274) +[DaRT 8.0 eBook](http://go.microsoft.com/fwlink/p/?LinkId=309573) (http://go.microsoft.com/fwlink/p/?LinkId=309573) +[DaRT 7.0 eBook](http://go.microsoft.com/fwlink/p/?LinkId=309572) (http://go.microsoft.com/fwlink/p/?LinkId=309572) |
+
Microsoft Desktop Enterprise Monitoring (DEM) monitors and reports enterprise-wide desktop application and system failures. |
+[DEM 3.5](http://go.microsoft.com/fwlink/p/?LinkId=232985) (http://go.microsoft.com/fwlink/p/?LinkId=232985) +[DEM Whitepapers on the Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkId=232276) (http://go.microsoft.com/fwlink/p/?LinkId=232276) |
+
Microsoft Enterprise Desktop Virtualization (MED-V) uses Microsoft Virtual PC to provide an enterprise solution for desktop virtualization. +MED-V 2.0 - Windows 7 +MED-V 1.0 SP1 - Windows 7, Windows Vista, Windows XP +MED-V 1.0 - Windows Vista, Windows XP |
+[Microsoft Enterprise Desktop Virtualization 2.0](../medv-v2/microsoft-enterprise-desktop-virtualization-20.md) +[About MED-V 1.0 SP1](../p_mdop_medv_1/about-med-v-10-sp1.md) +[Microsoft Enterprise Desktop Virtualization 1.0](74a9483e-87a1-4394-a4d5-50cff5c07297) +[MED-V Whitepapers on the Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkId=231903) (http://go.microsoft.com/fwlink/p/?LinkId=231903) |
+
Microsoft User Experience Virtualization (UE-V) captures settings to apply to computers accessed by the user including desktop computers, laptop computers, and VDI sessions. |
+[Microsoft User Experience Virtualization (UE-V) 2.x](../uev-v2/microsoft-user-experience-virtualization--ue-v--2x-new-uevv2.md) +[What's New in UE-V 2.1 SP1](../uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md) +[What's New in UE-V 2.1](../uev-v2/whats-new-in-ue-v-21-new-uevv2.md) +[What's New in UE-V 2.0](../uev-v2/whats-new-in-ue-v-20-new-uevv2.md) +[About User Experience Virtualization 1.0 SP1](../uev-v1/about-user-experience-virtualization-10-sp1.md) +[Microsoft User Experience Virtualization (UE-V) 1.0](../uev-v1/microsoft-user-experience-virtualization--ue-v--10.md) +[UE-V 1.0 eBooks](http://go.microsoft.com/fwlink/p/?LinkId=309574) (http://go.microsoft.com/fwlink/p/?LinkId=309574) |
+
[MDOP Solutions and Scenarios](../solutions/mdop-solutions-and-scenarios.md) |
+[Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0](../solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md) +[Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0](../solutions/virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md) +[Creating App-V 4.5 Databases Using SQL Scripting](../solutions/creating-app-v-45-databases-using-sql-scripting.md) +[Application Publishing and Client Interaction for App-V 5](../solutions/application-publishing-and-client-interaction-for-app-v-5-solutions.md) +[How to Download and Deploy MDOP Group Policy (.admx) Templates](../solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md) |
+
MDOP Videos |
+For a list of available MDOP videos, go to [Microsoft Desktop Optimization Pack Technologies Videos](http://go.microsoft.com/fwlink/p/?LinkId=234275) (http://go.microsoft.com/fwlink/p/?LinkId=234275). |
+
MDOP Virtual Labs |
+For a list of available MDOP virtual labs, go to [Microsoft Desktop Optimization Pack (MDOP) Virtual Labs](http://go.microsoft.com/fwlink/p/?LinkId=234276) (http://go.microsoft.com/fwlink/p/?LinkId=234276). |
+
MDOP TechCenter |
+For technical whitepapers, evaluation materials, blogs, and additional MDOP resources, go to [MDOP TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=225286) (http://go.microsoft.com/fwlink/p/?LinkId=225286) + |
+
MDOP Forums |
+Join in the MDOP community where you can ask and answer questions at the [MDOP TechNet Forum](http://go.microsoft.com/fwlink/p/?LinkId=286973) (http://go.microsoft.com/fwlink/p/?LinkId=286973). |
+
Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.) +20 Roszel Road +Princeton, NJ 08540 |
++ |
Telephone number from within the United States: |
+(800) 221-4792 |
+
Telephone number from outside the United States and Canada: |
+(609) 452-0606 |
+
Fax: |
+(609) 987-8116 |
+
[http://www.learningally.org/](http://go.microsoft.com/fwlink/?linkid=239) |
+Web addresses can change, so you might be unable to connect to the website or sites mentioned here. |
+
Name | +Description | +
---|---|
Add-MbamHardwareType |
+Adds a new hardware model to the MBAM hardware inventory. This cmdlet can also specify whether the hardware is supported or unsupported for BitLocker drive encryption. |
+
Get-MbamBitLockerRecoveryKey |
+Requests an MBAM recovery key that will enable a user to unlock a computer or encrypted drive. |
+
Get-MbamHardwareType |
+Gets a master hardware inventory that contains data that indicates whether hardware models are compatible or incompatible with BitLocker drive encryption. |
+
Get-MbamTPMOwnerPassword |
+Provides a TPM owner password for a user to manage their TPM (Trusted Platform Module) access. Helps users when TPM has locked them out and will no longer accept their PIN. |
+
Install-Mbam |
+Installs MBAM features that provide advanced group policy, encryption, key recovery, and compliance reporting tools. |
+
Remove-MbamHardwareType |
+Removes the hardware models from the hardware inventory. |
+
Set-MbamHardwareType |
+Allows management of a master hardware inventory to designate whether or not hardware models are capable or incapable to perform BitLocker encryption. |
+
Uninstall-Mbam |
+Removes previously installed MBAM features that provide advanced policy, encryption, key recovery, and compliance reporting tools. |
+
+ | Task | +References | +Notes | +
---|---|---|---|
![]() |
+Review the Getting Started information about MBAM to gain a basic understanding of the product before you begin your deployment planning. |
+[Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) |
++ |
![]() |
+
+ Prepare your computing environment for the MBAM installation. To do so, you must enable the Transparent Data Encryption (TDE) on the SQL Server instances that will host MBAM databases. To enable TDE in your lab environment, you can create a .sql file to run against the master database that is hosted on the instance of the SQL Server that MBAM will use. +
+Note
+
+You can use the following example to create a .sql file for your lab environment to quickly enable TDE on the SQL Server instance that will host the MBAM databases. These SQL Server commands will enable TDE by using a locally signed SQL Server certificate. Make sure to back up the TDE certificate and its associated encryption key to the example local backup path of C:\Backup\. The TDE certificate and key are required when recover the database or move the certificate and key to another server that has TDE encryption in place. +
+
+
+
|
+[MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) +[Database Encryption in SQL Server 2008 Enterprise Edition](http://go.microsoft.com/fwlink/?LinkId=269703) |
++ |
![]() |
+Plan for and configure MBAM Group Policy requirements. |
+[Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md) |
++ |
![]() |
+Plan for and create the necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements. |
+[Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md) |
++ |
![]() |
+Plan for MBAM Server feature deployment. |
+[Planning for MBAM 1.0 Server Deployment](planning-for-mbam-10-server-deployment.md) |
++ |
![]() |
+Plan for MBAM Client deployment. |
+[Planning for MBAM 1.0 Client Deployment](planning-for-mbam-10-client-deployment.md) |
++ |
![]() |
+Review the MBAM supported configurations information to make sure that the selected client and server computers are supported for the MBAM feature installation. |
+[MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md) |
++ |
![]() |
+Run MBAM Setup to deploy MBAM Server features on a single server for evaluation purposes. |
+[How to Install and Configure MBAM on a Single Server](how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md) |
++ |
![]() |
+Add the Active Directory Domain Services security groups that you created during the planning phase to the appropriate local MBAM Server feature local groups on the new MBAM server. |
+[Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md) and [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-1.md) |
++ |
![]() |
+Create and deploy the required MBAM Group Policy Objects. |
+[Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md) |
++ |
![]() |
+Deploy the MBAM Client software. |
+[Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md) |
++ |
User Status | +Computer Not Exempt | +Computer Exempt | +
---|---|---|
User not exempt |
+BitLocker protection is enforced on the computer. |
+BitLocker protection is not enforced on the computer. |
+
User exempt |
+BitLocker protection is not enforced on the computer. |
+BitLocker protection is not enforced on the computer. |
+
+ | Task | +References | +Notes | +
---|---|---|---|
![]() |
+Complete the planning phase to prepare the computing environment for MBAM deployment. |
+[MBAM 1.0 Planning Checklist](mbam-10-planning-checklist.md) |
++ |
![]() |
+Review the information on MBAM supported configurations to make sure that your selected client and server computers are supported for MBAM feature installation. |
+[MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md) |
++ |
![]() |
+Run MBAM Setup to deploy MBAM Server features in the following order: +
+Note
+
+Keep track of the names of the servers each feature is installed on. You will use this information throughout the installation process. +
+
+ |
+[Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md) |
++ |
![]() |
+Add Active Directory Domain Services security groups created during the planning phase to the appropriate local MBAM Server feature administrators groups on the appropriate servers. |
+[Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md) and [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-1.md) |
++ |
![]() |
+Create and deploy the required MBAM Group Policy Objects. |
+[Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md) |
++ |
![]() |
+Deploy the MBAM Client software. |
+[Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md) |
++ |
Prerequisite | +Details | +
---|---|
Windows ServerWeb Server Role |
+This role must be added to a server operating system supported for the mbam Administration and Monitoring Server feature. |
+
Web Server (IIS) Management Tools |
+IIS Management Scripts and Tools |
+
Web Server Role Services |
+Common HTTP Features: +
Application Development: +
Security: +
|
+
Windows Server Features |
+Microsoft .NET Framework 3.5.1 features: +
Windows Process Activation Service +
|
+
+ | Task | +References | +Notes | +
---|---|---|---|
![]() |
+Review the “getting started” information about MBAM to gain a basic understanding of the product before you begin the deployment planning. |
+[Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) |
++ |
![]() |
+Plan for MBAM 1.0 Deployment Prerequisites and prepare your computing environment. |
+[MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) |
++ |
![]() |
+Plan for and configure MBAM Group Policy requirements. |
+[Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md) |
++ |
![]() |
+Plan for and create necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements. |
+[Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md) |
++ |
![]() |
+Review the MBAM 1.0 Supported Configurations documentation to ensure hardware that meets MBAM installation system requirements is available. |
+[MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md) |
++ |
![]() |
+Plan for MBAM Server feature deployment. |
+[Planning for MBAM 1.0 Server Deployment](planning-for-mbam-10-server-deployment.md) |
++ |
![]() |
+Plan for MBAM Client deployment. |
+[Planning for MBAM 1.0 Client Deployment](planning-for-mbam-10-client-deployment.md) |
++ |
![]() |
+Validate your deployment plan in a lab environment. |
+[Evaluating MBAM 1.0](evaluating-mbam-10.md) |
++ |
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows Server 2008 |
+Standard, Enterprise, Datacenter, or Web Server |
+SP2 only |
+32-bit or 64-bit |
+
Windows Server 2008 R2 |
+Standard, Enterprise, Datacenter, or Web Server |
++ | 64-bit |
+
MBAM Server Feature | +SQL Server Version | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|---|
Compliance and Audit Reports |
+Microsoft SQL Server 2008 |
+R2, Standard, Enterprise, Datacenter, or Developer Edition |
+SP2 |
+32-bit or 64-bit |
+
Recovery and Hardware Database |
+Microsoft SQL Server 2008 |
+R2, Enterprise, Datacenter, or Developer Edition +
+Important
+
+SQL Server Standard Editions are not supported for MBAM Recovery and Hardware Database Server feature installation. +
+
+ |
+SP2 |
+32-bit or 64-bit |
+
Compliance and Audit Database |
+Microsoft SQL Server 2008 |
+R2, Standard, Enterprise, Datacenter, or Developer Edition |
+SP2 |
+32-bit or 64-bit |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows 7 |
+Enterprise Edition |
+None, SP1 |
+32-bit or 64-bit |
+
Windows 7 |
+Ultimate Edition |
+None, SP1 |
+32-bit or 64-bit |
+
Policy Name | +Overview and Suggested Policy Setting | +
---|---|
Choose drive encryption method and cipher strength |
+Suggested Configuration: Not Configured +Configure this policy to use a specific encryption method and cipher strength. +When this policy is not configured, BitLocker uses the default encryption method of AES 128-bit with Diffuser or the encryption method specified by the setup script. |
+
Prevent memory overwrite on restart |
+Suggested Configuration: Not Configured +Configure this policy to improve restart performance without overwriting BitLocker secrets in memory on restart. +When this policy is not configured, BitLocker secrets are removed from memory when the computer restarts. |
+
Validate smart card certificate usage rule |
+Suggested Configuration: Not Configured +Configure this policy to use smartcard certificate-based BitLocker protection. +When this policy is not configured, a default object identifier 1.3.6.1.4.1.311.67.1.1 is used to specify a certificate. |
+
Provide the unique identifiers for your organization |
+Suggested Configuration: Not Configured +Configure this policy to use a certificate-based data recovery agent or the BitLocker To Go reader. +When this policy is not configured, the Identification field is not used. +If your company requires higher security measurements, you may want to configure the Identification field to make sure that all USB devices have this field set and that they are aligned with this Group Policy setting. |
+
Policy Name | +Overview and Suggested Policy Settings | +
---|---|
Configure MBAM Services |
+Suggested Configuration: Enabled +
|
+
Allow hardware compatibility checking |
+Suggested Configuration: Enabled +This policy setting lets you manage the verification of hardware compatibility before you enable BitLocker protection on drives of MBAM client computers. +You should enable this policy option if your enterprise has older computer hardware or computers that do not support Trusted Platform Module (TPM). If either of these criteria is true, enable the hardware compatibility verification to make sure that MBAM is applied only to computer models that support BitLocker. If all computers in your organization support BitLocker, you do not have to deploy the Hardware Compatibility, and you can set this policy to Not Configured. +If you enable this policy setting, the model of the computer is validated against the hardware compatibility list once every 24 hours, before the policy enables BitLocker protection on a computer drive. +
+Note
+
+Before enabling this policy setting, make sure that you have configured the MBAM Recovery and Hardware service endpoint setting in the Configure MBAM Services policy options. +
+
+
+If you either disable or do not configure this policy setting, the computer model is not validated against the hardware compatibility list. |
+
Configure user exemption policy |
+Suggested Configuration: Not Configured +This policy setting lets you configure a web site address, email address, or phone number that will instruct a user to request an exemption from BitLocker encryption. +If you enable this policy setting and provide a web site address, email address, or phone number, users will see a dialog with instructions on how to apply for an exemption from BitLocker protection. For more information about how to enable BitLocker encryption exemptions for users, see [How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md). +If you either disable or do not configure this policy setting, the instructions about how to apply for an exemption request will not be presented to users. +
+Note
+
+User exemption is managed per user, not per computer. If multiple users log on to the same computer and one user is not exempt, the computer will be encrypted. +
+
+ |
+
Policy Name | +Overview and Suggested Policy Setting | +
---|---|
Fixed data drive encryption settings |
+Suggested Configuration: Enabled, and select the Enable auto-unlock fixed data drive check box if the operating system volume is required to be encrypted. +This policy setting lets you manage whether or not to encrypt the fixed drives. +When you enable this policy, do not disable the Configure use of password for fixed data drives policy. +If the Enable auto-unlock fixed data drive check box is selected, the operating system volume must be encrypted. +If you enable this policy setting, users are required to put all fixed drives under BitLocker protection, which will encrypt the drives. +If you do not configure this policy or if you disable this policy, users are not required to put fixed drives under BitLocker protection. +If you disable this policy, the MBAM agent decrypts any encrypted fixed drives. +If encrypting the operating system volume is not required, clear the Enable auto-unlock fixed data drive check box. |
+
Deny “write” permission to fixed drives that are not protected by BitLocker |
+Suggested Configuration: Not Configured +This policy setting determines if BitLocker protection is required for fixed drives on a computer so that they are writable. This policy setting is applied when you turn on BitLocker. +When the policy is not configured, all fixed drives on the computer are mounted with read/write permissions. |
+
Allow access to BitLocker-protected fixed drives from earlier versions of Windows |
+Suggested configuration: Not Configured +Enable this policy to unlock and view the fixed drives that are formatted with the file allocation table (FAT) file system on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. +These operating systems have read-only permissions to BitLocker-protected drives. +When the policy is disabled, fixed drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. |
+
Configure use of password for fixed drives |
+Suggested configuration: Not Configured +Enable this policy to configure password protection on fixed drives. +When the policy is not configured, passwords will be supported with the default settings, which do not include password complexity requirements and require only eight characters. +For higher security, enable this policy and select Require password for fixed data drive, select Require password complexity, and set the desired minimum password length. |
+
Choose how BitLocker-protected fixed drives can be recovered |
+Suggested Configuration: Not Configured +Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS). +When this policy is not configured, the BitLocker data recovery agent is allowed, and recovery information is not backed up to AD DS. MBAM does not require the recovery information to be backed up to AD DS. |
+
Policy Name | +Overview and Suggested Policy Setting | +
---|---|
Operating system drive encryption settings |
+Suggested configuration: Enabled +This policy setting determines if the operating system drive will be encrypted. +Configure this policy to do the following: +
If you enable this policy setting, users are required to secure the operating system drive by using BitLocker. +If you do not configure or if you disable the setting, users are not required to secure the operating system drive by using BitLocker. +If you disable this policy, the MBAM agent decrypts the operating system volume if it is encrypted. +When it is enabled, this policy setting requires users to secure the operating system by using BitLocker protection, and the drive is encrypted. Based on your encryption requirements, you may select the method of protection for the operating system drive. +For higher security requirements, use TPM + PIN, allow enhanced PINs, and set the minimum PIN length to eight characters. +When this policy is enabled with the TPM + PIN protector, you can consider disabling the following policies under System / Power Management / Sleep Settings: +
|
+
Configure TPM platform validation profile |
+Suggested Configuration: Not Configured +This policy setting lets you configure how the TPM security hardware on a computer secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker already has TPM protection enabled. +When this policy is not configured, the TPM uses the default platform validation profile or the platform validation profile specified by the setup script. |
+
Choose how to recover BitLocker-protected operating system drives |
+Suggested Configuration: Not Configured +Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS). +When this policy is not configured, the data recovery agent is allowed, and the recovery information is not backed up to AD DS. +MBAM operation does not require the recovery information to be backed up to AD DS. |
+
Policy Name | +Overview and Suggested Policy Setting | +
---|---|
Control the use of BitLocker on removable drives |
+Suggested configuration: Enabled +This policy controls the use of BitLocker on removable data drives. +Enable the Allow users to apply BitLocker protection on removable data drives option, to allow users to run the BitLocker setup wizard on a removable data drive. +Enable the Allow users to suspend and decrypt BitLocker on removable data drives option to allow users to remove BitLocker drive encryption from the drive or to suspend the encryption while maintenance is performed. +When this policy is enabled and the Allow users to apply BitLocker protection on removable data drives option is selected, the MBAM Client saves the recovery information about removable drives to the MBAM key recovery server, and it allows users to recover the drive if the password is lost. |
+
Deny the “write” permissions to removable drives that are not protected by BitLocker |
+Suggested Configuration: Not Configured +Enable this policy to allow write-only permissions to BitLocker protected drives. +When this policy is enabled, all removable data drives on the computer require encryption before write permissions are allowed. |
+
Allow access to BitLocker-protected removable drives from earlier versions of Windows |
+Suggested Configuration: Not Configured +Enable this policy to unlock and view the fixed drives that are formatted with the (FAT) file system on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. +These operating systems have read-only permissions to BitLocker-protected drives. +When the policy is disabled, removable drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. |
+
Configure the use of password for removable data drives |
+Suggested configuration: Not Configured +Enable this policy to configure password protection on removable data drives. +When this policy is not configured, passwords are supported with the default settings, which do not include password complexity requirements and require only eight characters. +For increased security, you can enable this policy and select Require password for removable data drive, select Require password complexity, and then set the preferred minimum password length. |
+
Choose how BitLocker-protected removable drives can be recovered |
+Suggested Configuration: Not Configured +You can configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS). +When the policy is set to Not Configured, the data recovery agent is allowed and recovery information is not backed up to AD DS. +MBAM operation does not require the recovery information to be backed up to AD DS. |
+
Group Name | +Details | +
---|---|
MBAM Advanced Helpdesk Users |
+Create this group to manage members of the MBAM Advanced Helpdesk Users local group that was created during MBAM Setup. |
+
MBAM Compliance Auditing DB Access |
+Create this group to manage members of the MBAM Compliance Auditing DB Access local group that was created during MBAM Setup. |
+
MBAM Hardware Users |
+Create this group to manage members of the MBAM Hardware Users local group that was created during MBAM Setup. |
+
MBAM Helpdesk Users |
+Create this group to manage members of the MBAM Helpdesk Users local group that was created during MBAM Setup. |
+
MBAM Recovery and Hardware DB Access |
+Create this group to manage members of the MBAM Recovery and Hardware DB Access local group that was created during MBAM Setup. |
+
MBAM Report Users |
+Create this group to manage members of the MBAM Report Users local group that was created during MBAM Setup. |
+
MBAM System Administrators |
+Create this group to manage members of the MBAM System Administrators local group that was created during MBAM Setup. |
+
BitLocker Encryption Exemptions |
+Create this group to manage user accounts that should be exempted from BitLocker encryption starting on computers that they log on to. |
+
Group Name | +Details | +
---|---|
MBAM Advanced Helpdesk Users |
+Members of this group have expanded access to the Helpdesk features of Microsoft BitLocker Administration and Monitoring. |
+
MBAM Compliance Auditing DB Access |
+This group contains the machines that have access to the MBAM Compliance Auditing Database. |
+
MBAM Hardware Users |
+Members of this group have access to some of the Hardware Capability features from Microsoft BitLocker Administration and Monitoring. |
+
MBAM Helpdesk Users |
+Members of this group have access to some of the Helpdesk features from Microsoft BitLocker Administration and Monitoring. |
+
MBAM Recovery and Hardware DB Access |
+This group contains the computers that have access to the MBAM Recovery and Hardware Database. |
+
MBAM Report Users |
+Members of this group have access to the Compliance and Audit reports from Microsoft BitLocker Administration and Monitoring. |
+
MBAM System Administrators |
+Members of this group have access to all the features of Microsoft BitLocker Administration and Monitoring. |
+
Column Name | +Description | +
---|---|
Computer Name |
+The user-specified DNS name that is being managed by MBAM. |
+
Domain Name |
+The fully qualified domain name where the client computer resides and is managed by MBAM. |
+
Compliance Status |
+The state of compliance for the computer, according to the policy specified for the computer. The possible states are Noncompliant and Compliant. For more information, see Enterprise Compliance Report Compliance States in this topic. |
+
Exemption |
+The state of the computer hardware for determining the identification of the hardware type and whether the computer is exempt from policy. There are three possible states: Hardware Unknown (the hardware type has not been identified by MBAM), Hardware Exempt (the hardware type was identified and was marked as exempt from MBAM policy), and Not Exempt (the hardware was identified and is not exempt from policy). |
+
Device Users |
+Known users on the computer that is being managed by MBAM. |
+
Compliance Status Details |
+Error and status messages about the compliance state of the computer in accordance to the specified policy. |
+
Last Contact |
+Date and time when the computer last contacted the server to report compliance status. This time is configurable. See MBAM policy settings. |
+
Compliance Status | +Exemption | +Description | +User Action | +
---|---|---|---|
Noncompliant |
+Not Exempt |
+The computer is noncompliant according to the specified policy, and the hardware type has not been indicated as exempt from policy. |
+Click Computer Name to expand the Computer Compliance Report and determine whether the state of each drive complies with the specified policy. If the encryption state indicates that the computer is not encrypted, encryption might still be in process, or there might be an error on the computer. If there is no error, the likely cause is that the computer is still in the process of connecting or establishing the encryption status. Check back later to determine if the state changes. |
+
Compliant |
+Not Exempt |
+The computer is compliant in accordance with the specified policy. |
+No Action needed. Optionally, you can view the Computer Compliance Report to confirm the state of the computer. |
+
Compliant |
+Hardware Exempt |
+If the Hardware type is exempt. Regardless of how the policy is set or the individual status of each hard-drive, the overall state is considered to be compliant. |
+No action needed. |
+
Compliant |
+Hardware Unknown |
+MBAM recognizes the hardware type, but MBAM does not know whether it is exempt or not exempt. This occurs if the administrator has not set the Compatible status for the hardware. Therefore, MBAM reverts to Compliant status by default. |
+This is the initial state of a newly deployed MBAM client. It is typically only a transient state. Even if the administrator has marked the Hardware as Compatible, there can be a significant delay or configurable wait time before the client computer reports back in. Make note of the time of Last Contact, and check in again after the specified interval to see if the state has changed. If the state has not changed, there may be an error for this computer or hardware type. |
+
Column Name | +Description | +
---|---|
Computer Name |
+The user-specified DNS computer name that is being managed by MBAM. |
+
Domain Name |
+The fully qualified domain name where the client computer resides and is managed by MBAM. |
+
Computer Type |
+The portability type of computer. Valid types are non-Portable and Portable. |
+
Operating System |
+Operating System type installed on the MBAM managed client computer. |
+
Compliance Status |
+The overall Compliance Status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. While it is possible to have Compliant and Noncompliant drives in the same computer, this field indicates the overall computer compliance per specified policy. |
+
Policy Cypher Strength |
+The Cipher Strength selected by the Administrator during MBAM policy specification. For example, 128-bit with Diffuser |
+
Policy Operating System Drive |
+Indicates whether encryption is required for the O/S and the protector type as applicable. |
+
Policy Fixed Data Drive |
+Indicates whether encryption is required for the Fixed Drive. |
+
Policy Removable Data Drive |
+Indicates whether encryption is required for the Removable Drive. |
+
Device Users |
+Provides the identity of known users on the computer. |
+
Exemption |
+Indicates whether the computer hardware type is recognized by MBAM and, if known, whether the computer has been indicated as exempt from policy. There are three states: Hardware Unknown (the hardware type has not been identified by MBAM); Hardware Exempt (the hardware type was identified and was marked as exempt from MBAM policy); and Not Exempt (the hardware was identified and is not exempt from policy). |
+
Manufacturer |
+The computer manufacturer name as it appears in the computer BIOS. |
+
Model |
+The computer manufacturer model name as it appears in the computer BIOS. |
+
Compliance Status Details |
+Error and status messages of the compliance state of the computer in accordance with the specified policy. |
+
Last Contact |
+Date and time that the computer last contacted the server to report compliance status. T |
+
Column Name | +Description | +
---|---|
Drive Letter |
+Computer drive letter that was assigned to this particular drive by the user. |
+
Drive Type |
+Type of drive. Valid values are Operating System Drive and Fixed Data Drive. These are physical drives rather than logical volumes. |
+
Cypher Strength |
+Cipher Strength selected by the Administrator during MBAM policy specification. |
+
Protector Type |
+Type of protector selected via policy used to encrypt an operating system or Fixed volume. The valid protector types on an operating system drive are TPM or TPM+PIN. The only valid protector type for a Fixed Data Volume is Password. |
+
Protector State |
+This field indicates whether the computer has enabled the protector type specified in the policy. The valid states are ON or OFF. |
+
Encryption State |
+This is the current encryption state of the drive. Valid states are Encrypted, Not Encrypted, and Encrypting. |
+
Compliance Status |
+Indicates whether the drive is in accordance with the policy. States are Noncompliant and Compliant. |
+
Compliance Status Details |
+Contains error and status messages regarding the compliance state of the computer. |
+
Column Name | +Description | +
---|---|
Date and Time |
+Date and time that a change was made to the Hardware Type. Note that every unique hardware type is assigned to at least one entry. |
+
User |
+Administrative user that has made the change for the particular entry. |
+
Change Type |
+Type of change that was made to the hardware type information. Valid values are Addition (new entry), Update (change existing entry), or Deletion (remove existing entry). |
+
Original Value |
+Value of the hardware type specification before the change was made. |
+
Current Value |
+Value of the hardware type specification after the change was made. |
+
Column Name | +Description | +
---|---|
Request Date and Time |
+The date and time that a key retrieval request was made by an end user or help desk user. |
+
Request Status |
+Status of the request. Valid statuses are either Successful (the key was retrieved) or Failed (the key was not retrieved). |
+
Helpdesk User |
+The help desk user who initiated the request for key retrieval. If the help desk user retrieves the key on behalf of an end user, the End User field will be blank. |
+
User |
+The end user who initiated the request for key retrieval. |
+
Key Type |
+The type of key that was requested. MBAM collects three key types: Recovery Key Password (to recovery a computer in recovery mode); Recovery Key ID (to recover a computer in recovery mode on behalf of another user); and Trusted Platform Module (TPM) Password Hash (to recover a computer with a locked TPM). |
+
Reason Description |
+The reason that the specified Key Type was requested. The reasons are specified in the Drive Recovery and Manage TPM features of the Administrative web site. Valid entries include user-entered text or one of the following reason codes: +
|
+
Command-Line Parameter | +Description | +Example | +
---|---|---|
CM_SSRS_REMOTE_SERVER_NAME |
+Enables you to install the Configuration Manager reports on a remote SQL Server Reporting Services (SSRS) server that is part of the same Configuration Manager site to which MBAM is installed. You can set the value to the fully qualified domain name of the remote SSRS point role server. |
+MbamSetup.exe CM_SSRS_REMOTE_SERVER_NAME=ssrsServer.Contoso.com |
+
CM_REPORTS_ONLY |
+Enables you to install only the Configuration Manager reports, without other Configuration Manager objects, such as the baseline, collection, and configuration items. +
+Note
+
+You must combine this parameter with the CM_REPORTS_COLLECTION_ID parameter. +
+
+
+Valid parameter values: +
You can combine this parameter with the CM_SSRS_REMOTE_SERVER_NAME parameter if you want to install the reports only to a remote SSRS point role server. +If you do not set the parameter or if you set it to False, MBAM Setup installs all of the Configuration Manager objects, including the reports. |
+MbamSetup.exe CM_REPORTS_ONLY=True +CM_REPORTS_COLLECTION_ID=SMS00001 |
+
CM_REPORTS_COLLECTION_ID |
+An existing collection ID that identifies the collection for which reporting compliance data will be displayed. You can specify any collection ID. You are not required to use the “MBAM Supported Computers” collection ID. |
+MbamSetup.exe CM_REPORTS_ONLY=True +CM_REPORTS_COLLECTION_ID=SMS00001 |
+
Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.) +20 Roszel Road +Princeton, NJ 08540 |
++ |
Telephone number from within the United States: |
+(800) 221-4792 |
+
Telephone number from outside the United States and Canada: |
+(609) 452-0606 |
+
Fax: |
+(609) 987-8116 |
+
[http://www.learningally.org/](http://go.microsoft.com/fwlink/?linkid=239) |
+Web addresses can change, so you might be unable to connect to the website or sites mentioned here. |
+
Name | +Description | +
---|---|
Install-Mbam |
+Installs the MBAM features that provide advanced policy, encryption, key recovery, and compliance reporting. |
+
Uninstall-Mbam |
+Removes the MBAM features that provide advanced policy, encryption, key recovery, and compliance reporting tools. |
+
Get-MbamBitLockerRecoveryKey |
+Requests an MBAM recovery key that will enable users to unlock a computer or encrypted drive. |
+
Get-MbamTPMOwnerPassword |
+Provides users with a TPM owner password that they can use to unlock a Trusted Platform Module (TPM) when the TPM has locked them out and will no longer accept their PIN. |
+
+ | Task | +References | +Notes | +
---|---|---|---|
![]() |
+Review the Getting Started information about MBAM to gain a basic understanding of the product before beginning deployment planning. |
+[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) |
++ |
![]() |
+Plan for MBAM 2.0 Deployment Prerequisites and prepare your computing environment. |
+[MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) |
++ |
![]() |
+Plan for and configure MBAM Group Policy requirements. |
+[Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md) |
++ |
![]() |
+Plan for and create necessary Active Directory Domain Services security groups, and plan for MBAM local security group membership requirements. |
+[Planning for MBAM 2.0 Administrator Roles](planning-for-mbam-20-administrator-roles-mbam-2.md) |
++ |
![]() |
+Plan for deploying MBAM Server feature deployment. |
+[Planning for MBAM 2.0 Server Deployment](planning-for-mbam-20-server-deployment-mbam-2.md) |
++ |
![]() |
+Plan for deploying MBAM Client deployment. |
+[Planning for MBAM 2.0 Client Deployment](planning-for-mbam-20-client-deployment-mbam-2.md) |
++ |
![]() |
+Review the MBAM supported configurations information to make sure that selected client and server computers are supported for MBAM feature installation. |
+[MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) |
++ |
![]() |
+Run MBAM Setup to deploy MBAM Server features on a single server for evaluation purposes. |
+[How to Install and Configure MBAM on a Single Server](how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md) |
++ |
![]() |
+Add Active Directory Domain Services security groups, that you created during the planning phase, to the appropriate local MBAM Server feature local groups on the new MBAM Server. |
+[Planning for MBAM 2.0 Administrator Roles](planning-for-mbam-20-administrator-roles-mbam-2.md) and [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-2.md) |
++ |
![]() |
+Create and deploy required MBAM Group Policy Objects. |
+[Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md) |
++ |
![]() |
+Deploy the MBAM Client software. |
+[Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) |
++ |
Name | +Default Value | +
---|---|
CompanyName* |
+ Contoso IT |
+
HelpdeskText* |
+ Contact Help Desk or IT Department |
+
HelpdeskUrl* |
+ Http://www.microsoft.com |
+
jQueryPath |
+ //ajax.aspnetcdn.com/ajax/jQuery/jquery-1.7.2.min.js |
+
MicrosoftAjaxPath |
+ //ajax.aspnetcdn.com/ajax/3.5/MicrosoftAjax.js |
+
MicrosoftMvcAjaxPath |
+ //ajax.aspnetcdn.com/ajax/mvc/2.0/MicrosoftMvcValidation.js |
+
NoticeTextPath |
+ Notice.txt +
+ Note
+
+ You can edit the Notice text either by using the IIS Manager or by opening and changing the Notice.txt file in the installation directory. +
+
+ |
+
Policy Group | +Policy | +Setting | +
---|---|---|
Client Management |
+ Configure MBAM Services |
+ Enabled. Set MBAM Recovery and Hardware service endpoint and Select BitLocker recovery information to store. Set MBAM compliance service endpoint and Enter status report frequency in (minutes). |
+
Operating System Drive |
+ Operating system drive encryption settings |
+ Enabled. Set Select protector for operating system drive. Required to save operating system drive data to the MBAMKey Recovery server. |
+
Removable Drive |
+ Control Use of BitLocker on removable drives |
+ Enabled. Required if MBAM will save removable drive data to the MBAM Key Recovery server. |
+
Fixed Drive |
+ Control Use of BitLocker on fixed drives |
+ Enabled. Required if MBAM will save fixed drive data to the MBAM Key Recovery server. +Set Choose how BitLocker-protected drives can be recovered and Allow data recovery agent. |
+
User Status | +Computer Not Exempt | +Computer Exempt | +
---|---|---|
User not exempt |
+BitLocker protection is enforced on computer |
+BitLocker protection is not enforced on computer |
+
User exempt |
+BitLocker protection is not enforced on computer |
+BitLocker protection is not enforced on computer |
+
Parameter | +Parameter Value | +Description | +
---|---|---|
TOPOLOGY |
+0 |
+0 – Stand-alone topology |
+
I_ACCEPT_ENDUSER_LICENSE_AGREEMENT |
+01 |
+0 – do not accept the license agreement1 – accept the license agreement |
+
ADDLOCAL |
++ | Features to be installed on the Server |
+
+ | KeyDatabase |
+Recovery Database |
+
+ | ReportsDatabase |
+Compliance and Audit Reports Database |
+
+ | Reports |
+Compliance and Audit Reports |
+
+ | AdministrationMonitoringServer |
+Administration and Monitoring website |
+
+ | SelfServiceServer |
+Self-Service Portal |
+
+ | PolicyTemplate |
+MBAM Group Policy template |
+
REPORTS_USERACCOUNT |
+[UserDomain]\[UserName1] |
+Domain and user account of the Reporting Services service account that will access the Compliance and Audit database |
+
REPORTS_USERACCOUNTPW |
+[UserPwd1] |
+Password of the Reporting Services service account that will access the Compliance and Audit database |
+
COMPLIDB_SQLINSTANCE |
+%computername% |
+SQL Server instance name for the Compliance and Audit Database – replace %computername% with the computer name |
+
RECOVERYANDHWDB_SQLINSTANCE |
+%computername% |
+SQL Server instance name for the Recovery Database – replace %computername% with the computer name |
+
SRS_INSTANCENAME |
+%computername% |
+SQL Server Reporting Server instance where the Compliance and Audit reports will be installed – replace %computername% with the computer name |
+
ADMINANDMON_WEBSITE_PORT |
+83 |
+Port for the Administration and Monitoring website; “83” is only an example |
+
WEBSITE_PORT |
+83 |
+Port for the Self-Service Portal website; “83” is only an example |
+
Parameter | +Parameter Value | +Description | +
---|---|---|
TOPOLOGY |
+1 |
+1 – Configuration Manager topology |
+
I_ACCEPT_ENDUSER_LICENSE_AGREEMENT |
+01 |
+0 – do not accept the license agreement1 – accept the license agreement |
+
COMPLIDB_SQLINSTANCE |
+%computername% |
+SQL Server instance name for the Audit Database – replace %computername% with the computer name |
+
RECOVERYANDHWDB_SQLINSTANCE |
+%computername% |
+SQL Server instance name for the Recovery Database - replace %computername% with the computer name |
+
SRS_INSTANCENAME |
+%computername% |
+SQL Server Reporting Server instance where the Audit reports will be installed – replace %computername% with the computer name |
+
REPORTS_USERACCOUNT |
+[UserDomain]\[UserName1] |
+Domain and user account of the Reporting Services service account that will access the Compliance and Audit database |
+
REPORTS_USERACCOUNTPW |
+[UserPwd1] |
+Password of the Reporting Services service account that will access the Compliance and Audit database |
+
ADMINANDMON_WEBSITE_PORT |
+83 |
+Port for the Administration and Monitoring website; “83” is only an example |
+
WEBSITE_PORT |
+83 |
+Port for the Self-Service Portal website; “83” is only an example |
+
+ | Task | +References | +Notes | +
---|---|---|---|
![]() |
+Complete the planning phase to prepare the computing environment for MBAM deployment. |
+[MBAM 2.0 Planning Checklist](mbam-20-planning-checklist-mbam-2.md) |
++ |
![]() |
+Review the MBAM supported configurations information to make sure selected client and server computers are supported for MBAM feature installation. |
+[MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) |
++ |
![]() |
+Run MBAM Setup to deploy MBAM Server features in the following order: +
+Note
+
+Keep track of the names of the servers each feature is installed on. This information will be used throughout the installation process. +
+
+ |
+[Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) |
++ |
![]() |
+Add Active Directory Domain Services security groups created during the planning phase to the appropriate local MBAM Server feature administrators groups on appropriate servers. |
+[Planning for MBAM 2.0 Administrator Roles](planning-for-mbam-20-administrator-roles-mbam-2.md) and [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-2.md) |
++ |
![]() |
+Create and deploy required MBAM Group Policy Objects. |
+[Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md) |
++ |
![]() |
+Deploy the MBAM Client software. |
+[Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) |
++ |
Prerequisite | +Details | +
---|---|
Windows Server Web Server Role |
+This role must be added to a server operating system that is supported for the Administration and Monitoring Server feature. |
+
Web Server (IIS) Management Tools |
+Select IIS Management Scripts and Tools. |
+
SSL Certificate |
+Optional. To secure communication between the clients and the web services, you have to obtain and install a certificate that a trusted security authority signed. |
+
Web Server Role Services |
+Common HTTP Features: +
Application Development: +
Security: +
|
+
Windows Server Features |
+.NET Framework 3.5.1 features: +
Windows Process Activation Service: +
|
+
Prerequisite | +Details | +
---|---|
Supported version of SQL Server +See [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) for supported versions. |
+Install SQL Server with: +
|
+
SQL Server Reporting Services (SSRS) |
++ |
SSRS instance rights – required for installing reports only if you are installing databases on a separate server from the reports. |
+Required instance rights: +
SSRS must be installed and running during the MBAM Server installation. Configure SSRS in “native” mode and not in unconfigured or “SharePoint” mode. |
+
Prerequisite | +Details | +
---|---|
Supported version of SQL Server +See [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) for supported versions. |
+Install SQL Server with: +
|
+
Required SQL Server permissions |
+Required permissions: +
|
+
Optional - Install Transparent Data Encryption (TDE) feature available in SQL Server |
+The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with many laws, regulations, and guidelines established in various industries. +
+Note
+
+TDE performs real-time decryption of database information, which means that, if the account under which you are logged on has permissions to the database while you are viewing the recovery key information in the SQL Server tables, the recovery key information is visible. +
+
+
+More about TDE: [MBAM 2.0 Security Considerations](mbam-20-security-considerations-mbam-2.md). |
+
Prerequisite | +Details | +
---|---|
Supported version of SQL Server +See [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) for supported versions. |
+Install SQL Server with: +
|
+
Required SQL Server permissions |
+Required permissions: +
|
+
Optional - Install Transparent Data Encryption (TDE) feature in SQL Server. |
+The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with many laws, regulations, and guidelines established in various industries. +
+Note
+
+TDE performs real-time decryption of database information, which means that, if the account under which you are logged on has permissions to the database while you are viewing the recovery key information in the SQL Server tables, the recovery key information is visible. +
+
+
+More about TDE: [MBAM 2.0 Security Considerations](mbam-20-security-considerations-mbam-2.md) |
+
SQL Server must have Database Engine Services installed and running during MBAM Server installation. |
++ |
The SQL Server Agent service must be running and set to auto-start on the selected instances of SQL Server. |
++ |
Prerequisite | +Details | +
---|---|
Supported version of Windows Server +See [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) for supported versions. |
++ |
ASP.NET MVC 2.0 |
+[ASP.NET MVC 2 download](http://go.microsoft.com/fwlink/?LinkId=392270) |
+
Web Service IIS Management Tools |
++ |
Prerequisite | +Details | +
---|---|
Windows 7 clients only - must have Trusted Platform Module (TPM) capability. |
+TPM version must be 1.2 or later. |
+
The TPM chip must be turned on in the BIOS and be resettable from the operating system. |
+For more information, see the BIOS documentation. |
+
Windows 8 clients only: To have MBAM store and manage the TPM recovery keys: TPM auto-provisioning must be turned off, and MBAM must be set as the owner of the TPM before you deploy MBAM. To turn off TPM auto-provisioning, see [Disable-TpmAutoProvisioning](http://go.microsoft.com/fwlink/?LinkId=286468). +
|
+To turn off TPM auto-provisioning, see [Disable-TpmAutoProvisioning](http://go.microsoft.com/fwlink/?LinkId=286468). +
+Note
+
+Ensure that the keyboard, video, or mouse are directly connected and not managed through a keyboard, video, or mouse (KVM) switch. A KVM switch can interfere with the ability of the computer to detect the physical presence of hardware. +
+
+ |
+
+ | Task | +References | +Notes | +
---|---|---|---|
![]() |
+Review the getting started information about MBAM to gain a basic understanding of the product before beginning deployment planning. |
+[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) |
++ |
![]() |
+Plan for MBAM 2.0 Deployment Prerequisites and prepare your computing environment. |
+[MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) |
++ |
![]() |
+Plan for and configure MBAM Group Policy requirements. |
+[Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md) |
++ |
![]() |
+Plan for and create necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements. |
+[Planning for MBAM 2.0 Administrator Roles](planning-for-mbam-20-administrator-roles-mbam-2.md) |
++ |
![]() |
+Review the MBAM 2.0 Supported Configurations documentation to ensure that hardware that meets MBAM installation system requirements is available. |
+[MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) |
++ |
![]() |
+Plan for deploying MBAM Server feature deployment. |
+[Planning for MBAM 2.0 Server Deployment](planning-for-mbam-20-server-deployment-mbam-2.md) |
++ |
![]() |
+Plan for deploying MBAM Client deployment. |
+[Planning for MBAM 2.0 Client Deployment](planning-for-mbam-20-client-deployment-mbam-2.md) |
++ |
![]() |
+Validate your deployment plan in a test environment. |
+[Evaluating MBAM 2.0](evaluating-mbam-20-mbam-2.md) |
++ |
Group Name | +Details | +
---|---|
MBAM Advanced Helpdesk Users |
+Create this group to manage members of the MBAM Advanced Helpdesk Users local group created during MBAM Setup. |
+
MBAM Compliance Auditing DB Access |
+Create this group to manage members of the MBAM Compliance Auditing DB Access local group created during MBAM Setup. |
+
MBAM Helpdesk Users |
+Create this group to manage members of the MBAM Helpdesk Users local group created during MBAM Setup. |
+
MBAM Recovery and Hardware DB Access |
+Create this group to manage members of the MBAM Recovery and Hardware DB Access local group created during MBAM Setup. |
+
MBAM Report Users |
+Create this group to manage members of the MBAM Report Users local group created during MBAM Setup. |
+
MBAM System Administrators |
+Create this group to manage members of the MBAM System Administrators local group created during MBAM Setup. |
+
BitLocker Encryption Exemptions |
+Create this group to manage user accounts that should be exempted from BitLocker encryption starting on computers that they log on to. |
+
Group Name | +Details | +
---|---|
MBAM Advanced Helpdesk Users |
+Members of this group have increased access to the Help Desk features from MBAM. |
+
MBAM Compliance Auditing DB Access |
+Contains the machines that have access to the MBAM Compliance and Auditing Database. |
+
MBAM Helpdesk Users |
+Members of this group have access to some of the Help Desk features from MBAM. |
+
MBAM Recovery and Hardware DB Access |
+Contains the machines that have access to the MBAM Recovery Database. |
+
MBAM Report Users |
+Members of this group have access to the Compliance and Audit reports from MBAM. |
+
MBAM System Administrators |
+Members of this group have access to all MBAM features. |
+
Operating system | +Edition | +Service pack | +System architecture | +
---|---|---|---|
Windows Server 2008 R2 |
+Standard, Enterprise, or Datacenter Edition |
+SP1 |
+64-bit |
+
Windows Server 2012 |
+Standard or Datacenter Edition |
++ | 64-bit |
+
Hardware component | +Minimum requirement | +Recommended requirement | +
---|---|---|
Processor |
+2.33 GHz |
+2.33 GHz or greater |
+
RAM |
+8 GB |
+12 GB |
+
Free disk space |
+1 GB |
+2 GB |
+
SQL Server version | +Edition | +Service pack | +System architecture | +
---|---|---|---|
Microsoft SQL Server 2008 R2 |
+Standard, Enterprise, or Datacenter Edition |
+SP1 |
+64-bit |
+
Microsoft SQL Server 2012 |
+Standard, Enterprise, or Datacenter Edition |
+SP1 |
+64-bit |
+
Hardware component | +Minimum requirement | +Recommended requirement | +
---|---|---|
Processor |
+2.33 GHz |
+2.33 GHz or greater |
+
RAM |
+8 GB |
+12 GB |
+
Free disk space |
+5 GB |
+5 GB or greater |
+
Operating system | +Edition | +Service pack | +System architecture | +
---|---|---|---|
Windows 7 |
+Enterprise or Ultimate Edition |
+SP1 |
+32-bit or 64-bit |
+
Windows 8 |
+Enterprise Edition |
++ | 32-bit or 64-bit |
+
Windows To Go |
+Windows 8 Enterprise Edition |
++ | 32-bit or 64-bit |
+
Operating system | +Edition | +Service pack | +System architecture | +
---|---|---|---|
Windows 7 |
+Enterprise, or Ultimate Edition |
+SP1 |
+32-bit or 64-bit |
+
Windows 8 |
+Enterprise Edition |
++ | 32-bit or 64-bit |
+
Windows Server 2008 R2 |
+Standard, Enterprise, or Datacenter Edition |
+SP1 |
+64-bit |
+
Windows Server 2012 |
+Standard or Datacenter Edition |
++ | 64-bit |
+
Policy Name | +Overview and Suggested Policy Setting | +
---|---|
Choose drive encryption method and cipher strength |
+Suggested Configuration: Not Configured +Configure this policy to use a specific encryption method and cipher strength. +When this policy is not configured, BitLocker uses the default encryption method of AES 128-bit with Diffuser or the encryption method specified by the setup script. |
+
Prevent memory overwrite on restart |
+Suggested Configuration: Not Configured +Configure this policy to improve restart performance without overwriting BitLocker secrets in memory on restart. +When this policy is not configured, BitLocker secrets are removed from memory when the computer restarts. |
+
Validate smart card certificate usage rule |
+Suggested Configuration: Not Configured +Configure this policy to use smartcard certificate-based BitLocker protection. +When this policy is not configured, a default object identifier 1.3.6.1.4.1.311.67.1.1 is used to specify a certificate. |
+
Provide the unique identifiers for your organization |
+Suggested Configuration: Not Configured +Configure this policy to use a certificate-based data recovery agent or the BitLocker To Go reader. +When this policy is not configured, the Identification field is not used. +If your company requires higher security measurements, you may want to configure the Identification field to make sure that all USB devices have this field set and that they are aligned with this Group Policy setting. |
+
Policy Name | +Overview and Suggested Policy Settings | +
---|---|
Configure MBAM Services |
+Suggested Configuration: Enabled +
|
+
Configure user exemption policy |
+Suggested Configuration: Not Configured +This policy setting lets you configure a web site address, email address, or phone number that will instruct a user to request an exemption from BitLocker encryption. +If you enable this policy setting and provide a web site address, email address, or phone number, users will see a dialog that gives them instructions on how to apply for an exemption from BitLocker protection. For more information about enabling BitLocker encryption exemptions for users, see [How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md). +If you either disable or do not configure this policy setting, the exemption request instructions will not be presented to users. +
+Note
+
+User exemption is managed per user, not per computer. If multiple users log on to the same computer and any one user is not exempt, the computer will be encrypted. +
+
+ |
+
Configure customer experience improvement program |
+This policy setting lets you configure how MBAM users can join the Customer Experience Improvement Program. This program collects information about computer hardware and how users use MBAM without interrupting their work. The information helps Microsoft to identify which MBAM features to improve. Microsoft will not use this information to identify or contact MBAM users. +If you enable this policy setting, users will be able to join the Customer Experience Improvement Program. +If you disable this policy setting, users will not be able to join the Customer Experience Improvement Program. +If you do not configure this policy setting, users will have the option to join the Customer Experience Improvement Program. |
+
Policy Name | +Overview and Suggested Policy Setting | +
---|---|
Fixed data drive encryption settings |
+Suggested Configuration: Enabled +This policy setting let you manage whether fixed drives must be encrypted. +If the operating system volume is required to be encrypted, select the Enable auto-unlock fixed data drive option. +When enabling this policy, you must not disable the Configure use of password for fixed data drives policy unless the use of Auto-Unlock for fixed data drives is allowed or required. +If you require the use of Auto-Unlock for fixed data drives, you must configure operating system volumes to be encrypted. +If you enable this policy setting, users are required to put all fixed drives under BitLocker protection, and the drives will be encrypted. +If you do not configure this policy setting, users are not required to put fixed drives under BitLocker protection. If you apply this policy after fixed data drives are encrypted, the MBAM agent decrypts the encrypted fixed drives. +If you disable this policy setting, users will not be able to put their fixed data drives under BitLocker protection. |
+
Deny write access to fixed drives not protected by BitLocker |
+Suggested Configuration: Not Configured +This policy setting determines whether BitLocker protection is required for fixed drives to be writable on a computer. This policy setting is applied when you turn on BitLocker. +When the policy is not configured, all fixed data drives on the computer are mounted with read and write access. |
+
Allow access to BitLocker-protected fixed drives from earlier versions of Windows |
+Suggested configuration: Not Configured +Enable this policy to let fixed drives with the FAT file system be unlocked and viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. +When the policy is enabled or not configured, fixed drives formatted with the FAT file system can be unlocked and their content can be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. These operating systems have read-only access to BitLocker-protected drives. +When the policy is disabled, fixed drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. |
+
Configure use of password for fixed drives |
+Suggested configuration: Not Configured +Use this policy to specify whether a password is required to unlock BitLocker-protected fixed data drives. +If you enable this policy setting, users can configure a password that meets the requirements you define. BitLocker will allow users to unlock a drive with any of the protectors that are available on the drive. +These settings are enforced when turning on BitLocker, not when unlocking a volume. +If you disable this policy setting, users are not allowed to use a password. +When the policy is not configured, passwords are supported with the default settings, which do not include password complexity requirements and which require only eight characters. +For higher security, enable this policy and select Require password for fixed data drive, select Require password complexity, and set the desired minimum password length. +If you disable this policy setting, users are not allowed to use a password. +If you do not configure this policy setting, passwords will be supported with the default settings, which do not include password complexity requirements and which require only eight characters. |
+
Choose how BitLocker-protected fixed drives can be recovered |
+Suggested Configuration: Not Configured +Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS). +When the policy is not configured, the BitLocker data recovery agent is allowed, and recovery information is not backed up to AD DS. MBAM does not require recovery information to be backed up to AD DS. |
+
Policy Name | +Overview and Suggested Policy Setting | +
---|---|
Operating system drive encryption settings |
+Suggested configuration: Enabled +This policy setting lets you manage whether the operating system drive must be encrypted. +For higher security, consider disabling the following policy settings in System/Power Management/Sleep Settings when you enable them with TPM + PIN protector: +
If you are running Microsoft Windows 8 or later, and you want to use BitLocker on a computer without a TPM, select the Allow BitLocker without a compatible TPM check box. In this mode, a password is required for startup. If you forget the password, you have to use one of the BitLocker recovery options to access the drive. +On a computer with a compatible TPM, two types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require the entry of a personal identification number (PIN). +If you enable this policy setting, users have to put the operating system drive under BitLocker protection, and the drive will be encrypted. +If you disable this policy, users will not be able to put the operating system drive under BitLocker protection. If you apply this policy after the operating system drive is encrypted, the drive will be decrypted. +If you do not configure this policy, the operating system drive is not required to be placed under BitLocker protection. |
+
Configure TPM platform validation profile |
+Suggested Configuration: Not Configured +This policy setting lets you configure how the TPM security hardware on a computer secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection. +When this policy setting is not configured, the TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script. |
+
Choose how BitLocker-protected operating system drives can be recovered |
+Suggested Configuration: Not Configured +Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS). +When this policy is not configured, the data recovery agent is allowed, and recovery information is not backed up to AD DS. +MBAM operation does not require recovery information to be backed up to AD DS. |
+
Policy Name | +Overview and Suggested Policy Setting | +
---|---|
Control use of BitLocker on removable drives |
+Suggested configuration: Enabled +This policy controls the use of BitLocker on removable data drives. +Enable the Allow users to apply BitLocker protection on removable data drives option to allow users to run the BitLocker setup wizard on a removable data drive. +Enable the Allow users to suspend and decrypt BitLocker on removable data drives option to allow users to remove BitLocker drive encryption from the drive or to suspend the encryption while maintenance is performed. +When this policy is enabled and the Allow users to apply BitLocker protection on removable data drives option is selected, the MBAM Client saves the recovery information about removable drives to the MBAM key recovery server and allows users to recover the drive if the password is lost. |
+
Deny write access to removable drives not protected by BitLocker |
+Suggested Configuration: Not Configured +Enable this policy to allow only write access to BitLocker protected drives. +When this policy is enabled, all removable data drives on the computer require encryption before write access is allowed. |
+
Allow access to BitLocker-protected removable drives from earlier versions of Windows |
+Suggested Configuration: Not Configured +Enable this policy to allow fixed drives with the FAT file system to be unlocked and viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. +When this policy is not configured, removable data drives formatted with the FAT file system can be unlocked on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have read-only access to BitLocker-protected drives. +When the policy is disabled, removable drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. |
+
Configure use of password for removable data drives |
+Suggested configuration: Not Configured +Enable this policy to configure password protection on removable data drives. +When this policy is not configured, passwords are supported with the default settings, which do not include password complexity requirements and which require only eight characters. +For increased security, you may enable this policy and check Require password for removable data drive, select Require password complexity, and set the preferred minimum password length. |
+
Choose how BitLocker-protected removable drives can be recovered |
+Suggested Configuration: Not Configured +Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS). +When set to Not Configured, the data recovery agent is allowed and recovery information is not backed up to AD DS. +MBAM operation does not require recovery information to be backed up to AD DS. |
+
Prerequisite | +Additional Information | +
---|---|
Ensure that the Configuration Manager Server is a primary site in the Configuration Manager system. |
+N/A |
+
Enable the Hardware Inventory Client Agent on the Configuration Manager Server. |
+For Configuration Manager 2007, see [How to Configure Hardware Inventory for a Site](http://go.microsoft.com/fwlink/?LinkId=301656). +For System Center 2012 Configuration Manager, see [How to Configure Hardware Inventory in Configuration Manager](http://go.microsoft.com/fwlink/?LinkId=301685). |
+
Enable the Desired Configuration Management (DCM) agent or the compliance settings, depending on the version of Configuration Manager that you are using. |
+For Configuration Manager 2007, enable the see [Desired Configuration Management Client Agent Properties](http://go.microsoft.com/fwlink/?LinkId=301686). +For System Center 2012 Configuration Manager, see [Configuring Compliance Settings in Configuration Manager](http://go.microsoft.com/fwlink/?LinkId=301687). |
+
Define a reporting services point in Configuration Manager. Required for SQL Reporting Services. |
+For Configuration Manager 2007, see [How to Create a Reporting Services Point for SQL Reporting Services](http://go.microsoft.com/fwlink/?LinkId=301688). +For System Center 2012 Configuration Manager, see [Prerequisites for Reporting in Configuration Manager](http://go.microsoft.com/fwlink/?LinkId=301689). |
+
Supported version | +Service pack | +System architecture | +
---|---|---|
Microsoft System Center Configuration Manager 2007 R2 |
+SP1 or later |
+64-bit +
+Note
+
+Although Configuration Manager 2007 is 32 bit, you must install it and SQL Server on a 64-bit operating system in order to match the 64-bit MBAM software. +
+
+ |
+
Microsoft System Center 2012 Configuration Manager |
+SP1 |
+64-bit |
+
Hardware Component | +Minimum Requirement | +Recommended Requirement | +
---|---|---|
Processor |
+2.33 GHz |
+2.33 GHz or greater |
+
RAM |
+4 GB |
+8 GB |
+
Free disk space |
+1 GB |
+2 GB |
+
Hardware Component | +Minimum Requirement | +Recommended Requirement | +
---|---|---|
Processor |
+2.33 GHz |
+2.33 GHz or greater |
+
RAM |
+4 GB |
+8 GB |
+
Free disk space |
+5 GB |
+5 GB or greater |
+
Permissions | +MBAM Server Feature | +
---|---|
SQL instance Login Server Roles: - dbcreator- processadmin |
+- Recovery Database- Audit Database |
+
SQL Server Reporting Services instance rights: - Create Folders- Publish Reports |
+- System Center Configuration Manager Integration |
+
Permissions | +Configuration Manager Server Feature | +
---|---|
Configuration Manager site rights:- Read |
+System Center Configuration Manager integration |
+
Configuration Manager collection rights: - Create- Delete- Read- Modify- Deploy Configuration Items |
+System Center Configuration Manager integration |
+
Configuration Manager configuration item rights: - Create- Delete- Read |
+System Center Configuration Manager integration |
+
Permissions | +Configuration Manager Server Feature | +
---|---|
Configuration Manager site rights:- Read |
+System Center Configuration Manager integration |
+
Configuration Manager collection rights: - Create- Delete- Read- ReadResource |
+System Center Configuration Manager integration |
+
Configuration Manager configuration item rights: - Create- Delete- Read- Distribute |
+System Center Configuration Manager integration |
+
+ | Task | +References | +Notes | +
---|---|---|---|
![]() |
+Review the getting started information, which describes how Configuration Manager works with MBAM and shows the recommended high-level architecture. |
+[Getting Started - Using MBAM with Configuration Manager](getting-started---using-mbam-with-configuration-manager.md) |
++ |
![]() |
+Review the planning information, which describes the deployment prerequisites, supported configurations, required permissions, and deployment order for each feature. |
+Planning to Deploy MBAM with Configuration Manager |
++ |
![]() |
+Plan for and configure MBAM Group Policy requirements. |
+[Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md) |
++ |
![]() |
+Plan for and create necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements. |
+[Planning for MBAM 2.0 Administrator Roles](planning-for-mbam-20-administrator-roles-mbam-2.md) |
++ |
![]() |
+Plan for deploying MBAM Client deployment. |
+[Planning for MBAM 2.0 Client Deployment](planning-for-mbam-20-client-deployment-mbam-2.md) |
++ |
KB Article | +Title | +Link | +
---|---|---|
2831166 |
+Installing Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 fails with "System Center CM Objects Already Installed" |
+[support.microsoft.com/kb/2831166/EN-US](http://support.microsoft.com/kb/2831166/EN-US) |
+
2870849 |
+Users cannot retrieve BitLocker Recovery key using MBAM 2.0 Self Service Portal |
+[support.microsoft.com/kb/2870849/EN-US](http://support.microsoft.com/kb/2870849/EN-US) |
+
2756402 |
+MBAM client would fail with Event ID 4 and error code 0x8004100E in the Event description |
+[support.microsoft.com/kb/2756402/EN-US](http://support.microsoft.com/kb/2756402/EN-US) |
+
2620287 |
+Error Message “Server Error in ‘/Reports’ Application” When You Click Reports Tab in MBAM |
+[support.microsoft.com/kb/2620287/EN-US](http://support.microsoft.com/kb/2620287/EN-US) |
+
2639518 |
+Error opening Enterprise or Computer Compliance Reports in MBAM |
+[support.microsoft.com/kb/2639518/EN-US](http://support.microsoft.com/kb/2639518/EN-US) |
+
2620269 |
+MBAM Enterprise Reporting Not Getting Updated |
+[support.microsoft.com/kb/2620269/EN-US](http://support.microsoft.com/kb/2620269/EN-US) |
+
2712461 |
+Installing MBAM on a Domain Controller is not supported |
+[support.microsoft.com/kb/2712461/EN-US](http://support.microsoft.com/kb/2712461/EN-US) |
+
2876732 |
+You receive error code 0x80071a90 during Standalone or Configuration Manager Integration setup of MBAM 2.0 |
+[support.microsoft.com/kb/2876732/EN-US](http://support.microsoft.com/kb/2876732/EN-US) |
+
2754259 |
+MBAM and Secure Network Communication |
+[support.microsoft.com/kb/2754259/EN-US](http://support.microsoft.com/kb/2754259/EN-US) |
+
2870842 |
+MBAM 2.0 Setup fails during Configuration Manager Integration Scenario with SQL Server 2008 |
+[support.microsoft.com/kb/2870842/EN-US](http://support.microsoft.com/kb/2870842/EN-US) |
+
2668533 |
+MBAM Setup fails if SQL SSRS is not configured properly |
+[support.microsoft.com/kb/2668533/EN-US](http://support.microsoft.com/kb/2668533/EN-US) |
+
2870847 |
+MBAM 2.0 Setup fails with "Error retrieving Configuration Manager Server role settings for 'Reporting Services Point' role" |
+[support.microsoft.com/kb/2870847/EN-US](http://support.microsoft.com/kb/2870847/EN-US) |
+
2870839 |
+MBAM 2.0 Enterprise Reports are not refreshed in MBAM 2.0 Standalone topology due to SQL job CreateCache failure |
+[support.microsoft.com/kb/2870839/EN-US](http://support.microsoft.com/kb/2870839/EN-US) |
+
2620269 |
+MBAM Enterprise Reporting Not Getting Updated |
+[support.microsoft.com/kb/2620269/EN-US](http://support.microsoft.com/kb/2620269/EN-US) |
+
2935997 |
+MBAM Supported Computers compliance reporting incorrectly includes unsupported products |
+[support.microsoft.com/kb/2935997/EN-US](http://support.microsoft.com/kb/2935997/EN-US) |
+
2612822 |
+Computer Record is Rejected in MBAM |
+[support.microsoft.com/kb/2612822/EN-US](http://support.microsoft.com/kb/2612822/EN-US) |
+
KB Article | +Title | +Link | +
---|---|---|
2831166 |
+Installing Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 fails with "System Center CM Objects Already Installed" |
+[support.microsoft.com/kb/2831166/EN-US](http://support.microsoft.com/kb/2831166/EN-US) |
+
2870849 |
+Users cannot retrieve BitLocker Recovery key using MBAM 2.0 Self Service Portal |
+[support.microsoft.com/kb/2870849/EN-US](http://support.microsoft.com/kb/2870849/EN-US) |
+
2756402 |
+MBAM client would fail with Event ID 4 and error code 0x8004100E in the Event description |
+[support.microsoft.com/kb/2756402/EN-US](http://support.microsoft.com/kb/2756402/EN-US) |
+
2620287 |
+Error Message “Server Error in ‘/Reports’ Application” When You Click Reports Tab in MBAM |
+[support.microsoft.com/kb/2620287/EN-US](http://support.microsoft.com/kb/2620287/EN-US) |
+
2639518 |
+Error opening Enterprise or Computer Compliance Reports in MBAM |
+[support.microsoft.com/kb/2639518/EN-US](http://support.microsoft.com/kb/2639518/EN-US) |
+
2620269 |
+MBAM Enterprise Reporting Not Getting Updated |
+[support.microsoft.com/kb/2620269/EN-US](http://support.microsoft.com/kb/2620269/EN-US) |
+
2712461 |
+Installing MBAM on a Domain Controller is not supported |
+[support.microsoft.com/kb/2712461/EN-US](http://support.microsoft.com/kb/2712461/EN-US) |
+
2876732 |
+You receive error code 0x80071a90 during Standalone or Configuration Manager Integration setup of MBAM 2.0 |
+[support.microsoft.com/kb/2876732/EN-US](http://support.microsoft.com/kb/2876732/EN-US) |
+
2754259 |
+MBAM and Secure Network Communication |
+[support.microsoft.com/kb/2754259/EN-US](http://support.microsoft.com/kb/2754259/EN-US) |
+
2870842 |
+MBAM 2.0 Setup fails during Configuration Manager Integration Scenario with SQL Server 2008 |
+[support.microsoft.com/kb/2870842/EN-US](http://support.microsoft.com/kb/2870842/EN-US) |
+
2668533 |
+MBAM Setup fails if SQL SSRS is not configured properly |
+[support.microsoft.com/kb/2668533/EN-US](http://support.microsoft.com/kb/2668533/EN-US) |
+
2870847 |
+MBAM 2.0 Setup fails with "Error retrieving Configuration Manager Server role settings for 'Reporting Services Point' role" |
+[support.microsoft.com/kb/2870847/EN-US](http://support.microsoft.com/kb/2870847/EN-US) |
+
2870839 |
+MBAM 2.0 Enterprise Reports are not refreshed in MBAM 2.0 Standalone topology due to SQL job CreateCache failure |
+[support.microsoft.com/kb/2870839/EN-US](http://support.microsoft.com/kb/2870839/EN-US) |
+
2620269 |
+MBAM Enterprise Reporting Not Getting Updated |
+[support.microsoft.com/kb/2620269/EN-US](http://support.microsoft.com/kb/2620269/EN-US) |
+
2935997 |
+MBAM Supported Computers compliance reporting incorrectly includes unsupported products |
+[support.microsoft.com/kb/2935997/EN-US](http://support.microsoft.com/kb/2935997/EN-US) |
+
2612822 |
+Computer Record is Rejected in MBAM |
+[support.microsoft.com/kb/2612822/EN-US](http://support.microsoft.com/kb/2612822/EN-US) |
+
Column Name | +Description | +
---|---|
Managed Computers |
+Number of computers that MBAM manages. |
+
% Compliant |
+Percentage of compliant computers in the enterprise. |
+
% Non-Compliant |
+Percentage of non-compliant computers in the enterprise. |
+
% Unknown Compliance |
+Percentage of computers whose compliance state is not known. |
+
% Exempt |
+Percentage of computers exempt from the BitLocker encryption requirement. |
+
% Non-Exempt |
+Percentage of computers exempt from the BitLocker encryption requirement. |
+
Compliant |
+Percentage of compliant computers in the enterprise. |
+
Non-Compliant |
+Percentage of non-compliant computers in the enterprise. |
+
Unknown Compliance |
+Percentage of computers whose compliance state is not known. |
+
Exempt |
+Total computers that are exempt from the BitLocker encryption requirement. |
+
Non-Exempt |
+Total computers that are not exempt from the BitLocker encryption requirement. |
+
Compliance Status | +Exemption | +Description | +
---|---|---|
Noncompliant |
+Not Exempt |
+The computer is noncompliant, according to the specified policy. |
+
Compliant |
+Not Exempt |
+The computer is compliant in accordance with the specified policy. |
+
Column Name | +Description | +
---|---|
Managed Computers |
+Number of computers that MBAM manages. |
+
% Compliant |
+Percentage of compliant computers in the enterprise. |
+
% Non-Compliant |
+Percentage of non-compliant computers in the enterprise. |
+
% Unknown Compliance |
+Percentage of computers whose compliance state is not known. |
+
% Exempt |
+Percentage of computers exempt from the BitLocker encryption requirement. |
+
% Non-Exempt |
+Percentage of computers exempt from the BitLocker encryption requirement. |
+
Compliant |
+Percentage of compliant computers in the enterprise. |
+
Non-Compliant |
+Percentage of non-compliant computers in the enterprise. |
+
Unknown Compliance |
+Percentage of computers whose compliance state is not known. |
+
Exempt |
+Total computers that are exempt from the BitLocker encryption requirement. |
+
Non-Exempt |
+Total computers that are not exempt from the BitLocker encryption requirement. |
+
Column Name | +Description | +
---|---|
Computer Name |
+User-specified DNS computer name that is being managed by MBAM. |
+
Domain Name |
+Fully qualified domain name, where the client computer resides and is managed by MBAM. |
+
Compliance Status |
+Overall Compliance Status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. Notice that the compliance status per drive (see table that follows) may indicate different compliance states. However, this field represents that compliance state, in accordance with the policy specified. |
+
Exemption |
+Status that indicates whether the user is exempt or non-exemption from the BitLocker policy. |
+
Device Users |
+User of the device. |
+
Compliance Status Details |
+Error and status messages of the compliance state of the computer in accordance to the policy specified. |
+
Last Contact |
+Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable (see MBAM policy settings). |
+
Column Name | +Description | +
---|---|
Computer Name |
+User-specified DNS computer name that is being managed by MBAM. |
+
Domain Name |
+Fully qualified domain name, where the client computer resides and is managed by MBAM. |
+
Computer Type |
+Type of computer. Valid types are non-Portable and Portable. |
+
Operating System |
+Operating System type found on the MBAM managed client computer. |
+
Overall Compliance |
+Overall Compliance Status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. Notice that the compliance status per drive (see table that follows) may indicate different compliance states. However, this field represents that compliance state, in accordance with the policy specified. |
+
Operating System Compliance |
+Compliance status of the operating system that is managed by MBAM. Valid states are Compliant and Noncompliant. |
+
Fixed Data Drive Compliance |
+Compliance status of the Fixed Data Drive that is managed by MBAM. Valid states are Compliant and Noncompliant. |
+
Last Update Date |
+Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable (see MBAM policy settings). |
+
Exemption |
+Status that indicates whether the user is exempt or non-exemption from the BitLocker policy. |
+
Exempted User |
+User who is exempt from the BitLocker policy. |
+
Exemption Date |
+Date on which the exemption was granted. |
+
Compliance Status Details |
+Error and status messages of the compliance state of the computer in accordance to the policy specified. |
+
Policy Cipher Strength |
+Cipher Strength selected by the Administrator during MBAM policy specification. (for example, 128-bit with Diffuser). |
+
Policy: Operating System Drive |
+Indicates if encryption is required for the O/S and the appropriate protector type. |
+
Policy:Fixed Data Drive |
+Indicates if encryption is required for the Fixed Drive. |
+
Manufacturer |
+Computer manufacturer name as it appears in the computer BIOS. |
+
Model |
+Computer manufacturer model name as it appears in the computer BIOS. |
+
Device Users |
+Known users on the computer that is being managed by MBAM. |
+
Column Name | +Description | +
---|---|
Drive Letter |
+Computer drive letter that was assigned to the particular drive by the user. |
+
Drive Type |
+Type of drive. Valid values are Operating System Drive and Fixed Data Drive. These are physical drives rather than logical volumes. |
+
Cipher Strength |
+Cipher Strength selected by the Administrator during MBAM policy specification. |
+
Protector Types |
+Type of protector selected via policy used to encrypt an operating system or Fixed volume. The valid protector types on an operating system are TPM or TPM+PIN and for a Fixed Data Volume is Password. |
+
Protector State |
+Indicates that the computer being managed by MBAM has enabled the protector type specified in the policy. The valid states are ON or OFF. |
+
Encryption State |
+Encryption state of the drive. Valid states are Encrypted, Not Encrypted, and Encrypting. |
+
Column Name | +Description | +
---|---|
Computer Name |
+User-specified DNS name that is being managed by MBAM. |
+
Domain Name |
+Fully qualified domain name where the client computer resides and is managed by MBAM. |
+
Compliance Status |
+State of compliance for the computer, according to the policy specified for the computer. The states are Noncompliant and Compliant. See the Enterprise Compliance Report Compliance States table for more information about how to interpret compliance states. |
+
Compliance Status Details |
+Error and status messages of the compliance state of the computer in accordance to the policy specified. |
+
Last Contact |
+Date and time when the computer last contacted the server to report compliance status. The contact frequency is configurable (see MBAM policy settings). |
+
Compliance Status | +Exemption | +Description | +User Action | +
---|---|---|---|
Noncompliant |
+Not Exempt |
+The computer is noncompliant, according to the specified policy. |
+Expand the Computer Compliance Report details by clicking Computer Name, and determine whether the state of each drive complies with the specified policy. If the encryption state indicates that the computer is not encrypted, encryption may be in process, or there is an error on the computer. If there is no error, the likely cause is that the computer is still in the process of connecting or establishing the encryption status. Check back later to determine if the state changes. |
+
Compliant |
+Not Exempt |
+The computer is compliant, according to the specified policy. |
+No action needed; the state of the computer can be confirmed by viewing the Computer Compliance Report. |
+
Column Name | +Description | +
---|---|
Computer Name |
+User-specified DNS computer name that is being managed by MBAM. |
+
Domain Name |
+Fully qualified domain name, where the client computer resides and is managed by MBAM. |
+
Computer Type |
+Type of computer. Valid types are non-Portable and Portable. |
+
Operating System |
+Operating system type found on the MBAM-managed client computer. |
+
Compliance Status |
+Overall compliance status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. Notice that the compliance status per drive (see the following table) may indicate different compliance states. However, this field represents that compliance state, according to the specified policy. |
+
Policy Cipher Strength |
+Cipher strength selected by the administrator during MBAM policy specification (for example, 128-bit with Diffuser). |
+
Policy Operating System Drive |
+Indicates if encryption is required for the operating system and shows the appropriate protector type. |
+
Policy-Fixed Data Drive |
+Indicates if encryption is required for the dixed data drive. |
+
Policy Removable Data Drive |
+Indicates if encryption is required for the removable drive. |
+
Device Users |
+Known users on the computer that is being managed by MBAM. |
+
Manufacturer |
+Computer manufacturer name, as it appears in the computer BIOS. |
+
Model |
+Computer manufacturer model name, as it appears in the computer BIOS. |
+
Compliance Status Details |
+Error and status messages of the compliance state of the computer, in accordance with the specified policy. |
+
Last Contact |
+Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable (see MBAM policy settings). |
+
Column Name | +Description | +
---|---|
Drive Letter |
+Computer drive letter that was assigned to the particular drive by the user. |
+
Drive Type |
+Type of drive. Valid values are Operating System Drive and Fixed Data Drive. These are physical drives rather than logical volumes. |
+
Cipher Strength |
+Cipher strength selected by the administrator during MBAM policy specification. |
+
Protector Type |
+Type of protector selected via the policy used to encrypt an operating system or fixed data volume. |
+
Protector State |
+Indicates that the computer being managed by MBAM has enabled the protector type that is specified in the policy. The valid states are ON or OFF. |
+
Encryption State |
+Encryption state of the drive. Valid states are Encrypted, Not Encrypted, and Encrypting. |
+
Compliance Status |
+State that indicates whether the drive is in accordance with the policy. States are Noncompliant and Compliant. |
+
Compliance Status Details |
+Error and status messages of the compliance state of the computer, according to the specified policy. |
+
Column Name | +Description | +
---|---|
Request Date and Time |
+Date and time that a key retrieval request was made by an end user or Help Desk user. |
+
Request Status |
+Status of the request. Valid statuses are either Successful (the key was retrieved), or Failed (the key was not retrieved). |
+
Helpdesk User |
+Help Desk user that initiated the request for key retrieval. Note: If the Help Desk user retrieves the key on behalf on an end-user, the End User field will be blank. |
+
User |
+End user who initiated the request for key retrieval. |
+
Key Type |
+Type of key that was requested by either the Help Desk user or the end user. The three types of keys that MBAM collects are: Recovery Key Password (used to recovery a computer in recovery mode), Recovery Key ID (used to recover a computer in recovery mode on behalf of another user), and TPM Password Hash (used to recover a computer with a locked TPM). |
+
Reason Description |
+Reason the specified Key Type was requested by the Help Desk user or the end user. The reasons are specified in the Drive Recovery and Manage TPM features of the Administration and Monitoring website. The valid entries are either user-entered text, or one of the following reason codes: +
|
+
File type | +File location | +
---|---|
language neutral (.admx) |
+ %systemroot%\policyDefinitions |
+
language specific (.adml) |
+ %systemroot%\policyDefinitions\[MUIculture] (for example, the U.S. English language specific file will be stored in %systemroot%\policyDefinitions\en-us) |
+
File type | +Domain controller file location | +
---|---|
Language neutral (.admx) |
+ %systemroot%sysvol\domain\policies\PolicyDefinitions |
+
Language specific (.adml) |
+ %systemroot%\sysvol\domain\policies\PolicyDefinitions\[MUIculture] (for example, the U.S. English language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us) |
+
Group Policy setting | +Description | +Group Policy node used to configure this setting | +
---|---|---|
Encryption Policy Enforcement Settings (Operating System Drive) |
+For this setting, use the option Configure the number of noncompliance grace period days for operating system drives to configure a grace period. +The grace period specifies the number of days that end users can postpone compliance with MBAM policies for their operating system drive after the drive is first detected as noncompliant. +After the configured grace period expires, users cannot postpone the required action or request an exemption from it. +If user interaction is required (for example, if you are using the Trusted Platform Module (TPM) + PIN or using a password protector), a dialog box appears, and users cannot close it until they provide the required information. If the protector is TPM only, encryption begins immediately in the background without user input. +Users cannot request exemptions through the BitLocker encryption wizard. Instead, they must contact their Help Desk or use whatever process their organization uses for exemption requests. |
+Computer Configuration > Policies > Administrative Templates > Windows Components > MDOP MBAM (BitLocker Management) > Operating System Drive |
+
Encryption Policy Enforcement Settings (Fixed Data Drives) |
+For this setting, use the option Configure the number of noncompliance grace period days for fixed drives to configure a grace period. +The grace period specifies the number of days that end users can postpone compliance with MBAM policies for their fixed drive after the drive is first detected as noncompliant. +The grace period begins when the fixed drive is determined to be noncompliant. If you are using auto-unlock, the policy will not be enforced until the operating system drive is compliant. However, if you are not using auto-unlock, encryption of the fixed data drive can begin before the operating system drive is fully encrypted. +After the configured grace period expires, users cannot postpone the required action or request an exemption from it. If user interaction is required, a dialog box appears and users cannot close it until they provide the required information. |
+Computer Configuration > Policies > Administrative Templates > Windows Components > MDOP MBAM (BitLocker Management) > Fixed Drive |
+
Role | +Access rights for this role on the Administration and Monitoring Website | +
---|---|
MBAM Helpdesk Users |
+Provides access to the Manage TPM and Drive Recovery areas of the MBAM Administration and Monitoring Website. Users who have access to these areas must fill in all fields when they use either area. |
+
MBAM Report Users |
+Provides access to the Reports in the Administration and Monitoring Website. |
+
MBAM Advanced Helpdesk Users |
+Provides access to all areas in the Administration and Monitoring Website. Users in this group have to enter only the recovery key, not the end user’s domain and user name, when helping end users recover their drives. If a user is a member of the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Users group permissions. |
+
Windows PowerShell Help format | +More information | +
---|---|
At a Windows PowerShell command prompt, type Get-Help <cmdlet> |
+To upload the latest Windows PowerShell cmdlets, follow the instructions in the previous section on how to load Windows PowerShell Help for MBAM. |
+
On TechNet as webpages |
+http://go.microsoft.com/fwlink/?LinkId=393498 |
+
On the Download Center as a Word .docx file |
+http://go.microsoft.com/fwlink/?LinkId=393497 |
+
On the Download Center as a .pdf file |
+http://go.microsoft.com/fwlink/?LinkId=393499 |
+
Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.) +20 Roszel Road +Princeton, NJ 08540 |
++ |
Telephone number from within the United States: |
+(800) 221-4792 |
+
Telephone number from outside the United States and Canada: |
+(609) 452-0606 |
+
Fax: |
+(609) 987-8116 |
+
[http://www.learningally.org/](http://go.microsoft.com/fwlink/?linkid=239) |
+Web addresses can change, so you might be unable to connect to the website or sites mentioned here. |
+
Event ID | +Channel | +Event symbol | +Message | +
---|---|---|---|
1 |
+Operational |
+VolumeEnactmentSuccessful |
+The MBAM policies were applied successfully. |
+
2 |
+Admin |
+VolumeEnactmentFailed |
+An error occurred while applying MBAM policies. |
+
3 |
+Operational |
+TransferStatusDataSuccessful |
+The encryption status data was sent successfully. |
+
4 |
+Admin |
+TransferStatusDataFailed |
+An error occurred while sending encryption status data. |
+
8 |
+Admin |
+SystemVolumeNotFound |
+The system volume is missing. SystemVolume is needed to encrypt the operating system drive. |
+
9 |
+Admin |
+TPMNotFound |
+The TPM hardware is missing. TPM is needed to encrypt the operating system drive with any TPM protector. |
+
10 |
+Admin |
+MachineHWExempted |
+The computer is exempted from Encryption. Machine’s hardware status: Exempted |
+
11 |
+Admin |
+MachineHWUnknown |
+The computer is exempted from encryption. Machine’s hardware status: Unknown |
+
12 |
+Admin |
+HWCheckFailed |
+Hardware exemption check failed. |
+
13 |
+Admin |
+UserIsExempted |
+The user is exempt from encryption. |
+
14 |
+Admin |
+UserIsWaiting |
+The user requested an exemption. |
+
15 |
+Admin |
+UserExemptionCheckFailed |
+User exemption check failed. |
+
16 |
+Admin |
+UserPostponed |
+The user postponed the encryption process. |
+
17 |
+Admin |
+TPMInitializationFailed |
+TPM initialization failed. The user rejected the BIOS changes. |
+
18 |
+Admin |
+CoreServiceDown |
+Unable to connect to the MBAM Recovery and Hardware service. |
+
19 |
+Operational |
+CoreServiceUp |
+Successfully connected to the MBAM Recovery and Hardware service. |
+
20 |
+Admin |
+PolicyMismatch |
+The MBAM policy is in conflict or corrupt. |
+
21 |
+Admin |
+ConflictingOSVolumePolicies |
+Detected OS volume encryption policies conflict. Check BitLocker and MBAM policies related to OS drive protectors. |
+
22 |
+Admin |
+ConflictingFDDVolumePolicies |
+Detected Fixed Data Drive volume encryption policies conflict. Check BitLocker and MBAM policies related to FDD drive protectors. |
+
27 |
+Admin |
+EncryptionFailedNoDra |
+An error occurred while encrypting. A Data Recovery Agent (DRA) protector is required in FIPS mode for pre-Windows 8.1 machines. |
+
28 |
+Operational |
+TpmOwnerAuthEscrowed |
+The TPM OwnerAuth has been escrowed. |
+
29 |
+Operational |
+RecoveryKeyEscrowed |
+The BitLocker recovery key for the volume has been escrowed. |
+
30 |
+Operational |
+RecoveryKeyReset |
+The BitLocker recovery key for the volume has been updated. |
+
31 |
+Operational |
+EnforcePolicyDateSet |
+The enforce policy date, <date>, has been set for the volume |
+
32 |
+Operational |
+EnforcePolicyDateCleared |
+The enforce policy date, <date>, has been cleared for the volume. |
+
33 |
+Operational |
+TpmLockOutResetSucceeded |
+Successfully reset TPM lockout. |
+
34 |
+Admin |
+TpmLockOutResetFailed |
+Failed to reset TPM lockout. |
+
35 |
+Operational |
+TpmOwnerAuthRetrievalSucceeded |
+Successfully retrieved TPM OwnerAuth from MBAM services. |
+
36 |
+Admin |
+TpmOwnerAuthRetrievalFailed |
+Failed to retrieve TPM OwnerAuth from MBAM services. |
+
37 |
+Admin |
+WmiProviderDllSearchPathUpdateFailed |
+Failed to update the DLL search path for WMI provider. |
+
38 |
+Admin |
+TimedOutWaitingForWmiProvider |
+Agent Stopping - Timed-out waiting for MBAM WMI Provider Instance. |
+
39 |
+Operational |
+RemovableDriveMounted |
+Removable drive was mounted. |
+
40 |
+Operational |
+RemovableDriveDismounted |
+Removable drive was unmounted. |
+
41 |
+Operational |
+FailedToEnactEndpointUnreachable |
+Failure to connect to the MBAM Recovery and Hardware service prevented MBAM policies from being applied successfully to the volume. |
+
42 |
+Operational |
+FailedToEnactLockedVolume |
+Locked volume state prevented MBAM policies from being applied successfully to the volume. |
+
43 |
+Operational |
+TransferStatusDataFailedEndpointUnreachable |
+Failure to connect to the MBAM Compliance and Status service prevented the transfer of encryption status data. |
+
Windows PowerShell Help format | +More information | +
---|---|
At a Windows PowerShell command prompt, type Get-Help <cmdlet> |
+To upload the latest Windows PowerShell cmdlets, follow the instructions in the previous section on how to load Windows PowerShell Help for MBAM. |
+
On TechNet as webpages |
+http://go.microsoft.com/fwlink/?LinkId=393498 |
+
On the Download Center as a Word .docx file |
+http://go.microsoft.com/fwlink/?LinkId=393497 |
+
On the Download Center as a .pdf file |
+http://go.microsoft.com/fwlink/?LinkId=393499 |
+
Configurations that you can do only by using Windows PowerShell | +Details | +
---|---|
Install the web services on a separate computer from the web applications. |
+Using the wizard, you must install the web services and web applications on the same computer. |
+
Enable reports on a separate reporting services point without installing all of the Configuration Manager objects. |
++ |
Delete all of the objects from Configuration Manager. |
+Deleting the objects in turn deletes all of the compliance data from Configuration Manager. |
+
Enter a custom connection string for the databases. |
+Example: To configure the web applications to work with mirroring, you must use the Enable-MbamWebApplication cmdlet to specify the appropriate failover partner syntax in the connection string. |
+
Skip validation and configure a feature even though the prerequisite check failed. |
++ |
Prerequisite | +Details or additional information | +
---|---|
Create the required accounts. |
+See section Required accounts and corresponding Windows PowerShell cmdlet parameters later in this topic. |
+
User accounts and groups that you pass as parameters to the Windows PowerShell cmdlets must be valid accounts in the domain. |
+You cannot use local accounts. |
+
Specify accounts in the down-level format. |
+Examples: +domainNetBiosName\userdomainNetBiosName\group |
+
Prerequisite | +Details or additional information | +||||||||
---|---|---|---|---|---|---|---|---|---|
You must be an administrator on the local computer where you are configuring the MBAM feature. |
++ | ||||||||
Use an elevated Windows PowerShell command prompt to run all Windows PowerShell cmdlets. |
++ | ||||||||
For the Enable-MbamDatabase cmdlet only: +You must have "create any database" permissions on the instance of the target Microsoft SQL Server database. +This user account must be a part of the local administrators group or the Backup Operators group to register the MBAM Volume Shadow Copy Service (VSS) Writer. |
+By default, the database administrator or system administrator has the required "create any database" permissions. + +For more information about VSS Writer, see [Volume Shadow Copy Service](http://go.microsoft.com/fwlink/?LinkId=392814). |
+||||||||
For the System Center Configuration Manager Integration feature only: +The user who enables this feature must have these rights in Configuration Manager: |
+
+ |
+
When to use this capability |
+When you want to configure the MBAM 2.5 Server features on a remote computer. The Windows PowerShell cmdlets are running on one computer, and you are configuring the features on a different, remote computer. |
+
What you have to do |
+To use Windows PowerShell to configure MBAM 2.5 Server features on a remote computer, you must: +
|
+
Why you have to do it |
+This protocol enables the Windows PowerShell cmdlets to connect to Active Directory Domain Services by using the user’s administrative credentials. You might get a validation error if you start the Windows PowerShell session without this protocol. |
+
How to start a Windows PowerShell session with the CredSSP protocol |
+Type the following code at the Windows PowerShell prompt: +
The following code shows an example. +
|
+
Step | +Where to get instructions | +
---|---|
Review the recommended architecture for MBAM. |
+[High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) |
+
Review the supported configurations for MBAM. |
+[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) |
+
Complete the required prerequisites on each server. |
+
|
+
Install the MBAM Server software on each server where you will configure an MBAM Server feature. |
+[Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md) |
+
Review the prerequisites for using Windows PowerShell to configure MBAM Server features (if you are using this method to configure MBAM Server features). |
+[Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) |
+
Features to install | +Where to get instructions | +
---|---|
Configure the databases. |
+[How to Configure the MBAM 2.5 Databases](how-to-configure-the-mbam-25-databases.md) |
+
Configure the reports. |
+[How to Configure the MBAM 2.5 Reports](how-to-configure-the-mbam-25-reports.md) |
+
Configure the web applications. |
+[How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) |
+
Configure the System Center Configuration Manager Integration (if applicable). |
+[How to Configure the MBAM 2.5 System Center Configuration Manager Integration](how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md) |
+
File type | +File location | +
---|---|
Group Policy template (.admx) |
+
|
+
Group Policy language file (.adml) |
+
|
+
File type | +File location | +
---|---|
Group Policy template (.admx) |
+
|
+
Group Policy language file (.adml) |
+
For example, the U.S. English ADML language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us. |
+
What you can do | +Instructions | +
---|---|
You can brand the Self-Service Portal with your company name, Help Desk URL, and can change the Session Time-out setting to make the end user’s session expire after a specified period of inactivity. |
+[How to Set the Self-Service Portal Branding and Session Time-out](how-to-set-the-self-service-portal-branding-and-session-time-out.md) |
+
You can turn the Self-Service Portal notice text on or off. |
+[How to Turn the Self-Service Portal Notice Text On or Off](how-to-turn-the-self-service-portal-notice-text-on-or-off.md) |
+
You can configure a localized version of the Self-Service Portal "HelpdeskText" statement, which tells end users how to get additional help when they are using the Self-Service Portal. |
+[How to Localize the “HelpdeskText” Statement that Points Users to More Self-Service Portal Information](how-to-localize-the-helpdesktext-statement-that-points-users-to-more-self-service-portal-information.md) |
+
You can configure a localized version of the Self-Service Portal "HelpdeskURL" to display to end users by default. |
+[How to Localize the Self-Service Portal “HelpdeskURL”](how-to-localize-the-self-service-portal-helpdeskurl.md) |
+
You can configure localized notice text to display to end users by default in the Self-Service Portal. |
+[How to Localize the Self-Service Portal Notice Text](how-to-localize-the-self-service-portal-notice-text.md) |
+
Topic description | +Links to topics | +
---|---|
|
+[Deploying the MBAM 2.5 Server Infrastructure](deploying-the-mbam-25-server-infrastructure.md) |
+
How to download and deploy the MBAM Group Policy Templates, which are required to manage MBAM Clients and BitLocker encryption policies in the enterprise. |
+[Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md) |
+
How to use the MBAM Client Windows Installer files to deploy the MBAM Client software. |
+[Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) |
+
Checklist that can assist you in deploying the MBAM Server features and MBAM Client. |
+[MBAM 2.5 Deployment Checklist](mbam-25-deployment-checklist.md) |
+
How to upgrade MBAM from previous versions. |
+[Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions](upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md) |
+
How to remove MBAM Server features or software. |
+[Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md) |
+
Task | +Where to get instructions | +
---|---|
Install the MBAM 2.5 Server software on each server where you want to configure an MBAM Server feature. |
+[Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md) |
+
Configure the databases, reports, web applications, and the optional System Center Configuration Manager Integration topology. +You can use the MBAM Server Configuration wizard or Windows PowerShell cmdlets to do the configuration. |
+[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) |
+
Validate the MBAM Server configuration. |
+[Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md) |
+
Non-Compliance Code | +Reason for Non-Compliance | +
---|---|
0 |
+Cipher strength not AES 256. |
+
1 |
+MBAM Policy requires this volume to be encrypted but it is not. |
+
2 |
+MBAM Policy requires this volume to NOT be encrypted, but it is. |
+
3 |
+MBAM Policy requires this volume use a TPM protector, but it does not. |
+
4 |
+MBAM Policy requires this volume use a TPM+PIN protector, but it does not. |
+
5 |
+MBAM Policy does not allow non TPM machines to report as compliant. |
+
6 |
+Volume has a TPM protector but the TPM is not visible (booted with recover key after disabling TPM in BIOS?). |
+
7 |
+MBAM Policy requires this volume use a password protector, but it does not have one. |
+
8 |
+MBAM Policy requires this volume NOT use a password protector, but it has one. |
+
9 |
+MBAM Policy requires this volume use an auto-unlock protector, but it does not have one. |
+
10 |
+MBAM Policy requires this volume NOT use an auto-unlock protector, but it has one. |
+
11 |
+Policy conflict detected preventing MBAM from reporting this volume as compliant. |
+
12 |
+A system volume is needed to encrypt the OS volume but it is not present. |
+
13 |
+Protection is suspended for the volume. |
+
14 |
+AutoUnlock unsafe unless the OS volume is encrypted. |
+
Task | +More information | +
---|---|
Copy the MBAM 2.5 Group Policy Templates. |
+[Copying the MBAM 2.5 Group Policy Templates](copying-the-mbam-25-group-policy-templates.md) |
+
Determine which Group Policy Objects (GPOs) you want to use in your MBAM implementation. Based on the needs of your organization, you might have to configure additional Group Policy settings. |
+[Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md) – contains descriptions of the GPOs |
+
Set the Group Policy settings for your organization. |
++ |
Policy Group | +Policy | +
---|---|
Client Management |
+ Configure MBAM Services |
+
Operating System Drive |
+ Operating system drive encryption settings |
+
Removable Drive |
+ Control use of BitLocker on removable drives |
+
Fixed Drive |
+ Control use of BitLocker on fixed drives |
+
Task | +Where to get instructions | +
---|---|
Ensure that you have installed all of the prerequisite software. |
+ [MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md) |
+
Check the required hardware, RAM, and other specifications. |
+ [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) |
+
Review the prerequisites for using Windows PowerShell if you plan to use the cmdlets to configure MBAM. |
+ [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) |
+
Task | +Where to get instructions | +
---|---|
Install the MBAM Server software on each server where you want to configure an MBAM Server feature. |
+ [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md) |
+
Configure the Compliance and Audit Database and the Recovery Database. |
+ [How to Configure the MBAM 2.5 Databases](how-to-configure-the-mbam-25-databases.md) |
+
Configure the Reports feature. |
+ [How to Configure the MBAM 2.5 Reports](how-to-configure-the-mbam-25-reports.md) |
+
Configure the web applications. |
+ [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) |
+
Task | +Where to get instructions | +
---|---|
Ensure that you have installed all of the prerequisite software. |
+ [MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md) +[MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md) |
+
Check the required hardware, RAM, and other specifications. |
+ [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) |
+
Review the prerequisites for using Windows PowerShell if you plan to use the cmdlets to configure MBAM. |
+ [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) |
+
Create or edit the .mof files. |
+ [Edit the Configuration.mof File](edit-the-configurationmof-file-mbam-25.md) +[Create or Edit the Sms_def.mof File](create-or-edit-the-sms-defmof-file-mbam-25.md) |
+
Task | +Where to get instructions | +
---|---|
Install the MBAM Server software on each server where you want to configure an MBAM Server feature. +
+ Note
+
+ You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see [Data-tier Applications](http://technet.microsoft.com/library/ee210546.aspx). +
+
+ |
+ [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md) |
+
Configure the Compliance and Audit Database and the Recovery Database. |
+ [How to Configure the MBAM 2.5 Databases](how-to-configure-the-mbam-25-databases.md) |
+
Configure the Reports feature. |
+ [How to Configure the MBAM 2.5 Reports](how-to-configure-the-mbam-25-reports.md) |
+
Configure the web applications. |
+ [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) |
+
Configure the System Center Configuration Manager to install the Configuration Manager objects. |
+ [How to Configure the MBAM 2.5 System Center Configuration Manager Integration](how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md) |
+
Task | +Where to get instructions | +
---|---|
Ensure that you have installed all of the prerequisite software. |
+ [MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md) +[MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md) |
+
Check the required hardware, RAM, and other specifications. |
+ [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) |
+
Create or edit the .mof files. |
+ [Edit the Configuration.mof File](edit-the-configurationmof-file-mbam-25.md) +[Create or Edit the Sms_def.mof File](create-or-edit-the-sms-defmof-file-mbam-25.md) |
+
Task | +Where to get instructions | +
---|---|
Install the MBAM Server software on each server where you want to configure an MBAM Server feature. +
+ Note
+
+ You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see [Data-tier Applications](http://technet.microsoft.com/library/ee210546.aspx). +
+
+ |
+ [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md) |
+
Configure the Compliance and Audit Database and the Recovery Database. |
+ [How to Configure the MBAM 2.5 Databases](how-to-configure-the-mbam-25-databases.md) |
+
Configure the Reports feature. |
+ [How to Configure the MBAM 2.5 Reports](how-to-configure-the-mbam-25-reports.md) |
+
Configure the web applications. |
+ [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) |
+
Configure the System Center Configuration Manager to install the Configuration Manager objects. |
+ [How to Configure the MBAM 2.5 System Center Configuration Manager Integration](how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md) |
+
Topic description | +Links to topics | +
---|---|
High-level overview of MBAM 2.5 that describes how you can use it in your organization. |
+[About MBAM 2.5](about-mbam-25.md) |
+
Release notes, which lists known issues in the product. |
+[Release Notes for MBAM 2.5](release-notes-for-mbam-25.md) |
+
Information about how you can evaluate MBAM 2.5 in a test environment. |
+[Evaluating MBAM 2.5 in a Test Environment](evaluating-mbam-25-in-a-test-environment.md) |
+
Description of the MBAM 2.5 features and the recommended architecture of the Stand-alone and Configuration Manager Integration topologies in a production environment. |
+[High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) |
+
Description and illustration of each MBAM Server feature, without the recommended architecture. |
+[Illustrated Features of an MBAM 2.5 Deployment](illustrated-features-of-an-mbam-25-deployment.md) |
+
Describes the keyboard shortcuts that are available for MBAM 2.5. |
+[Accessibility for MBAM 2.5](accessibility-for-mbam-25.md) |
+
Recommended architecture | +Details | +
---|---|
Number of servers and other computers |
+Three servers +One workstation |
+
Number of client computers supported |
+500,000 |
+
Configuration Manager version | +Description | +
---|---|
System Center 2012 R2 Configuration Manager +System Center 2012 Configuration Manager |
+If you install MBAM on a primary site server or on a central administration server, MBAM performs all of the installation actions on that site server. |
+
Configuration Manager 2007 R2 +Configuration Manager 2007 |
+If you install MBAM on a primary site server that is part of a larger Configuration Manager hierarchy with a central site parent server, MBAM identifies the central site parent server and performs all of the installation actions on that parent server. The installation includes checking prerequisites and installing the Configuration Manager objects and reports. +For example, if you install MBAM on a primary site server that is a child of a central site parent server, MBAM installs all of the Configuration Manager objects and reports on the parent server. If you install MBAM on the parent server, MBAM performs all of the installation actions on that parent server. |
+
Items installed into Configuration Manager | +Description | +||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Configuration data |
+The configuration data installs a configuration baseline, called “BitLocker Protection,” which contains two configuration items: +
The configuration baseline is deployed to the MBAM Supported Computers collection, which is also created when MBAM is installed. +The two configuration items provide the basis for evaluating the compliance status of the client computers. This information is captured, stored, and evaluated in Configuration Manager. +The configuration items are based on the compliance requirements for operating system drives and fixed data drives. The required details for the deployed computers are collected so that the compliance for those drive types can be evaluated. +By default, the configuration baseline evaluates the compliance status every 12 hours and sends the compliance data to Configuration Manager. |
+||||||||||
MBAM Supported Computers collection |
+MBAM creates a collection that is called MBAM Supported Computers. The configuration baseline is targeted to client computers that are in this collection. +This is a dynamic collection. By default, it runs every 12 hours and evaluates membership, based on three criteria: +
The collection is evaluated against all computers and a subset of compatible computers is created, which provides the basis for compliance evaluation and reporting for the MBAM integration. |
+||||||||||
Reports |
+When you configure MBAM with the Configuration Manager Integration topology, you view all reports in Configuration Manager, except the Recovery Audit Report, the latter of which you continue to view in the MBAM Administration and Monitoring Website. The reports available in Configuration Manager are: +
|
+
Recommended architecture in a production environment | +Details | +
---|---|
Number of servers and other computers |
+Two servers +One workstation |
+
Number of client computers supported |
+500,000 |
+
Step | +Where to get instructions | +
---|---|
Review the recommended architecture for MBAM. |
+[High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) |
+
Review the supported configurations for MBAM. |
+[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) |
+
Complete the required prerequisites on each server. |
+
|
+
Install the MBAM Server software on each server where you plan to configure an MBAM Server feature. +
+Note
+
+You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see [Data-tier Applications](http://technet.microsoft.com/library/ee210546.aspx). +
+
+ |
+[Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md) |
+
Review the prerequisites for using Windows PowerShell if you plan to use Windows PowerShell cmdlets to configure MBAM Server features. |
+[Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) |
+
Field | +Description | +
---|---|
SQL Server name |
+ Name of the server where you are configuring the Compliance and Audit Database. +
+ Note
+
+ You must add an exception on the Compliance and Audit Database computer to enable inbound traffic on the Microsoft SQL Server port. The default port number is 1433. +
+
+ |
+
SQL Server database instance |
+ Name of the database instance where the compliance and audit data will be stored. You must also specify where the database information will be located. |
+
Database name |
+ Name of the database that will store the compliance data. +
+ Note
+
+ If you are upgrading from a previous version of MBAM, you must use the same database name as the name that was used in your previous deployment. +
+
+ |
+
Read/write access domain user or group |
+ Domain user or group that has read/write permission to this database to enable the web applications to access the data and reports in this database. +If you enter a user in this field, it must be the same value as the value in the Web service application pool domain account field on the Configure Web Applications page. +If you enter a group in this field, the value in the Web service application pool domain account field on the Configure Web Applications page must be a member of the group you enter in this field. |
+
Read-only access domain user or group |
+ Name of the user or group that will have read-only permission to this database to enable the reports to access the compliance data in this database. +If you enter a user in this field, it must be the same user as the one you specify in the Compliance and Audit Database domain account field on the Configure Reports page. +If you enter a group in this field, the value that you specify in the Compliance and Audit Database domain account field on the Configure Reports page must be a member of the group that you specify in this field. |
+
Field | +Description | +
---|---|
SQL Server name |
+ Name of the server where you are configuring the Recovery Database. +
+ Note
+
+ You must add an exception on the Recovery Database computer to enable inbound traffic on the Microsoft SQL Server port. The default port number is 1433. +
+
+ |
+
SQL Server database instance |
+ Name of the database instance where the recovery data will be stored. You must also specify where the database information will be located. |
+
Database name |
+ Name of the database that will store the recovery data. +
+ Note
+
+ If you are upgrading from a previous version of MBAM, you must use the same database name as the name that was used in your previous deployment. +
+
+ |
+
Read/write access domain user or group |
+ Domain user or group that has read/write permission to this database to enable the web applications to access the data and reports in this database. +If you enter a user in this field, it must be the same value as the value in the Web service application pool domain account field on the Configure Web Applications page. +If you enter a group in this field, the value in the Web service application pool domain account field on the Configure Web Applications page must be a member of the group you enter in this field. |
+
Step | +Where to get instructions | +
---|---|
Review the recommended architecture for MBAM. |
+[High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) |
+
Review the supported configurations for MBAM. |
+[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) |
+
Complete the required prerequisites on each server. |
+
|
+
Install the MBAM Server software on each server where you plan to configure an MBAM Server feature. |
+[Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md) |
+
Review the prerequisites for using Windows PowerShell if you plan to use Windows PowerShell cmdlets to configure MBAM Server features. |
+[Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) |
+
Field | +Description | +
---|---|
SQL Server Reporting Services instance |
+ Instance of SQL Server Reporting Services where the Reports will be configured. |
+
Reporting role domain group |
+ Name of the domain Users group whose members have rights to access the reports on the Administration and Monitoring Server. |
+
SQL Server name |
+ Name of the server where the Compliance and Audit Database is configured. |
+
SQL Server database instance |
+ Name of the instance of SQL Server (for example, MSSQLSERVER) where the Compliance and Audit Database is configured. +
+ Note
+
+ You must add an exception on the Reports computer to enable inbound traffic on the port of the Reporting Server (the default port is 80). +
+
+ |
+
Database name |
+ Name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status, although you can change the name when you configure the Compliance and Audit Database. +
+ Note
+
+ If you are upgrading from a previous version of MBAM, you must use the same database name as the name used in your previous deployment. +
+
+ |
+
Compliance and Audit Database domain account |
+ Domain user account and password to access the Compliance and Audit Database. +If the value you enter in the Read-only access domain user or group field on the Configure Databases page is a user, you must enter that same value in this field. +If the value that you enter in the Read-only access domain user or group field on the Configure Databases page is a group, the value that you enter in this field must be a member of that group. +Configure the password for this account to never expire. The user account should be able to access all data that is available to the MBAM Reports Users group. |
+
Step | +Where to get instructions | +
---|---|
Review the recommended architecture for MBAM. |
+[High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology](high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md) |
+
Review the supported configurations for MBAM. |
+[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) |
+
Complete the required prerequisites on each server. |
+
|
+
Install the MBAM Server software on each server where you will configure an MBAM Server feature. +
+Note
+
+For this topology, you must install the Configuration Manager console on the computer where you are installing the MBAM Server software. +
+
+ |
+[Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md) |
+
Review Windows PowerShell prerequisites (applicable only if you are going to use Windows PowerShell cmdlets to configure MBAM). |
+[Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) |
+
Field | +Description | +
---|---|
SQL Server Reporting Services server |
+ Fully qualified domain name (FQDN) of the server with the Reporting Service point role. This is the server to which the MBAM Configuration Manager Reports are deployed. +If you don’t specify a server, the Configuration Manager Reports will be deployed to the local server. |
+
SQL Server Reporting Services instance |
+ Name of the SQL Server Reporting Services (SSRS) instance where the Configuration Manager Reports are deployed. +If you don’t specify an instance, the Configuration Manager Reports will be deployed to the default SSRS instance name. The value you enter is ignored if the server has System Center 2012 Configuration Manager installed. |
+
Website | +Description | +
---|---|
Administration and Monitoring Website |
+Website where specified users can view reports and help end users recover their computers when they forget their PIN or password |
+
Self-Service Portal |
+Website that end users can access to independently regain access to their computers if they forget their PIN or password |
+
Step | +Where to get instructions | +
---|---|
Review the recommended architecture for MBAM. |
+[High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) |
+
Review the supported configurations for MBAM. |
+[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) |
+
Complete the required prerequisites on each server. +
+Note
+
+Ensure that you configure SQL ServerReporting Services (SSRS) to use the Secure Sockets Layer (SSL) before you configure the Administration and Monitoring Website. Otherwise, the Reports feature will use HTTP instead of HTTPS. +
+
+ |
+
|
+
Register service principal names (SPNs) for the application pool account for the websites. You need to do this step only if you do not have administrative domain rights in Active Directory Domain Services (AD DS). If you do have these rights in AD DS, MBAM will create the SPNs for you. |
+[Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md#bkmk-regvirtualspn) |
+
Install the MBAM Server software on each server where you will configure an MBAM Server feature. +
+Note
+
+If you plan to install the websites on one server and the web services on another, you will be able to configure them only by using the Enable-MbamWebApplication Windows PowerShell cmdlet. The MBAM Server Configuration wizard does not support configuring these items on separate servers. +
+
+ |
+[Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md) |
+
Review the prerequisites for using Windows PowerShell if you plan to use cmdlets to configure MBAM Server features. |
+[Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) |
+
Field | +Description | +
---|---|
Security certificate |
+ Select a previously created certificate to optionally encrypt the communication between the web services and the server on which you are configuring the websites. If you choose Do not use a certificate, your web communication may not be secure. |
+
Host name |
+ Name of the host computer where you are configuring the websites. |
+
Installation path |
+ Path where you are installing the websites. |
+
Port |
+ Port number to use for website and service communication. +
+ Note
+
+ You must set a firewall exception to enable communication through the specified port. +
+
+ |
+
Web service application pool domain account and password |
+ Domain user account and password for the web service application pool. +If you enter a user name in the Read/write access domain user or group field on the Configure Databases page, you must enter that same value in this field. +If you enter a group name in the Read/write access domain user or group field on the Configure Databases page, the value you enter in this field must be a member of that group. +If you do not specify credentials, the credentials that were specified for any previously enabled web application will be used. All web applications must use the same application pool credentials. If you specify different credentials for different web applications, the most recently specified value will be used. +
+ Important
+
+ For improved security, set the account that is specified in the credentials to have limited user rights. Also, set the password of the account to never expire. +
+
+ |
+
Field | +Description | +
---|---|
SQL Server name |
+ Name of the server where the Compliance and Audit Database is configured. |
+
SQL Server database instance |
+ SQL Server instance name where the Compliance and Audit Database is configured. |
+
Database name |
+ Name of the Compliance and Audit Database. |
+
Field | +Description | +
---|---|
SQL Server name |
+ Name of the server where the Recovery Database is configured. |
+
SQL Server database instance |
+ SQL Server instance name where the Recovery Database is configured. |
+
Database name |
+ Name of the Recovery Database. |
+
Field | +Description | +||||||
---|---|---|---|---|---|---|---|
Advanced Helpdesk role domain group |
+ Domain user group whose members have access to all areas of the Administration and Monitoring Website except the Reports area. |
+ ||||||
Helpdesk role domain group |
+ Domain user group whose members have access to the Manage TPM and Drive Recovery areas of the Administration and Monitoring Website. |
+ ||||||
Use System Center Configuration Manager Integration |
+ Select this check box if you are configuring MBAM with the Configuration Manager Integration topology. Selecting this check box makes all reports, except the Recovery Audit report, appear in Configuration Manager instead of in the Administration and Monitoring Website. |
+ ||||||
Reporting role domain group |
+ Domain user group whose members have read-only access to the Reports area of the Administration and Monitoring Website. |
+ ||||||
SQL Server Reporting Services URL |
+ URL for the SSRS server where the MBAM Reports are configured. +Examples of report URLs: +
|
+ ||||||
Virtual directory |
+ Virtual directory of the Administration and Monitoring Website. This name corresponds to the website’s physical directory on the server and is appended to the website’s host name, for example: +http(s)://<hostname>:<port>/HelpDesk/ +If you do not specify a virtual directory, the value HelpDesk will be used. |
+ ||||||
Data Migration role domain group (optional) |
+ Domain user group whose members have access to use the Write-Mbam*Information Cmdlets to write recovery information via this endpoint. |
+
Field | +Description | +
---|---|
Virtual directory |
+ Virtual directory of the web application. This name corresponds to the website’s physical directory on the server, and is appended to the website’s host name, for example: +http(s)://<hostname>:<port>/SelfService/ +If you do not specify a virtual directory, the value SelfService will be used. |
+
Company name |
+ Specify a company name for the Self-Service Portal, for example: +Contoso IT +This company name is viewed by all Self-Service Portal users. |
+
Helpdesk URL text |
+ Specify a text statement that directs users to your organization's Helpdesk website, for example: +Contact Helpdesk or IT department |
+
Helpdesk URL |
+ Specify the URL for your organization's Helpdesk website, for example: +http(s)://<companyHelpdeskURL>/ |
+
Notice text file |
+ Select a file that contains the notice you want displayed to users on the Self-Service Portal landing page. |
+
Do not display notice text to users |
+ Select this check box to specify that the notice text is not displayed to users. |
+
Install the MBAM Client software by using | +Example | +
---|---|
MBAMClientSetup.exe |
+MbamClientSetup.exe OPTIN_FOR_MICROSOFT_UPDATES=1 |
+
msiexec /i MBAMClient.msi |
+msiexec /i MBAMClient.msi OPTIN_FOR_MICROSOFT_UPDATES=1 |
+
Parameter | +Description | +
---|---|
RecoveryServiceEndPoint |
+ A string specifying the MBAM recovery service endpoint. |
+
Common return values | +Error message | +
---|---|
S_OK +0 (0x0) |
+ The method was successful |
+
MBAM_E_TPM_NOT_PRESENT +2147746304 (0x80040200) |
+ TPM is not present in the computer or is disabled in the BIOS configuration. |
+
MBAM_E_TPM_INCORRECT_STATE +2147746305 (0x80040201) |
+ TPM is not in the correct state (enabled, activated and owner installation allowed). |
+
MBAM_E_TPM_AUTO_PROVISIONING_PENDING +2147746306 (0x80040202) |
+ MBAM cannot take ownership of TPM because auto-provisioning is pending. Try again after auto-provisioning is completed. |
+
MBAM_E_TPM_OWNERAUTH_READFAIL +2147746307 (0x80040203) |
+ MBAM cannot read the TPM owner authorization value. The value might have been removed after a successful escrow. On Windows 7, MBAM cannot read the value if the TPM is owned by others. |
+
MBAM_E_REBOOT_REQUIRED +2147746308 (0x80040204) |
+ The computer must be restarted to set TPM to the correct state. You might need to manually reboot the computer. |
+
MBAM_E_SHUTDOWN_REQUIRED +2147746309 (0x80040205) |
+ The computer must be shut down and turned back on to set TPM to the correct state. You might need to manually reboot the computer. |
+
WS_E_ENDPOINT_ACCESS_DENIED +2151481349 (0x803D0005) |
+ Access was denied by the remote endpoint. |
+
WS_E_ENDPOINT_NOT_FOUND +2151481357 (0x803D000D) |
+ The remote endpoint does not exist or could not be located. |
+
WS_E_ENDPOINT_FAILURE +2151481357 (0x803D000F) |
+ The remote endpoint could not process the request. |
+
WS_E_ENDPOINT_UNREACHABLE +2151481360 (0x803D0010) |
+ The remote endpoint was not reachable. |
+
WS_E_ENDPOINT_FAULT_RECEIVED +2151481363 (0x803D0013) |
+ A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint. |
+
WS_E_INVALID_ENDPOINT_URL +2151481376 (0x803D0020) |
+ The endpoint address URL is not valid. The URL must start with “http” or “https”. |
+
Parameter | +Description | +
---|---|
ReportingServiceEndPoint |
+ A string specifying the MBAM status reporting service endpoint. |
+
Common return values | +Error message | +
---|---|
S_OK +0 (0x0) |
+ The method was successful |
+
WS_E_ENDPOINT_ACCESS_DENIED +2151481349 (0x803D0005) |
+ Access was denied by the remote endpoint. |
+
WS_E_ENDPOINT_NOT_FOUND +2151481357 (0x803D000D) |
+ The remote endpoint does not exist or could not be located. |
+
WS_E_ENDPOINT_FAILURE +2151481357 (0x803D000F) |
+ The remote endpoint could not process the request. |
+
WS_E_ENDPOINT_UNREACHABLE +2151481360 (0x803D0010) |
+ The remote endpoint was not reachable. |
+
WS_E_ENDPOINT_FAULT_RECEIVED +2151481363 (0x803D0013) |
+ A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint. |
+
WS_E_INVALID_ENDPOINT_URL +2151481376 (0x803D0020) |
+ The endpoint address URL is not valid. The URL must start with “http” or “https”. |
+
Parameter | +Description | +
---|---|
RecoveryServiceEndPoint |
+ A string specifying the MBAM recovery service endpoint. |
+
Common return values | +Error message | +
---|---|
S_OK +0 (0x0) |
+ The method was successful |
+
FVE_E_LOCKED_VOLUME +2150694912 (0x80310000) |
+ The volume is locked. |
+
FVE_E_PROTECTOR_NOT_FOUND +2150694963 (0x80310033) |
+ A Numerical Password protector was not found for the volume. |
+
WS_E_ENDPOINT_ACCESS_DENIED +2151481349 (0x803D0005) |
+ Access was denied by the remote endpoint. |
+
WS_E_ENDPOINT_NOT_FOUND +2151481357 (0x803D000D) |
+ The remote endpoint does not exist or could not be located. |
+
WS_E_ENDPOINT_FAILURE +2151481357 (0x803D000F) |
+ The remote endpoint could not process the request. |
+
WS_E_ENDPOINT_UNREACHABLE +2151481360 (0x803D0010) |
+ The remote endpoint was not reachable. |
+
WS_E_ENDPOINT_FAULT_RECEIVED +2151481363 (0x803D0013) |
+ A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint. |
+
WS_E_INVALID_ENDPOINT_URL +2151481376 (0x803D0020) |
+ The endpoint address URL is not valid. The URL must start with “http” or “https”. |
+
-RecoveryServiceEndpoint |
+ Required |
+ MBAM recovery service endpoint |
+
-StatusReportingServiceEndpoint |
+ Optional |
+ MBAM status reporting service endpoint |
+
-EncryptionMethod |
+ Optional |
+ Encryption method (default: AES 128) |
+
-EncryptAndEscrowDataVolume |
+ Switch |
+ Specify to encrypt data volume(s) and escrow data volume recovery key(s) |
+
-WaitForEncryptionToComplete |
+ Switch |
+ Specify to wait for the encryption to complete |
+
-DoNotResumeSuspendedEncryption |
+ Switch |
+ Specify that the deployment script will not resume suspended encryption |
+
-IgnoreEscrowOwnerAuthFailure |
+ Switch |
+ Specify to ignore TPM owner-auth escrow failure. It should be used in the scenarios where MBAM is not able to read the TPM owner-auth, e.g. if TPM auto provisioning is enabled |
+
-IgnoreEscrowRecoveryKeyFailure |
+ Switch |
+ Specify to ignore volume recovery key escrow failure |
+
-IgnoreReportStatusFailure |
+ Switch |
+ Specify to ignore status reporting failure |
+
Task | +Details | +
---|---|
Create an infrastructure to support exempted users. |
+Examples of this infrastructure include providing users with a contact telephone number, webpage, or mailing address that they can use to request an exemption. |
+
Add the exempted user to a security group for a Group Policy Object that is configured specifically for exempted users. |
+When members of this security group sign in to a computer, the user’s Group Policy setting exempts the user from BitLocker protection. The user’s Group Policy setting overwrites the computer policy, and the computer will remain exempt from BitLocker encryption. +
+Note
+
+MBAM does not enact the encryption policy if the computer is already BitLocker-protected and the user is exempted. However, if another user who is not exempt from the encryption policy signs in to the computer, encryption will take place. +
+
+ |
+
Task | +Details | +
---|---|
Create an infrastructure to support exempted users. |
+Examples of this infrastructure include providing users with a contact telephone number, webpage, or mailing address that they can use to request an exemption. |
+
Add the exempted user to a security group for a Group Policy Object that is configured specifically for exempted users. |
+When members of this security group sign in to a computer, the user’s Group Policy setting exempts the user from BitLocker protection. The user’s Group Policy setting overwrites the computer policy, and the computer will remain exempt from BitLocker encryption. +
+Note
+
+If the computer is already BitLocker-protected, the User Exemption Policy has no effect. In addition, if another user signs in to a computer that is not exempt from the encryption policy, encryption will take place. +
+
+ |
+
Parameter | +Description | +
---|---|
$SERVERNAME$ |
+ Name of the server to which the files will be copied. |
+
$DESTINATIONSHARE$ |
+ Name of the share and path to which the files will be copied. |
+
Parameter | +Description | +
---|---|
$SERVERNAME$\$SQLINSTANCENAME$ |
+ Server name and instance of SQL Server where the Recovery Database is located. |
+
$DATABASE$ |
+ Name of the Recovery database. |
+
Parameter | +Description | +
---|---|
$SERVERNAME$ |
+ Name of the server to which the files will be copied. |
+
$DESTINATIONSHARE$ |
+ Name of the share and path to which the files will be copied. |
+
Parameter | +Description | +
---|---|
$SERVERNAME$\$SQLINSTANCENAME$ |
+ Server name and instance of SQL Server where the Recovery Database is located. |
+
$DATABASE$ |
+ Name of the recovered database. |
+
Parameter | +Description | +
---|---|
$SERVERNAME$ |
+ Name of the server to which the Reports were moved. |
+
$SRSINSTANCENAME$ |
+ Name of the instance of SQL Server Reporting Services to which the Reports were moved. |
+
Task | +Details and more information | +
---|---|
Create a recovery key package file by accessing the Drive Recovery area of the Administration and Monitoring Website. |
+To access the Drive Recovery area, you must be assigned the MBAM Helpdesk Users role or the MBAM Advanced Helpdesk Users role. You may have given these roles different names when you created them. For more information, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md#bkmk-helpdesk-roles). |
+
Copy the package file to the computer that contains the corrupted drive. |
++ |
Use the |
+To avoid a potential loss of data, it is strongly recommended that you review the [Manage-bde](http://go.microsoft.com/fwlink/?LinkId=393567) command before using it. |
+
Name | +Default value | +
---|---|
ClientValidationEnabled |
+ true |
+
CompanyName |
+ Contoso IT |
+
DisplayNotice |
+ true |
+
HelpdeskText |
+ Contact Helpdesk or IT Department |
+
HelpdeskUrl |
+ # +
+ Note
+
+ In MBAM 2.5 SP1, the HelpdeskUrl default value is empty. +
+
+ |
+
jQueryPath |
+ [//go.microsoft.com/fwlink/?LinkID=390515](//go.microsoft.com/fwlink/?LinkID=390515) +
+ Note
+
+ In MBAM 2.5 SP1, this has been changed to a local JavaScript file shipped with the product, located at ~/Scripts/jquery-1.10.2.min.js +
+
+ |
+
jQueryValidatePath |
+ [//go.microsoft.com/fwlink/?LinkID=390516](//go.microsoft.com/fwlink/?LinkID=390516) +
+ Note
+
+ In MBAM 2.5 SP1, this has been changed to a local JavaScript file shipped with the product, located at ~/Scripts/jquery.validate.min.js +
+
+ |
+
jQueryValidateUnobtrusivePath |
+ [//go.microsoft.com/fwlink/?LinkID=390517](//go.microsoft.com/fwlink/?LinkID=390517) +
+ Note
+
+ In MBAM 2.5 SP1, this has been changed to a local JavaScript file shipped with the product, located at ~/Scripts/jquery.validate.unobtrusive.min.js +
+
+ |
+
NoticeTextPath |
+ Notice.txt +
+ Note
+
+ You can edit the notice text either by using the Internet Information Services (IIS) Manager or by opening and changing the Notice.txt file in the installation directory. +
+
+ |
+
UnobtrusiveJavaScriptEnabled |
+ true |
+
Account | +Description | +
---|---|
MBAM Advanced Helpdesk Users |
+Provides access to all areas of the Administration and Monitoring Website. Users who have this role enter only the recovery key, and not the end user’s domain and user name, when helping end users recover their drives. If a user is a member of both the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Users Group permissions. + |
+
MBAM Helpdesk Users |
+Provides access to the Manage TPM and Drive Recovery areas of the Administration and Monitoring Website. Individuals who have this role must fill in all fields, including the end-user’s domain and account name, when they use either area. +If a user is a member of both the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Users Group permissions. |
+
MBAM Report Users |
+Provides access to the reports in the Reports area of the Administration and Monitoring Website. |
+
Task | +Area of the Website where you access the task | +Description | +For more information | +
---|---|---|---|
View reports |
+Reports |
+Enables you to run reports to monitor BitLocker usage, compliance, and key recovery activity. Reports provide data about enterprise compliance, individual computers, and who requested recovery keys or the TPM OwnerAuth package for a specific computer. |
+[Viewing MBAM 2.5 Reports for the Stand-alone Topology](viewing-mbam-25-reports-for-the-stand-alone-topology.md) |
+
Determine the BitLocker encryption status of lost or stolen computers |
+Reports |
+Determine if a volume was encrypted if the computer is lost or stolen. |
+[How to Determine BitLocker Encryption State of Lost Computers](how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-25.md) |
+
Recover lost drives |
+Drive Recovery |
+Recover drives that are: +
|
+
|
+
Reset a TPM lockout |
+Manage TPM |
+Provides access to TPM data that has been collected by the MBAM Client. In a TPM lockout, use the Administration and Monitoring Website to retrieve the necessary password file to unlock the TPM. |
+[How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-25.md) |
+
Before you start | +Description | +
---|---|
Review the MBAM 2.5 planning information |
+
|
+
Read how to get log files |
+By default, log files are created in the local computer’s %temp% folder. To write the log files to a specific location rather than to the %temp% folder, use the /log <location> argument. +Additional events might be logged in Event Viewer in the MBAM-Setup or MBAM-Web nodes under Applications and Services Logs > Microsoft > Windows. For example, if you uninstall MBAM, the uninstaller will also uninstall the MBAM-Setup and MBAM-Web logs in EventViewer. |
+
Parameter | +Parameter value | +Description | +
---|---|---|
CEIPENABLED |
+True False |
+True - participate in the Customer Improvement Experience Program, which helps Microsoft identify which MBAM features to improve. +False – do not participate in the Customer Improvement Experience Program. |
+
OPTIN_FOR_MICROSOFT_UPDATES |
+True False |
+True - use Microsoft Update to keep your computer secure and up-to-date for Windows and other Microsoft products, including MBAM. +False – do not use Microsoft Update |
+
INSTALLDIR |
+<Path> |
+Location where you want to install MBAM. +Example: +INSTALLDIR=c:\mbaminstall |
+
FORCE_UNINSTALL |
+True False |
+True - continue the process of uninstalling MBAM, even if any features fail to be removed. +False (default) if the uninstallation custom action fails to remove an added MBAM Server feature, the uninstallation fails, and MBAM remains installed. +In both instances, any features that were successfully removed during the attempt to uninstall MBAM stay removed. |
+
+ | Task | +References | +Notes | +
---|---|---|---|
![]() |
+Review and complete all planning steps to prepare your environment for MBAM deployment. |
+[MBAM 2.5 Planning Checklist](mbam-25-planning-checklist.md) |
++ |
![]() |
+Review the supported configurations information to ensure that MBAM supports the selected client and server computers. |
+[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) |
++ |
![]() |
+Install the MBAM Server software. |
+[Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md) |
++ |
![]() |
+Configure the MBAM Server features: +
+Note
+
+Note the names of the servers on which you configure each feature. You will use this information throughout the configuration process. +
+
+ |
+[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) |
++ |
![]() |
+Validate the MBAM configuration. |
+[Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md) |
++ |
![]() |
+Copy the MBAM Group Policy Template and edit the Group Policy settings. |
+[Copying the MBAM 2.5 Group Policy Templates](copying-the-mbam-25-group-policy-templates.md) and [Editing the MBAM 2.5 Group Policy Settings](editing-the-mbam-25-group-policy-settings.md) |
++ |
![]() |
+Deploy the MBAM Client software. |
+[Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) |
++ |
+ | Task | +References | +Notes | +
---|---|---|---|
![]() |
+Review the "Getting started" information to understand the product before you start deployment planning. |
+[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) |
++ |
![]() |
+Review the recommended high-level architecture for an MBAM deployment. You might also want to review an illustration and description of the individual parts (databases, websites, Reports) of an MBAM deployment. |
+[High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) +[Illustrated Features of an MBAM 2.5 Deployment](illustrated-features-of-an-mbam-25-deployment.md) |
++ |
![]() |
+Review and complete the prerequisites for the MBAM Stand-alone and Configuration Manager Integration topologies. |
+[MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md) |
++ |
![]() |
+If you plan to use the Configuration Manager Integration topology, complete the additional prerequisites that apply only to this topology. |
+[MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md) |
++ |
![]() |
+Review and meet the MBAM 2.5 prerequisites for the MBAM Client. |
+[Prerequisites for MBAM 2.5 Clients](prerequisites-for-mbam-25-clients.md) |
++ |
![]() |
+Plan for and configure MBAM Group Policy requirements. |
+[Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md) |
++ |
![]() |
+Plan for and create the necessary Active Directory Domain Services security groups. |
+[Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md) |
++ |
![]() |
+Plan how you will secure the MBAM websites. |
+[Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md) |
++ |
![]() |
+Review the MBAM Supported Configurations to ensure that your hardware meets the installation system requirements. |
+[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) |
++ |
![]() |
+Review the considerations for deploying the MBAM Server features. |
+[Planning for MBAM 2.5 Server Deployment](planning-for-mbam-25-server-deployment.md) |
++ |
![]() |
+Review the considerations for deploying the MBAM Client. |
+[Planning for MBAM 2.5 Client Deployment](planning-for-mbam-25-client-deployment.md) |
++ |
![]() |
+Review the requirements and steps to deploy MBAM in a highly available configuration. |
+[Planning for MBAM 2.5 High Availability](planning-for-mbam-25-high-availability.md) |
++ |
![]() |
+Review the MBAM security considerations that pertain to the Trusted Platform Module, log files, and transparent data encryption. |
+[MBAM 2.5 Security Considerations](mbam-25-security-considerations.md) |
++ |
![]() |
+Optionally, review the steps to evaluate MBAM in a test environment. |
+[Evaluating MBAM 2.5 in a Test Environment](evaluating-mbam-25-in-a-test-environment.md) |
++ |
Group Policy Setting | +Configuration | +
---|---|
Turn on TPM backup to Active Directory Domain Services |
+Disabled or Not Configured |
+
Configure the level of TPM owner authorization information available to the operating system |
+Delegated/None or Not Configured |
+
Entry | +Value | +
---|---|
Audit Request Source |
+Agent TPM unlock |
+
Key Type |
+TPM Password Hash |
+
Reason Description |
+TPM Reset |
+
Prerequisite | +Details | +
---|---|
Groups created in Active Directory Domain Services (AD DS) |
+See [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md) for a description of these groups and accounts. |
+
Prerequisite | +Details | +
---|---|
Supported version of SQL Server |
+Install Microsoft SQL Server with SQL_Latin1_General_CP1_CI_AS collation. +See [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) for supported versions. |
+
Required SQL Server permissions |
+Required permissions: +
|
+
Optional - Install the Transparent Data Encryption (TDE) feature available in SQL Server |
+The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with laws, regulations, and guidelines that apply to various industries. +
+Note
+
+TDE performs real-time decryption of database information. This means that, if you are viewing recovery key information in the SQL Server database and you are logged on under an account that has permissions to the database, the recovery key information is visible. To read more about TDE, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md). +
+
+ |
+
SQL Server Database Engine Services |
+SQL Server Database Engine Services must be installed and running during MBAM Server installation. |
+
Windows PowerShell 3.0 or later |
+Windows PowerShell does not have to be installed on the Recovery Database server if you are using Windows PowerShell to configure the database from a remote computer. |
+
Prerequisite | +Details | +
---|---|
Supported version of SQL Server |
+Install SQL Server with SQL_Latin1_General_CP1_CI_AS collation. +See [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) for supported versions. |
+
Required SQL Server permissions |
+Required permissions: +
|
+
Optional - Install the Transparent Data Encryption (TDE) feature in SQL Server |
+The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with laws, regulations, and guidelines that apply to various industries. +TDE performs real-time decryption of database information. This means that, if you are viewing recovery key information in the SQL Server database and you are logged on under an account that has permissions to the database, the recovery key information is visible. To read more about TDE, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md). |
+
SQL Server Database Engine Services |
+SQL Server Database Engine Services must be installed and running during MBAM Server installation. However, SQL Server can be running remotely; it doesn’t have to be on the same server on which you are installing the MBAM Server software. |
+
Windows PowerShell 3.0 or later |
+Windows PowerShell does not have to be installed on the Compliance and Audit Database server if you are using Windows PowerShell to configure the database from a remote computer. |
+
Prerequisite | +Details | +
---|---|
Supported version of SQL Server |
+Install SQL Server with SQL_Latin1_General_CP1_CI_AS collation. +See [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) for supported versions. |
+
SQL Server Reporting Services (SSRS) |
+SSRS must be installed and running during the MBAM Server installation. +Configure SSRS in "native" mode and not in unconfigured or "SharePoint" mode. |
+
SSRS instance rights – required for configuring Reports only if you are installing databases on a separate server from the server where Reports are configured. |
+Required instance rights: +
|
+
Windows PowerShell 3.0 or later |
+Windows PowerShell does not have to be installed on this Database server if you are using Windows PowerShell to configure the database from a remote computer. |
+
Prerequisite | +Details | +
---|---|
Windows Server Web Server Role |
+This role must be added to a server operating system that is supported for the Administration and Monitoring Server feature. |
+
Web Server (IIS) Management Tools |
+Click IIS Management Scripts and Tools. |
+
SSL Certificate |
+Optional. To secure communication between the client computers and the web services, you must obtain and install a certificate that a trusted security authority signed. |
+
Web Server Role Services |
+Common HTTP Features: +
Application Development: +
Security: +
|
+
Windows Server Features |
+.NET Framework 4.5 features: +
Windows Process Activation Service: +
|
+
Service Principal Name (SPN) |
+The web applications require an SPN for the virtual host name under the domain account that you use for the web application pools. +If your administrative rights permit you to create SPNs in Active Directory Domain Services, MBAM creates the SPN for you. See [Setspn](http://technet.microsoft.com/library/cc731241.aspx) for information about the rights required to create SPNs. +If you do not have administrative rights to create SPNs, you must ask the Active Directory administrators in your organization to create the SPN for you by using the following command. +
+In the code example, the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pools is contoso\mbamapppooluser. +
+Note
+
+If you are setting up Load Balancing, use the same application pool account on all servers. +
+
+
+For more information about registering SPNs for fully qualified, NetBIOS, and custom host names, see [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md). |
+
Prerequisite | +Details | +
---|---|
Supported version of Windows Server |
+See [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) for supported versions. |
+
ASP.NET MVC 4.0 |
+[ASP.NET MVC 4 download](http://go.microsoft.com/fwlink/?LinkId=392271) |
+
Web Service IIS Management Tools |
++ |
Service Principal Name (SPN) |
+The web applications require an SPN for the virtual host name under the domain account that you use for the web application pools. +If your administrative rights permit you to create SPNs in Active Directory Domain Services, MBAM creates the SPN for you. See [Setspn](http://technet.microsoft.com/library/cc731241.aspx) for information about the rights required to create SPNs. +If you do not have administrative rights to create SPNs, you must ask the Active Directory administrators in your organization administrators in your organization to create the SPN for you by using the following command. +
+In the code example, the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pools is contoso\mbamapppooluser. +
+Note
+
+If you are setting up Load Balancing, use the same application pool account on all servers. +
+
+
+For more information about registering SPNs for fully qualified, NetBIOS, and custom host names, see [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md). |
+
Prerequisite | +Details | +||||||
---|---|---|---|---|---|---|---|
Before installing the MBAM Client, download the MBAM Group Policy Templates from [How to Get MDOP Group Policy (.admx) Templates](http://go.microsoft.com/fwlink/p/?LinkId=393941) and configure them with the settings that you want to implement in your enterprise for BitLocker Drive Encryption. |
+Before installing the MBAM Client, do the following: +
|
+
Client Languages | +Server Languages | +
---|---|
Czech (Czech Republic) cs-CZ +Danish (Denmark) da-DK +Dutch (Netherlands) nl-NL +English (United States) en-US +Finnish (Finland) fi-FI +French (France) fr-FR +German (Germany) de-DE +Greek (Greece) el-GR +Hungarian (Hungary) hu-HU +Italian (Italy) it-IT +Japanese (Japan) ja-JP +Korean (Korea) ko-KR +Norwegian, Bokmål (Norway) nb-NO +Polish (Poland) pl-PL +Portuguese (Brazil) pt-BR +Portuguese (Portugal) pt-PT +Russian (Russia) ru-RU +Slovak (Slovakia) sk-SK +Spanish (Spain) es-ES +Swedish (Sweden) sv-SE +Turkish (Turkey) tr-TR +Slovenian (Slovenia) sl-SI +Simplified Chinese (PRC) zh-CN +Traditional Chinese (Taiwan) zh-TW |
+
|
+
Client Languages | +Server Languages | +
---|---|
|
+
|
+
Operating system | +Edition | +Service pack | +System architecture | +
---|---|---|---|
Windows Server 2008 R2 |
+Standard, Enterprise, or Datacenter |
+SP1 |
+64-bit |
+
Windows Server 2012 |
+Standard or Datacenter |
++ | 64-bit |
+
Windows Server 2012 R2 |
+Standard or Datacenter |
++ | 64-bit |
+
Hardware item | +Minimum requirement | +Recommended requirement | +
---|---|---|
Processor |
+2.33 GHz |
+2.33 GHz or greater |
+
RAM |
+8 GB |
+12 GB |
+
Free disk space |
+1 GB |
+2 GB |
+
Hardware item | +Minimum requirement | +Recommended requirement | +
---|---|---|
Processor |
+2.33 GHz |
+2.33 GHz or greater |
+
RAM |
+4 GB |
+8 GB |
+
Free disk space |
+1 GB |
+2 GB |
+
Supported version | +Service pack | +System architecture | +
---|---|---|
Microsoft System Center 2012 R2 Configuration Manager |
++ | 64-bit |
+
Microsoft System Center 2012 Configuration Manager |
+SP1 |
+64-bit |
+
Microsoft System Center Configuration Manager 2007 R2 or later |
+SP1 or later |
+64-bit +
+Note
+
+Although Configuration Manager 2007 R2 is 32 bit, you must install it and SQL Server on a 64-bit operating system in order to match the 64-bit MBAM software. +
+
+ |
+
SQL Server version | +Edition | +Service pack | +System architecture | +
---|---|---|---|
Microsoft SQL Server 2014 |
+Standard, Enterprise, or Datacenter |
+SP1 |
+64-bit |
+
Microsoft SQL Server 2014 |
+Standard, Enterprise, or Datacenter |
++ | 64-bit |
+
Microsoft SQL Server 2012 |
+Standard, Enterprise, or Datacenter |
+SP2 |
+64-bit |
+
Microsoft SQL Server 2012 |
+Standard, Enterprise, or Datacenter |
+SP1 |
+64-bit |
+
Microsoft SQL Server 2008 R2 |
+Standard or Enterprise |
+SP1, SP2, SP3 |
+64-bit |
+
Hardware item | +Minimum requirement | +Recommended requirement | +
---|---|---|
Processor |
+2.33 GHz |
+2.33 GHz or greater |
+
RAM |
+8 GB |
+12 GB |
+
Free disk space |
+5 GB |
+5 GB or greater |
+
Hardware item | +Minimum requirement | +Recommended requirement | +
---|---|---|
Processor |
+2.33 GHz |
+2.33 GHz or greater |
+
RAM |
+4 GB |
+8 GB |
+
Free disk space |
+5 GB |
+5 GB |
+
Operating system | +Edition | +Service pack | +System architecture | +
---|---|---|---|
Windows 10 |
+Enterprise |
++ | 32-bit or 64-bit |
+
Windows 8.1 |
+Enterprise |
++ | 32-bit or 64-bit |
+
Windows 8 |
+Enterprise |
++ | 32-bit or 64-bit |
+
Windows 7 |
+Enterprise or Ultimate |
+SP1 |
+32-bit or 64-bit |
+
Windows To Go |
+Windows 8, Windows 8.1, and Windows 10 Enterprise |
++ | 32-bit or 64-bit |
+
Operating system | +Edition | +Service pack | +System architecture | +
---|---|---|---|
Windows 10 |
+Enterprise |
++ | 32-bit or 64-bit |
+
Windows 8.1 |
+Enterprise |
++ | 32-bit or 64-bit |
+
Windows 8 |
+Enterprise, or Pro |
++ | 32-bit or 64-bit |
+
Windows 7 |
+Enterprise, or Ultimate |
+SP1 |
+32-bit or 64-bit |
+
Windows Server 2012 R2 |
+Standard or Datacenter |
++ | 64-bit |
+
Windows Server 2012 |
+Standard or Datacenter |
++ | 64-bit |
+
Windows Server 2008 R2 |
+Standard, Enterprise, or Datacenter |
+SP1 |
+64-bit |
+
Type of performance counter | +Description | +
---|---|
Total number of requests |
+Provides an incrementing count that starts from zero when the server is started or restarted. +Provides an overall view of system activity. Can be monitored by automated tools to ensure the health of the server and to validate that the counter continually increments over a specified period of time. |
+
Requests per second |
+Indicates the current throughput of the MBAM Server as it supports the MBAM client base. +Enables site administrators to: +
|
+
Request duration |
+Records the duration of requests in milliseconds. +Although this counter is updated with the duration of each request, Windows Performance Monitor samples it only periodically (typically every second), so you might see some variability in the value. For this reason, consider using the average value displayed by Performance Monitor. |
+
Type of drive or volume | +Supported BitLocker protectors | +
---|---|
Operating system volumes |
+
|
+
Fixed data drives |
+
|
+
Removable drives |
+
|
+
Steps to follow | +Where to get instructions | +
---|---|
Copy the MBAM Group Policy Templates from [How to Get MDOP Group Policy (.admx) Templates](http://go.microsoft.com/fwlink/p/?LinkId=393941) and install them on a computer that is capable of running the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM). |
+[Copying the MBAM 2.5 Group Policy Templates](copying-the-mbam-25-group-policy-templates.md) |
+
Configure the Group Policy settings that you want to use in your enterprise. |
+[Editing the MBAM 2.5 Group Policy Settings](editing-the-mbam-25-group-policy-settings.md) |
+
Policy name | +Overview and suggested Group Policy settings | +
---|---|
Choose drive encryption method and cipher strength |
+Suggested configuration: Enabled +Configure this policy to use a specific encryption method and cipher strength. +When this policy is not configured, BitLocker uses the default encryption method: AES 128-bit with Diffuser. +
+Note
+
+An issue with the BitLocker Computer Compliance report causes it to display "unknown" for the cipher strength, even if you are using the default value. To work around this issue, make sure you enable this setting and set a value for cipher strength. +
+
+
+
|
+
Prevent memory overwrite on restart |
+Suggested configuration: Not Configured +Configure this policy to improve restart performance without overwriting BitLocker secrets in memory on restart. +When this policy is not configured, BitLocker secrets are removed from memory when the computer restarts. |
+
Validate smart card certificate usage rule |
+Suggested configuration: Not Configured +Configure this policy to use smartcard certificate-based BitLocker protection. +When this policy is not configured, the default object identifier 1.3.6.1.4.1.311.67.1.1 is used to specify a certificate. |
+
Provide the unique identifiers for your organization |
+Suggested configuration: Not Configured +Configure this policy to use a certificate-based data recovery agent or the BitLocker To Go reader. +When this policy is not configured, the Identification field is not used. +If your company requires higher security measurements, you can configure the Identification field to make sure that all USB devices have this field set and that they are aligned with this Group Policy setting. |
+
Policy name | +Overview and suggested Group Policy settings | +
---|---|
Configure MBAM Services |
+Suggested configuration: Enabled +
|
+
Configure user exemption policy |
+Suggested configuration: Not Configured +This policy setting lets you configure a website address, email address, or phone number that instructs a user to request an exemption from BitLocker encryption. +If you enable this policy setting and provide a website address, email address, or phone number, users see a dialog box with instructions on how to apply for an exemption from BitLocker protection. For more information about enabling BitLocker encryption exemptions for users, see [How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-25.md). +If you either disable or do not configure this policy setting, the exemption request instructions are not displayed to users. +
+Note
+
+User exemption is managed per user, not per computer. If multiple users log on to the same computer and any one user is not exempt, the computer is encrypted. +
+
+ |
+
Configure customer experience improvement program |
+Suggested configuration: Enabled +This policy setting lets you configure how MBAM users can join the Customer Experience Improvement Program. This program collects information about computer hardware and how users use MBAM without interrupting their work. The information helps Microsoft to identify which MBAM features to improve. Microsoft does not use this information to identify or contact MBAM users. +If you enable this policy setting, users can join the Customer Experience Improvement Program. +If you disable this policy setting, users cannot join the Customer Experience Improvement Program. +If you do not configure this policy setting, users have the option to join the Customer Experience Improvement Program. |
+
Provide the URL for the Security Policy link |
+Suggested configuration: Enabled +Use this policy setting to specify a URL that is displayed to end users as a link named "Company Security Policy." The link points to your company’s internal security policy and provides end users with information about encryption requirements. The link appears when users are prompted by MBAM to encrypt a drive. +If you enable this policy setting, you can configure the URL for the Security Policy link. +If you disable or do not configure this policy setting, the Security Policy link is not displayed to users. |
+
Policy name | +Overview and suggested Group Policy settings | +
---|---|
Fixed data drive encryption settings |
+Suggested configuration: Enabled +This policy setting lets you manage whether fixed data drives must be encrypted. +If the operating system volume is required to be encrypted, click Enable auto-unlock fixed data drive. +When you enable this policy, you must not disable the Configure use of password for fixed data drives policy unless you are enabling or requiring the use of auto-unlock for fixed data drives. +If you have to use auto-unlock for fixed data drives, you must configure operating system volumes to be encrypted. +If you enable this policy setting, users are required to put all fixed data drives under BitLocker protection, and the data drives are then encrypted. +If you do not configure this policy setting, users are not required to put fixed data drives under BitLocker protection. If you apply this policy after fixed data drives are encrypted, the MBAM agent decrypts the encrypted fixed data drives. +If you disable this policy setting, users cannot put their fixed data drives under BitLocker protection. |
+
Deny write access to fixed drives not protected by BitLocker |
+Suggested configuration: Not Configured +This policy setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer. This policy setting is applied when you turn on BitLocker. +When the policy is not configured, all fixed data drives on the computer are mounted with read/write permission. |
+
Allow access to BitLocker-protected fixed drives from earlier versions of Windows |
+Suggested configuration: Not Configured +Enable this policy so that fixed drives with the FAT file system can be unlocked and viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. +When the policy is enabled or not configured, fixed drives that are formatted with the FAT file system can be unlocked and their content can be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. These operating systems have read-only permission to BitLocker-protected drives. +When the policy is disabled, fixed drives that are formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. |
+
Configure use of password for fixed drives |
+Suggested configuration: Not Configured +Use this policy to specify whether a password is required to unlock BitLocker-protected fixed data drives. +If you enable this policy setting, users can configure a password that meets the requirements that you define. BitLocker enables users to unlock a drive with any of the protectors that are available on the drive. +These settings are enforced when you turn on BitLocker, not when you unlock a volume. +If you disable this policy setting, users are not allowed to use a password. +When the policy is not configured, passwords are supported with the default settings, which do not include password complexity requirements and which require only eight characters. +For higher security, enable this policy, and then select Require password for fixed data drive, click Require password complexity, and set the minimum password length that you want. +If you disable this policy setting, users are not allowed to use a password. +If you do not configure this policy setting, passwords are supported with the default settings, which do not include password complexity requirements and which require only eight characters. |
+
Choose how BitLocker-protected fixed drives can be recovered |
+Suggested configuration: Not Configured +Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS). +When the policy is not configured, the BitLocker data recovery agent is allowed, and recovery information is not backed up to AD DS. MBAM does not require recovery information to be backed up to AD DS. |
+
Encryption Policy Enforcement Settings |
+Suggested configuration: Enabled +Use this policy setting to configure the number of days that fixed data drives can remain noncompliant until they are forced to comply with MBAM policies. Users cannot postpone the required action or request an exemption from it after the grace period. The grace period starts when the fixed data drive is determined to be noncompliant. However, the fixed data drive policy is not enforced until the operating system drive is compliant. +If the grace period expires and the fixed data drive is still not compliant, users do not have the option to postpone or to request an exemption. If the encryption process requires user input, a dialog box appears that users cannot close until they provide the required information. +Enter 0 in the Configure the number of noncompliance grace period days for fixed drives to force the encryption process to begin immediately after the grace period expires for the operating system drive. +If you disable or do not configure this setting, users are not forced to comply with MBAM policies. +If no user interaction is required to add a protector, encryption begins in the background after the grace period expires. |
+
Policy name | +Overview and suggested Group Policy settings | +
---|---|
Operating system drive encryption settings |
+Suggested configuration: Enabled +This policy setting lets you manage whether the operating system drive must be encrypted. +For higher security, consider disabling the following policy settings in System > Power Management > Sleep Settings when you enable them with TPM + PIN protector: +
If you are running Microsoft Windows 8 or later, and you want to use BitLocker on a computer without a TPM, select the Allow BitLocker without a compatible TPM check box. In this mode, a password is required for startup. If you forget the password, you have to use one of the BitLocker recovery options to access the drive. +On a computer with a compatible TPM, two types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require the entry of a personal identification number (PIN). +If you enable this policy setting, users have to put the operating system drive under BitLocker protection, and the drive is then encrypted. +If you disable this policy, users cannot put the operating system drive under BitLocker protection. If you apply this policy after the operating system drive is encrypted, the drive is then decrypted. +If you do not configure this policy, the operating system drive is not required to be placed under BitLocker protection. |
+
Allow enhanced PINs for startup |
+Suggested configuration: Not Configured +Use this policy setting to configure whether enhanced startup PINs are used with BitLocker. Enhanced startup PINs permit the use of characters including uppercase and lowercase letters, symbols, numbers, and spaces. This policy setting is applied when you turn on BitLocker. +If you enable this policy setting, all new BitLocker startup PINs set will enable end user to create enhanced PINs. However, not all computers can support enhanced PINs in the pre-boot environment. We strongly recommend that administrators evaluate whether their systems are compatible with this feature before enabling its use. +Select the Require ASCII-only PINs check box to help make enhanced PINs more compatible with computers that limit the type or number of characters that can be entered in the pre-boot environment. +If you disable or do not configure this policy setting, enhanced PINs are not used. |
+
Choose how BitLocker-protected operating system drives can be recovered |
+Suggested configuration: Not Configured +Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS). +When this policy is not configured, the data recovery agent is allowed, and recovery information is not backed up to AD DS. +MBAM operation does not require recovery information to be backed up to AD DS. |
+
Configure use of passwords for operating system drives |
+Suggested configuration: Not Configured +Use this policy setting to set the constraints for passwords that are used to unlock BitLocker-protected operating system drives. If non-TPM protectors are allowed on operating system drives, you can provision a password, enforce complexity requirements on the password, and configure a minimum length for the password. For the complexity requirement setting to be effective, you must also enable the Group Policy setting "Password must meet complexity requirements" located in Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy. +
+Note
+
+These settings are enforced when you turn on BitLocker, not when you unlock a volume. BitLocker lets you unlock a drive with any of the protectors that are available on the drive. +
+
+
+If you enable this policy setting, users can configure a password that meets the requirements that you define. To enforce complexity requirements on the password, click Require password complexity. |
+
Configure TPM platform validation profile for BIOS-based firmware configurations |
+Suggested configuration: Not Configured +This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection. +
+Important
+
+This Group Policy setting applies only to computers with BIOS configurations or to computers with UEFI firmware with a Compatibility Service Module (CSM) enabled. Computers that use a native UEFI firmware configuration store different values into the Platform Configuration Registers (PCRs). Use the "Configure TPM platform validation profile for native UEFI firmware configurations" Group Policy setting to configure the TPM PCR profile for computers that use native UEFI firmware. +
+
+
+If you enable this policy setting before you turn on BitLocker, you can configure the boot components that the TPM validates before you unlock access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive and the computer instead displays the BitLocker Recovery console and requires that you provide either the recovery password or recovery key to unlock the drive. +If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile or the platform validation profile that is specified by the Setup script. |
+
Configure TPM platform validation profile |
+Suggested configuration: Not Configured +This policy setting enables you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection. +If you enable this policy setting before you turn on BitLocker, you can configure the boot components that the TPM validates before you unlock access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive and the computer instead displays the BitLocker Recovery console and requires that you provide either the recovery password or recovery key to unlock the drive. +If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script. |
+
Configure TPM platform validation profile for native UEFI firmware configurations |
+Suggested configuration: Not Configured +This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection. +
+Important
+
+This Group Policy setting applies only to computers with a native UEFI firmware configuration. +
+
+
+If you enable this policy setting before you turn on BitLocker, you can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive and the computer instead displays the BitLocker Recovery console and requires that you provide either the recovery password or recovery key to unlock the drive. +If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script. |
+
Reset platform validation data after BitLocker recovery |
+Suggested configuration: Not Configured +Use this policy setting to control whether platform validation data is refreshed when Windows is started after BitLocker recovery. +If you enable this policy setting, platform validation data are refreshed when Windows is started after BitLocker recovery. If you disable this policy setting, platform validation data are not refreshed when Windows is started after BitLocker recovery. If you do not configure this policy setting, platform validation data are refreshed when Windows is started after BitLocker recovery. |
+
Use enhanced Boot Configuration Data validation profile |
+Suggested configuration: Not Configured +This policy setting allows you to choose specific Boot Configuration Data (BCD) settings to verify during platform validation. +If you enable this policy setting, you can add additional settings, remove the default settings, or both. If you disable this policy setting, the computer reverts to a BCD profile similar to the default BCD profile that is used by Windows 7. If you do not configure this policy setting, the computer verifies the default Windows BCD settings. +
+Note
+
+When BitLocker uses Secure Boot for platform and Boot Configuration Data (BCD) integrity validation, as defined by the "Allow Secure Boot for integrity validation" policy, the "Use enhanced Boot Configuration Data validation profile" policy is ignored. +
+
+
+The setting that controls boot debugging (0x16000010) is always validated and has no effect if it is included in the provided fields. |
+
Encryption Policy Enforcement Settings |
+Suggested configuration: Enabled +Use this policy setting to configure the number of days that users can postpone complying with MBAM policies for their operating system drive. The grace period begins when the operating system is first detected as noncompliant. After this grace period expires, users cannot postpone the required action or request an exemption from it. +If the encryption process requires user input, a dialog box appears that users cannot close until they provide the required information. +If you disable or do not configure this setting, users are not forced to comply with MBAM policies. +If no user interaction is required to add a protector, encryption begins in the background after the grace period expires. |
+
Configure pre-boot recovery message and URL |
+Suggested configuration: Not Configured +Enable this policy setting to configure a custom recovery message or to specify a URL that is then displayed on the pre-boot BitLocker recovery screen when the OS drive is locked. This setting is only available on client computers running Windows 10. +When this policy is enabled, you can select one of these options for the pre-boot recovery message: +
+Note
+
+Not all characters and languages are supported in pre-boot. We recommend that you test that the characters you use for the custom message or URL appear correctly on the pre-boot BitLocker recovery screen. +
+
+ |
+
Policy name | +Overview and suggested Group Policy settings | +
---|---|
Control use of BitLocker on removable drives |
+Suggested configuration: Enabled +This policy controls the use of BitLocker on removable data drives. +Click Allow users to apply BitLocker protection on removable data drives to allow users to run the BitLocker setup wizard on a removable data drive. +Click Allow users to suspend and decrypt BitLocker on removable data drives to enable users to remove BitLocker drive encryption from the drive or to suspend the encryption while maintenance is performed. +When this policy is enabled, and you click Allow users to apply BitLocker protection on removable data drives, the MBAM Client saves the recovery information about removable drives to the MBAM key recovery server and allows users to recover the drive if the password is lost. |
+
Deny write access to removable drives not protected by BitLocker |
+Suggested configuration: Not Configured +Enable this policy to allow only write permission to BitLocker-protected drives. +When this policy is enabled, all removable data drives on the computer require encryption before write permission is allowed. |
+
Allow access to BitLocker-protected removable drives from earlier versions of Windows |
+Suggested configuration: Not Configured +Enable this policy to allow fixed drives with the FAT file system to be unlocked and viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. +When this policy is not configured, removable drives that are formatted with the FAT file system can be unlocked on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have read-only permission to BitLocker-protected drives. +When the policy is disabled, removable drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. |
+
Configure use of password for removable data drives |
+Suggested configuration: Not Configured +Enable this policy to configure password protection on removable data drives. +When this policy is not configured, passwords are supported with the default settings, which do not include password complexity requirements and which require only eight characters. +For increased security, you can enable this policy and select Require password for removable data drive, click Require password complexity, and set the preferred minimum password length. |
+
Choose how BitLocker-protected removable drives can be recovered |
+Suggested configuration: Not Configured +Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS). +When set to Not Configured, the data recovery agent is allowed, and recovery information is not backed up to AD DS. +MBAM operation does not require recovery information to be backed up to AD DS. |
+
Account name and purpose | +Account type | +MBAM Server Configuration wizard field that corresponds to this account | +Description of the MBAM Server Configuration wizard field that corresponds to this account | +
---|---|---|---|
Compliance and Audit Database and Recovery Database read/write user or group for reports |
+User or Group |
+Read/write access domain user or group |
+Domain user or group that has read/write access to the Compliance and Audit Database and the Recovery Database to enable the web applications to access the data and reports in these databases. +If you enter a user name in this field, it must be the same value as the value in the Web service application pool domain account field on the Configure Web Applications page. +If you enter a group name in this field, the value in the Web service application pool domain account field on the Configure Web Applications page must be a member of the group you enter in this field. |
+
Compliance and Audit Database read-only user or group for reports |
+User or Group |
+Read-only access domain user or group |
+Name of the user or group that will have read-only access to the Compliance and Audit Database to enable the reports to access the compliance and audit data in this database. +If you enter a user name in this field, it must be the same user as the one you specify in the Compliance and Audit Database domain account field on the Configure Reports page. +If you enter a group name in this field, the value that you specify in the Compliance and Audit Database domain account field on the Configure Reports page must be a member of the group that you specify in this field. |
+
Account name/purpose | +Account type | +MBAM Server Configuration wizard field that corresponds to this account | +Description of the MBAM Server Configuration wizard field that corresponds to this account | +
---|---|---|---|
Reports read-only domain access group |
+Group |
+Reporting role domain group |
+Name of the domain group whose members have read-only access to the reports in the Administration and Monitoring Website. |
+
Compliance and Audit Database domain user account |
+User |
+Compliance and Audit Database domain account |
+Domain user account and password that the local SQL Server Reporting Services instance uses to access the Compliance and Audit Database. This account requires Log On as Batch rights to the SQL Server Reporting Services server. +If the value you enter in the Read-only access domain user or group field on the Configure Databases page is a user name, you must enter that same value in this field. +If the value you enter in the Read-only access domain user or group field on the Configure Databases page is a group name, the value that you enter in this field must be a member of that group. +Configure the password for this account to never expire. The user account should be able to access all data that is available to the MBAM Reports Users group. |
+
Account name/purpose | +Account type | +MBAM Server Configuration wizard field that corresponds to this account | +Description of the MBAM Server Configuration wizard field that corresponds to this account | +
---|---|---|---|
Web service application pool domain account |
+User |
+Web service application pool domain account |
+Domain user account to be used by the application pool for the web applications. +If you enter a user name in the Read/write access domain user or group field on the Configure Databases page, you must enter that same value in this field. +If you enter a group name in the Read/write access domain user or group field on the Configure Databases page, the value you enter in this field must be a member of that group. +If you do not specify credentials, the credentials that were specified for any previously enabled web application will be used. All web applications must use the same application pool credentials. If you specify different credentials for different web applications, the most recently specified value will be used. +
+Important
+
+For improved security, set the account that is specified in the credentials to have limited user rights. +
+
+ |
+
MBAM Advanced Helpdesk Users access group |
+Group |
+MBAM Advanced Helpdesk Users |
+Domain user group whose members have access to all recovery areas of the Administration and Monitoring Website. Users who have this role have to enter only the recovery key, and not the end user’s domain and user name, when helping end users recover their drives. If a user is a member of both the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Group permissions. |
+
MBAM Helpdesk Users access group |
+Group |
+MBAM Helpdesk Users |
+Domain user group whose members have access to the Manage TPM and Drive Recovery areas of the MBAM Administration and Monitoring Website. Individuals who have this role must fill-in all fields, including the end-user’s domain and account name, when they use either option. +If a user is a member of both the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Group permissions. |
+
MBAM Report Users access group |
+Group |
+MBAM Report Users |
+Domain user group whose members have read-only access to the reports in the Reports area of the Administration and Monitoring Website. |
+
MBAM Data Migration User Group |
+Group |
+MBAM Data Migration Users |
+Optional domain user group whose members have permissions to write data to MBAM by using the MBAM Recovery and Hardware Service running on the MBAM server. This account is generally used with the Write-Mbam* cmdlets to write recovery and TPM data from Active Directory into the MBAM database. +For more information, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md). |
+
Considerations | +Details or purpose | +
---|---|
Review the following before you start the deployment: +
|
+Each MBAM feature has specific prerequisites that must be met before you start the MBAM installation. |
+
BitLocker recovery keys in MBAM expire after a single use. |
+A single use means that the recovery key has been retrieved through the Administration and Monitoring Website (also known as Help Desk), Self-Service Portal, or by using the Get-MbamBitLockerRecoveryKey Windows PowerShell cmdlet. |
+
Keep track of the names of the computers on which you configure each feature. You will use this information throughout the configuration process. |
+You may want to use the [MBAM 2.5 Deployment Checklist](mbam-25-deployment-checklist.md) for this purpose. |
+
Configure only the Group Policy settings in the MDOP MBAM (BitLocker Management) node. Do not change the Group Policy settings in the BitLocker Drive Encryption node. |
+If you change the Group Policy settings in the BitLocker Drive Encryption node, MBAM will not work. |
+
Method | +Required or optional? | +
---|---|
Using certificates to secure MBAM websites |
+Optional, but highly recommended |
+
Registering Service Principal Names (SPN) for the application pool account |
+Required |
+
Task or item | +More information | +
---|---|
Create a service account in Active Directory Domain Services (AD DS). |
+The service account is a user account that you create in AD DS to provide security for the MBAM websites. The MBAM websites run under an application pool, whose identity is the name of the service account. The SPNs are then registered in the application pool account. +
+Note
+
+You must use the same application pool account for all web servers. +
+
+ |
+
Verify that either the IIS-IUSRS group account or the application pool account has been granted the necessary rights. |
+To check this, follow these steps: +
|
+
If you configure the MBAM websites by using a domain administrative account, MBAM will create the SPNs for you. |
+If you configure the MBAM websites by using a domain administrative account, follow the steps in this topic to register SPNs manually for the type of host name that you are using. |
+
What you need to do | +Examples and more information | +
---|---|
Register an SPN for the fully qualified domain name. |
+
The fully qualified host name is mybitlockerrecovery.contoso.com, and the domain account used for the web application pool is contoso\mbamapppooluser. |
+
Configure constrained delegation for the SPN that you are registering for the application pool account. |
+[Configuring Constrained Delegation](http://go.microsoft.com/fwlink/?LinkId=394335) +This requirement only applies to MBAM 2.5; it is not necessary in MBAM 2.5 SP1. |
+
What you need to do | +Examples and more information | +
---|---|
Register an SPN for the NetBIOS host name. |
+
The NetBIOS host name is nbname01, and the domain account used for the web application pool is contoso\mbamapppooluser. |
+
Register an SPN for the fully qualified domain name. |
+
The fully qualified domain name is nbname01.contoso.com, and the domain account used for the web application pool is contoso\mbamapppooluser. |
+
Configure constrained delegation for the SPNs that you are registering for the application pool account. |
+[Configuring Constrained Delegation](http://go.microsoft.com/fwlink/?LinkId=394335) +This requirement only applies to MBAM 2.5; it is not necessary in MBAM 2.5 SP1. |
+
What you need to do | +Examples and more information | +
---|---|
If your virtual host name is a fully qualified domain name, as in this example, register only one SPN. |
+
In the example, the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pool is contoso\mbamapppooluser. |
+
Register this additional SPN if your virtual host name is not a fully qualified domain name. |
+
In the example, the virtual host name is mbamvirtual, and the domain account used for the web application pool is contoso\mbamapppooluser. |
+
Register this additional SPN if your virtual host name is not a fully qualified domain name. |
+
In the example, the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pool is contoso\mbamapppooluser. |
+
On the Domain Name Server (DNS) server, create an “A record” for the custom host name and point it to a web server or a load balancer. |
+See the “To configure DNS Host A Records” section in [Configure DNS Host Records](http://go.microsoft.com/fwlink/?LinkId=394337). +We recommend that you use A records instead of CNAMES. If you use CNAMES to point to the domain address, you must also register SPNs for the web server name in the application pool account. |
+
Configure constrained delegation for the SPNs that you are registering for the application pool account. |
+[Configuring Constrained Delegation](http://go.microsoft.com/fwlink/?LinkId=394335) +This requirement only applies to MBAM 2.5; it is not necessary in MBAM 2.5 SP1. |
+
What you need to do | +Examples and more information | +||||||
---|---|---|---|---|---|---|---|
Create an application pool account in Active Directory Domain Services (AD DS). |
++ | ||||||
Remove the currently installed websites and web services. |
+[Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md) |
+||||||
Remove SPNs from the machine account. |
+
|
+||||||
Register SPNs in the application pool account. |
+Follow the steps for [Registering SPNs when you use a virtual host name](#bkmk-regvirtualspn). |
+||||||
Reconfigure the web applications and web services. |
+[How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) |
+||||||
Do one of the following, depending on the method you use for the configuration: +
|
+
+Important
+
+The host name that you enter must be the same name as the virtual host name for which you are creating the SPNs. Also, in your web farm, the host names and the application pool credentials must be the same on every server that you are configuring. +
+
+
+When MBAM configures the web applications, it will try to register the SPNs for you, but it can do so only if you have Domain Admin rights on the server on which you are installing MBAM. If you do not have these rights, you can complete the configuration, but you will have to set the SPNs before or after you configure MBAM. |
+
Prerequisite | +Details | +
---|---|
The enterprise domain must contain at least one Windows Server 2008 (or later) domain controller. |
++ |
The client computer must be logged on to the enterprise intranet. |
++ |
For Windows 7 client computers only: Each client must have Trusted Platform Module (TPM) capability (TPM 1.2 or later). |
++ |
For Windows 8 and Windows 8.1 client computers only: If you want MBAM to be able to store and manage the TPM recovery keys, TPM auto-provisioning must be turned off, and MBAM must be set as the owner of the TPM before you deploy MBAM. +In MBAM 2.5 SP1 only, you no longer need to turn off TPM auto-provisioning, but you must make sure that the TPM Group Policy Objects are set to not escrow TPM OwnerAuth to Active Directory. |
+[MBAM 2.5 Security Considerations](mbam-25-security-considerations.md#bkmk-tpm) |
+
The TPM chip must be turned on in the BIOS and be resettable from the operating system. |
+See the BIOS documentation for more information. |
+
The computer’s hard disk must have at least two partitions and must be formatted with the NTFS file system. |
++ |
The computer’s hard disk must have a BIOS that is compatible with TPM and that supports USB devices during computer startup. |
+
+Note
+
+Ensure that the keyboard, video, or mouse are directly connected and not managed through a keyboard, video, or mouse (KVM) switch. A KVM switch can interfere with the ability of the computer to detect the physical presence of hardware. +
+
+ |
+
If you use a proxy, it must be visible in the system context. MBAM runs under the system context, not the user context. |
++ |
Prerequisite | +Additional information | +
---|---|
The Configuration Manager Server is a primary site in the Configuration Manager system. |
+N/A |
+
The Hardware Inventory Client Agent is on the Configuration Manager Server. |
+For System Center 2012 Configuration Manager, see [How to Configure Hardware Inventory in Configuration Manager](http://go.microsoft.com/fwlink/?LinkId=301685). +For Configuration Manager 2007, see [How to Configure Hardware Inventory for a Site](http://go.microsoft.com/fwlink/?LinkId=301656). |
+
One of the following is enabled, depending on the version of Configuration Manager that you are using: +
|
+For System Center 2012 Configuration Manager, see [Configuring Compliance Settings in Configuration Manager](http://go.microsoft.com/fwlink/?LinkId=301687). +For Configuration Manager 2007, see [Desired Configuration Management Client Agent Properties](http://go.microsoft.com/fwlink/?LinkId=301686). |
+
A reporting services point is defined in Configuration Manager. Required for SQL Server Reporting Services (SSRS). |
+For System Center 2012 Configuration Manager, see [Prerequisites for Reporting in Configuration Manager](http://go.microsoft.com/fwlink/?LinkId=301689). +For Configuration Manager 2007, see [How to Create a Reporting Services Point for SQL Reporting Services](http://go.microsoft.com/fwlink/?LinkId=301688). |
+
Configuration Manager 2007 requires Microsoft .NET Framework 2.0 |
+The Desired Configuration Management (DCM) Client Agent in Configuration Manager 2007 requires .NET Framework 2.0 to report compliance. +
+Note
+
+Installing .NET Framework 3.5 automatically installs .NET Framework 2.0. +
+
+ |
+
Permissions | +MBAM Server feature | +
---|---|
SQL Server instance login server roles: - dbcreator- processadmin |
+- Recovery Database- Audit Database |
+
SSRS instance rights: - Create Folders- Publish Reports |
+- System Center Configuration Manager Integration |
+
Permissions | +Configuration Manager Server feature | +
---|---|
Configuration Manager site rights:- Read |
+System Center Configuration Manager Integration |
+
Configuration Manager collection rights: - Create- Delete- Read- Modify- Deploy Configuration Items |
+System Center Configuration Manager Integration |
+
Configuration Manager configuration item rights: - Create- Delete- Read |
+System Center Configuration Manager Integration |
+
Permissions | +Configuration Manager Server feature | +
---|---|
Configuration Manager site rights:- Read |
+System Center Configuration Manager Integration |
+
Configuration Manager collection rights: - Create- Delete- Read- ReadResource |
+System Center Configuration Manager Integration |
+
Configuration Manager configuration item rights: - Create- Delete- Read- Distribute |
+System Center Configuration Manager Integration |
+
KB Article | +Title | +Link | +
---|---|---|
2975636 |
+Hotfix Package 1 for Microsoft BitLocker Administration and Monitoring 2.5 |
+[support.microsoft.com/kb/2975636/EN-US](http://support.microsoft.com/kb/2975636/EN-US) |
+
3015477 |
+Hotfix Package 2 for BitLocker Administration and Monitoring 2.5 |
+[support.microsoft.com/kb/3015477](https://support.microsoft.com/kb/3015477) |
+
3011022 |
+MBAM 2.5 installation or Configuration Manager reporting fails if the name of SSRS instance contains an underscore |
+[support.microsoft.com/kb/3011022/EN-US](http://support.microsoft.com/kb/3011022/EN-US) |
+
2756402 |
+MBAM client would fail with Event ID 4 and error code 0x8004100E in the Event description |
+[support.microsoft.com/kb/2756402/EN-US](http://support.microsoft.com/kb/2756402/EN-US) |
+
2639518 |
+Error opening Enterprise or Computer Compliance Reports in MBAM |
+[support.microsoft.com/kb/2639518/EN-US](http://support.microsoft.com/kb/2639518/EN-US) |
+
2870842 |
+MBAM 2.0 Setup fails during Configuration Manager Integration Scenario with SQL Server 2008 |
+[support.microsoft.com/kb/2870842/EN-US](http://support.microsoft.com/kb/2870842/EN-US) |
+
2975472 |
+SQL deadlocks when many MBAM clients connect to the MBAM recovery database |
+[support.microsoft.com/kb/2975472/EN-US](http://support.microsoft.com/kb/2975472/EN-US) |
+
Event ID | +Source | +Event symbol | +Message | +Troubleshooting | +
---|---|---|---|---|
103 |
+Microsoft-Windows-MBAM-Server/Operational |
+VssRegistrationException |
+An exception was thrown during VSS registration. |
++ |
104 |
+Microsoft-Windows-MBAM-Server/Operational |
+VssDeregistrationException |
+An exception was thrown during VSS deregistration. |
++ |
300 |
+Microsoft-Windows-MBAM-Server /Admin |
+CmdletError |
+Failed in removing folder. |
+Indicates that a terminating error occurred while performing a task. Inspect other event messages in the log to further diagnose MBAM setup. |
+
301 |
+Microsoft-Windows-MBAM-Server /Admin |
+cmdletUnexpectedError |
+Unexpected Cmdlet error. |
++ |
302 |
+Microsoft-Windows-MBAM-Server /Admin |
+CmdletWarning |
+Cmdlet warning. |
++ |
303 |
+Microsoft-Windows-MBAM-Server/Operational |
+CmdletInformation |
+Cmdlet information. |
+Informational only; no troubleshooting required. The event indicates that a task is taking place by the Cmdlets such as enabling\disabling a feature or cancelling an operation. |
+
400 |
+Microsoft-Windows-MBAM-Server /Admin |
+ConfiguratorError |
+Configurator error. |
+Indicates that an error has occurred while launching the MBAM Configurator. Ensure that the user has adequate privileges to launch the MBAM Configurator. |
+
401 |
+Microsoft-Windows-MBAM-Server /Admin |
+ConfiguratorUnexpectedError |
+Unexpected Configurator error. |
+Indicates that a terminating error has occurred while performing an MBAM Configurator task. The error message will contain more details about the error. Inspect other error messages in the event log to further diagnose MBAM setup. Known errors include: +
|
+
402 |
+Microsoft-Windows-MBAM-Server /Admin |
+ConfiguratorWarning |
+Configurator warning. |
+Indicates that an MBAM Configurator task is not complete as expected but did not fail completely. Known tasks include missing certificate in the LocalMachine\My store that was configured in the web application feature, or a timeout for a pending task. |
+
410 |
+Microsoft-Windows-MBAM-Server/Operational |
+ConfiguratorInformation |
+Configurator information. |
+Informational only; no troubleshooting required. The event indicates that a task is being invoked by the MBAM Configurator. Known tasks include: +
|
+
500 |
+Microsoft_Windows_MBAM_Server_Admin |
+WebProviderUnexpectedError |
+Web application provider unexpected error. |
+Indicates that an error has occurred while enabling and configuring an MBAM web site or web service in IIS. Known errors include: +
This error is also logged if MBAM cannot access Active Directory (AD) to validate user accounts. Verify that IIS is installed, correctly configured, and the IIS service is running. Verify that all the MBAM software prerequisite checks pass. Verify that the user has the correct permissions to create web applications on the IIS instance. Verify that the user has access to read user account objects in AD. |
+
501 |
+Microsoft-Windows-MBAM-Server /Admin |
+WebProviderError |
+Web application provider unexpected error. |
+Indicates that an error has occurred while enabling, disabling, or configuring an MBAM web site or web service in IIS. Known errors include: +
Verify that IIS is installed and correctly configured. Verify that the registry key HKLM\SOFTWARE\Microsoft\InetStp:PathWWWRoot exists and accessible. Verify that the binding information in IIS is not corrupt. |
+
502 |
+Microsoft-Windows-MBAM-Server /Admin |
+WebProviderWarning |
+Web application provider warning. |
+Indicates that a non-terminating error has occurred while enabling an MBAM web site or web service. Known errors include: +
The event message will contain more information about the specific error. Verify that AD is reachable from the server where MBAM setup is running. Verify that the user who is running the MBAM setup has read permissions on the app pool account in AD. If an SPN is already registered on the app pool account in AD then make sure that it is not registered on other accounts. |
+
503 |
+Microsoft-Windows-MBAM-Server/Operational |
+WebProviderInformation |
+Web application provider information. {Description} |
+Informational only; no troubleshooting required. The event indicates that a task is being invoked by the MBAM Setup. Known tasks include getting IIS configuration such as binding information and root site, and configuring Service Principal Name (SPN). |
+
600 |
+Microsoft-Windows-MBAM-Server /Admin |
+SetupUnexpectedError |
+Unexpected setup error. |
+Indicates that a terminating error has occurred while enabling\disabling or configuring an MBAM feature. Known errors include: +
The event message will contain more information about the specific error. Verify that all MBAM software prerequisite checks pass. Make sure the MBAM registry path, if exists, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server and all the subkeys are readable. Verify that AD is reachable from the server where MBAM setup is running. Verify that the user who is running the MBAM setup has read permissions in AD. +For a successful VSS writer registration, verify that a supported version of SQL is installed and an instance is accessible to the user who is running the MBAM setup. If disabling an MBAM feature or uninstalling MBAM verify that all files such as log files and web.config files are closed so MBAM can remove its web sites and web services. |
+
601 |
+Microsoft-Windows-MBAM-Server /Admin |
+SetupError |
+Setup error. |
+Indicates that a terminating error has occurred while enabling\disabling or configuring an MBAM feature. Known errors include: +
The event message will contain more information about the specific error. Verify that IIS is installed and configured correctly. Verify that all MBAM software prerequisite checks pass. For a successful VSS writer registration, verify that a supported version of SQL is installed and an instance is accessible to the user who is running the MBAM setup. |
+
602 |
+Microsoft-Windows-MBAM-Server /Admin |
+SetupWarning |
+Setup warning. |
+Indicates that a non-terminating error has occurred while enabling\disabling or configuring an MBAM feature such as Configuration Manager (CM) Integration or MBAM web application. Known errors include: failure to delete MBAM Reports from SRS Role point in the CM, and failure to resolve a host name from the domain controller. The event message will contain more information about the specific error. +Verify that AD is reachable from the server where MBAM setup is running. Verify that the user who is running the MBAM setup has remove permissions on the SSRS instance that is configured as an SRS Role point in CM. |
+
603 |
+Microsoft-Windows-MBAM-Server/Operational |
+SetupInformation |
+Setup information. |
+Informational only; no troubleshooting required. |
+
605 |
+Microsoft-Windows-MBAM-Server /Admin |
+WebProviderSoftwareCheckFailure |
+Web application cannot be enabled because one or more software dependencies are not being met. |
+During MBAM web site/web service installation, MBAM setup verifies if necessary prerequisites are in place. This message indicates that MBAM failed to install the requested web site/web service as the necessary prerequisite is missing. Refer to error messages preceding this message to get more information about missing prerequisites. |
+
606 |
+Microsoft-Windows-MBAM-Server /Admin |
+SetupParameterValidationFailure |
+The parameter that is needed to enable the server feature was either not specified or it did not pass the validation. |
+Indicates that the parameter that is needed to configure an MBAM feature was either not specified or it did not pass the validation. |
+
607 |
+Microsoft-Windows-MBAM-Server /Admin |
+SetupParameterValidationFailureWithError |
+Error encountered while trying to validate specified parameter that is needed to enable the server feature. |
+Indicates that an error was encountered while trying to validate specified parameter that is needed to enable the server feature. |
+
700 |
+Microsoft-Windows-MBAM-Server /Admin |
+DbProviderUnexpectedError |
+DB provider unexpected error. |
++ |
701 |
+Microsoft-Windows-MBAM-Server /Admin |
+DbProviderError |
+DB provider error. |
+The message contained in the EventDetails section should provide more information about actual error. These are some of the areas to verify: +
|
+
702 |
+Microsoft-Windows-MBAM-Server /Admin |
+DbProviderWarning |
+DB provider warning. |
++ |
703 |
+Microsoft-Windows-MBAM-Server/Operational |
+DbProviderInformation |
+DB provider information. |
+Informational only; no troubleshooting required. |
+
704 |
+Microsoft-Windows-MBAM-Server /Admin |
+DbProviderDacError |
+An error occurred while deploying the Data-Tier Application. |
+MBAM packages its databases as data tier applications and tries to register them using Microsoft.SqlServer.Dac.DacServices. The error message in context is reported by DAC service. The event should contain detailed information about what caused it. Read the information in the error message to troubleshoot and fix the issue. |
+
705 |
+Microsoft-Windows-MBAM-Server /Admin |
+DbProviderDacWarning |
+A warning occurred while deploying the Data-Tier Application. |
+MBAM packages its databases as data tier application and tries to register them using Microsoft.SqlServer.Dac.DacServices. The warning message in context is reported by DAC service. The event should contain detailed information about what caused it. Read the information in the warning message to troubleshoot and fix the issue. |
+
706 |
+Microsoft-Windows-MBAM-Server/Operational |
+DbProviderDacInformation |
+A message was raised while deploying the Data-Tier Application. |
+Informational only; no troubleshooting required. |
+
800 |
+Microsoft-Windows-MBAM-Server /Admin |
+ReportProviderUnexpectedError |
+Report provider unexpected error. |
+Report provider unexpected error. {Description} {exceptionDetails} These are some of the possible exception details: +An error occurred while getting the name of directory '{directoryName}' +An exception occurred while getting files for directory '{directoryName}' +An exception occurred while enumerating directories in directory '{directoryName}' +An exception occurred while reading all bytes for file '{fileName}' +During MBAM installation, MBAM setup unzips all the report files to the specified installation path. As a part of report installation, install module tries to access the unzipped report files at installation path and communicates with SQL Reporting services to publish the report files. The above errors occur when MBAM cannot access the files/folders at unzipped Installation path. These are some tips to troubleshoot this issue: +
Reporting Services connectivity failed.{exceptionDetails} +During MBAM reports installation, modules tries to communicate with SSRS web services to create folders and publish reports. The above message indicates that MBAM could not find or communicate with SSRS web services. These are some tips to troubleshoot this issue: +
Failed to remove the MBAM Reports using Reporting Services instance URL '{SSRSInstanceUrl}'.Make sure the SSRS instance required for MBAM Reports is running and configured correctly. +When MBAM installation fails or When user disables MBAM Reporting features, setup module removes SSRS reports. The above message indicates that MBAM failed to remove SSRS reports. These are some tips to troubleshoot this issue: +
An error occurred while publishing reports.{exceptionDetails}. +During MBAM reports installation, modules tries to communicate with SSRS web services to create folders and publish reports. The above message indicates that SSRS web service reported and exception while publishing reports. These are some tips to troubleshoot this issue: +
A policy for group user name '{userName}' already exists. In case this is not correct, manually revise the Reporting Service for duplicate or invalid policies. +After Publishing MBAM reports, MBAM setup tries to create a MBAM Report Users roles (if it does not exist already) and sets corresponding user policy. The above error indicates that SSRS web service threw an exception while setting up report user role policy. Follow the instructions in the event message and refer to "https://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=SQL+Server+Reporting+Services&ProdVer=8.00&EvtID=rsInvalidPolicyDefinition&EvtSrc=Microsoft.ReportingServices.Diagnostics.ErrorStrings.resources.Strings&LCID=1033" for more help. +An error occurred while validating access to SSRS {exceptionDetails}. +As part of prerequisite check, MBAM setup verifies if the user has necessary permissions to access/create folder under SSRS. The error message indicates that an exception has occurred while verifying access to SSRS. Refer to the exception details for debugging tips. +A SOAP error occurred while checking the SSRS URL.{exceptionDetails} +A web error occurred while checking the SSRS URL.{exceptionDetails} +An http/https error occurred while checking the SSRS URL.{exceptionDetails} +An error occurred while checking the SSRS URL.{exceptionDetails} +As part of prerequisite check, MBAM setup retrieves URLs associated with the supplied SSRS instance and tries to communicate with SSRS web service. The above error message indicates that SSRS web service at the given URL threw an exception, Refer to exception details for more information. These are some tips to resolve SSRS communication issues. +
An error occurred while retrieving the SSRS version. {exceptionDetails} +As part of prerequisite check, MBAM setup queries WMI to retrieve the version number associated to the supplied SSRS instance. The above error message indicates that an exception occurred while querying WMI. Refer to exceptionDetails for more information. These are some checks you can perform: +
The current user is not authorized to access the WMI namespace '{ssrsWMINamespace}'. +An error occurred while enumerating the namespace '{ssrsWMINamespace}'. RPC server for SSRS WMI provider on the local host is not found. +An error occurred while enumerating the namespace '{ssrsNamespace}'. Unable to find an instance of SSRS on the local host. +An error occurred while accessing WMI. RPC server for instance '{ssrsInstance}' was not found. +An error occurred while accessing WMI. Instance name '{ssrsInstanceName}' is not correct. +An error occurred while accessing WMI. Unable to find instance '{ssrsInstanceName}' on the local host. +As part of prerequisite check, MBAM setup queries WMI to retrieve WMI namespace associated to given instance. The above error message indicates that and exception was occurred while querying WMI. Refer to exceptionDetails for more information. These are some checks you can perform: +
|
+
801 |
+Microsoft-Windows-MBAM-Server /Admin |
+ReportProviderError |
+Report provider unexpected error. |
+Given the SQL server reporting services instance name, MBAM tries to find the WMI namespace corresponding to the reporting instance and connect to it. This error occurs if MBAM encounters an exception when MBAM searches for or tries to connect to SSRS WMI namespace. Read the information in the error messages logged in the MBAM setup channel before this message to get more details. Here are some things you can check: +
|
+
802 |
+Microsoft-Windows-MBAM-Server /Admin |
+ReportProviderWarning |
+Report provider warning. |
++ |
803 |
+Microsoft-Windows-MBAM-Server/Operational |
+ReportProviderInformation |
+Report provider information. |
+Informational only; no troubleshooting required. |
+
900 |
+Microsoft-Windows-MBAM-Server /Admin |
+CMProviderUnexpectedError |
+CM provider unexpected error. |
+Indicates that a terminating error has occurred while enabling\disabling or configuring the Configuration Manager (CM) Integration feature in MBAM. Known errors include: +
The event message will contain more information about the specific error. Verify that all MBAM software prerequisite checks pass. Verify that the MBAM registry path, if exists, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server and all the subkeys are readable. Verify that MBAM is being integrated with a supported version of Configuration Manager. Verify that the Configuration Manager Console is installed on the machine where the MBAM setup is being invoked and that the console can be used to connect to the target CM Site Server. Verify that a valid SSRS instance is configured as an SRS Role point in CM and that the user who is running the MBAM setup has read\write permissions on the SSRS instance. |
+
901 |
+Microsoft-Windows-MBAM-Server /Admin |
+CMProviderError |
+CM provider unexpected error. |
+Indicates that a terminating error has occurred while enabling\disabling or configuring the Configuration Manager (CM) Integration feature in MBAM. Known errors include: +
The event message will contain more information about the specific error. Verify that all MBAM software prerequisite checks pass. Verify that the MBAM registry path, if exists, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server and all the subkeys are readable. Verify that MBAM is being integrated with a supported version of Configuration Manager. Verify that the Configuration Manager Console is installed on the machine where the MBAM setup is being invoked and that the console can be used to connect to the target CM Site Server. Verify that the user has the required read\write permissions to create Configuration Items, Baselines, and Collections in CM. Verify that a valid SSRS instance is configured as an SRS Role point in CM and that the user who is running the MBAM setup has read\write permissions on the SSRS instance. |
+
902 |
+Microsoft_Windows_MBAM_Server_Admin |
+CMProviderWarning |
+CM provider warning. |
+Indicates that a non-terminating error has occurred while enabling the Configuration Manager (CM) Integration feature. Known errors include: failure to commit collection rules in the MBAM Supported Computers collection in CM, and other SSRS and network related errors. +The event message will contain more information about the specific error. Some operations that caused this warning are retired after the warning. If after several retries the error persists, then MBAM might end with an actual error. Inspect other event messages in the log to further diagnose MBAM setup. |
+
903 |
+Microsoft-Windows-MBAM-Server/Operational |
+CMProviderInformation |
+CM provider information. |
+Informational only; no troubleshooting required. |
+
Event ID | +Source | +Event Symbol | +Message | +Troubleshooting | +
---|---|---|---|---|
1 |
+Microsoft-Windows-MBAM-Web/Admin |
+WebAppSpnError |
+Application: {SiteName}\{VirtualDirectory} is missing the following Service Principal Names (SPNs):{ListOfSpns} Register the required SPNs on the account: {ExecutionAccount}. |
+For Integrated Windows Authentication to succeed, necessary SPNs needs to be in place. This message indicates that the SPN required for MBAM application has not been correctly configured. Details contained in this event should provide more information. +See “Service Principal Name (SPN)” in [MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md#bkmk-prereqsams) for more information. |
+
4 |
+Microsoft-Windows-MBAM-Web/Operational |
+PerformanceCounterError |
+An error occurred while retrieving a performance counter. +Message:{EventMessage}Category:{CategoryOfPerformanceCounter} Performance Counter:{NameOfPerformanceCounter} Instance:{Name of performance counter category instance} Exception:{ExceptionThrown} +Trace message will contain the actual exception message, some of which are explained here: +ArgumentNullException: This exception is thrown if the category, counter or instance of requested Performance counter is invalid. +System.InvalidOperationException: categoryName is an empty string ("").-or- counterName is an empty string(""). +-or- The read/write permission setting requested is invalid for this counter. +-or- The category specified does not exist (if readOnly is true). +-or- The category specified is not a .NET Framework custom category (if readOnly is false). +-or-The category specified is marked as multi-instance and requires the performance counter to be created with an instance name. +-or-instanceName is longer than 127 characters. +-or-categoryName and counterName have been localized into different languages. +System.ComponentModel.Win32Exception: An error occurred when accessing a system API. +System.PlatformNotSupportedException: The platform is Windows 98 or Windows Millennium Edition (ME), which does not support performance counters. +System.UnauthorizedAccessException: Code that is executing without administrative privileges attempted to read a performance counter. |
+The message contained in the event will provide more details around the exception that was thrown. If a System.UnauthorizedAccessException was thrown, verify that MBAM execution account (app pool) has access to performance counter APIs. |
+
100 |
+Microsoft-Windows-MBAM-Web/Admin |
+AdminServiceRecoveryDbError |
+GetMachineUsers: An error occurred while getting user information from the database. Message:{message} -or- +GetRecoveryKey: an error occurred while getting recovery key from the database. Message:{message} -or- +GetRecoveryKey: an error occurred while getting user information from the database. Message:{message} -or- +GetRecoveryKeyIds: an error occurred while getting recovery key Ids from the database. Message:{message} -or- +GetTpmHashForUser: An error occurred while getting TPM hash data from the recovery database. Message:{message} -or- +GetTpmHashForUser: An error occurred while getting TPM hash data from the recovery database. Message:{message}-or- +QueryDriveRecoveryData: An error occurred while getting drive recovery data from the database. Message:{message}-or- +QueryRecoveryKeyIdsForUser: An error occurred while getting recovery key Ids from the database. Message:{message} -or- +QueryVolumeUsers: An error occurred while getting user information from the database. |
+This message is logged whenever there is an exception while communicating with the MBAM recovery database. Read through the information contained in the trace to get specific details about the exception. +For detailed troubleshooting steps, see the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](http://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx). |
+
101 |
+Microsoft-Windows-MBAM-Web/Admin |
+AdminServiceComplianceDbError |
+GetRecoveryKey: An error occurred while logging an audit event to the compliance database. Message:{message} -or- +GetRecoveryKeyIds: An error occurred while logging an audit event to the compliance database. Message:{message} -or- +GetTpmHashForUser: An error occurred while logging an audit event to the compliance database. Message:{message} -or- +QueryRecoveryKeyIdsForUser: An error occurred while logging an audit event to the compliance database. Message:{message} -or- +QueryDriveRecoveryData: An error occurred while logging an audit event to the compliance database. Message:{message} |
+This message is logged whenever there is an exception while communicating the MBAM compliance database. Read through the information contained in the trace to get specific details about the exception. +For detailed troubleshooting steps, see the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](http://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx). |
+
102 |
+Microsoft-Windows-MBAM-Web/Admin |
+AgentServiceRecoveryDbError |
++ | This message indicates an exception when MBAM Agent service tries to communicate with the recovery database. Read through the message contained in the event to get specific information about the exception. +See the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](http://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify whether the MBAM app pool account has required permissions in place to connect or execute on MBAM recovery database. |
+
103 |
+Microsoft-Windows-MBAM-Web/Admin |
+AgentServiceError |
+Unable to detect client machine account or data migration user account. -or- +Account verification failed for caller identity. |
+Whenever a call is made to the "PostKeyRecoveryInfo", "IsRecoveryKeyResetRequired", "CommitRecoveryKeyRest", or "GetTpmHash" web methods on MBAM Agent services, it retrieves the caller context to obtain caller credentials. If the caller context is null or empty, the MBAM Agent service logs "Unable to detect client machine account or data migration user account." +The message "Account verification failed for caller identity " is logged if the web method is expecting the caller to a be computer account and the caller is not a computer account, or if the web method is excepting the caller to be a user account and the caller is not a user account or member of data migration group account. |
+
104 |
+Microsoft-Windows-MBAM-Web/Admin |
+StatusServiceComplianceDbConfigError |
+"The Compliance database connection string in the registry is empty." |
+This message is logged whenever the compliance db connection string is invalid. +Verify the value at the registry key HKLM\Software\Microsoft\MBAM Server\Web\ComplianceDBConnectionString |
+
105 |
+Microsoft-Windows-MBAM-Web/Admin |
+StatusServiceComplianceDbError |
++ | This error indicates that MBAM websites/web services were unable to connect to the MBAMCompliance database. +See the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](http://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify that the IIS app pool account could connect to the MBAM compliance database. |
+
106 |
+Microsoft-Windows-MBAM-Web/Admin |
+HelpdeskError |
+The request to URL {url} caused an internal error. -or- +An error occurred while obtaining execution context information. Unable to verify Service Principal Name (SPN) registration. -or- +An error occurred while verifying Service Principal Name (SPN) registration. |
+Indicates that an unhandled exception has been raised in Helpdesk application. Review the log entries in the MBAM Admin operational channel to find the specific exception. –or- +During the initial Helpdesk website load operation, an SPN check is performed. To verify SPN, the Helpdesk requires execution account information, IIS Sitename, and ApplicationVirtualPath corresponding to Helpdesk website. This error message is logged when one or more of these is invalid or missing. –or- +This message indicates that a security exception is thrown while performing SPN verification. Refer to the exception contained in event details section. |
+
107 |
+Microsoft-Windows-MBAM-Web/Admin |
+SelfServicePortalError |
+An error occurred while getting recovery key for a user. EventDetails:{ExceptionMessage} -or- +An error occurred while obtaining execution context information. Unable to verify Service Principal Name (SPN) registration. EventDetails: User: {username Identity} Application:{SiteName\ApplicationVirtualPath} -or- +An error occurred while verifying Service Principal Name (SPN) registration. EventDetails:{ExceptionMessage} |
+Indicates that an unexpected exception was thrown when a request was made to retrieve recovery key. Refer to the exception message contained in event details section. If tracing is enabled on MBAM Helpdesk, refer to trace data to obtain detailed exception messages. –or- +During an initial load operation, the Self-Service Portal (SSP) retrieves execution account information, IIS Sitename, and ApplicationVirtualPath corresponding to the Self-Service website to verify SPN. This error message is logged when one or more of these is invalid. –or- +This message indicates that a security exception was thrown while performing SPN verification. Refer to the exception contained in event details section. |
+
108 |
+Microsoft-Windows-MBAM-Web/Admin |
+DomainControllerError |
+An error occurred while resolving domain name {DomainName}, A memory allocation failure occurred. -or- +Could not invoke DsGetDcName method. EventDetails:{ExceptionMessage} |
+To resolve Domain name, MBAM leverages "DsGetDcName" windows API. This message is logged when "DsGetDcName" returns "ERROR_NOT_ENOUGH_MEMORY" indicating a memory allocation failure. –or- +This message indicates that "DsGetDcName" API method is unavailable on the hosting system. |
+
109 |
+Microsoft-Windows-MBAM-Web/Admin |
+WebAppRecoveryDbError |
+An error occurred while reading the configuration of the Recovery database. The connection string to the Recovery database is not configured. Message:{message} -or- +DoesUserHaveMatchingRecoveryKey: an error occurred while getting recovery key Ids for a user. Message:{message} -or- +QueryDriveRecoveryData: an error occurred while getting drive recovery data. Message:{message} -or- +QueryRecoveryKeyIdsForUser: an error occurred while getting recovery key Ids for a user. Message:{message} -or- +An error occurred while getting TPM password hash from the Recovery database. EventDetails:{ExceptionMessage} |
+This message indicates that recovery database connection string information at "HKLM\Software\Microsoft\MBAM Server\Web\RecoveryDBConnectionString" is invalid. Verify the given registry key value. –or- +If any of the remaining messages are logged, refer to the troubleshooting steps listed at the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](http://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify whether a connection could be made to the MBAM Recovery database from IIS server using app pool credentials. |
+
110 |
+Microsoft-Windows-MBAM-Web/Admin |
+WebAppComplianceDbError |
+An error occurred while reading the configuration of the Compliance database. The connection string to the Compliance database is not configured. -or- +GetRecoveryKeyForCurrentUser: an error occurred while logging an audit event to the Compliance database. Message:{message} -or- +QueryRecoveryKeyIdsForUser: an error occurred while logging an audit event to the Compliance database. Message:{message} -or- +QueryRecoveryKeyIdsForUser: an error occurred while logging an audit event to the compliance database. Message:{message} |
+This message indicates that compliance db connection string information at "HKLM\Software\Microsoft\MBAM Server\Web\ComplianceDBConnectionString" is invalid. Verify the value corresponding to above registry key. –or- +If any of the remaining messages are logged, refer to the troubleshooting steps listed at the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](http://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify whether a connection could be made to the MBAM Compliance database from IIS server using app pool credentials. |
+
111 |
+Microsoft-Windows-MBAM-Web/Admin |
+WebAppDbError |
++ | These errors indicate one of the following two conditions +
The message contained in the event will provide more details about the exception. +Refer to the troubleshooting steps listed at the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](http://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify that the MBAM execution account (app pool account) could connect to MBAM compliance/recovery database and it has permissions in place to execute GetVersion stored procedure. |
+
112 |
+Microsoft-Windows-MBAM-Web/Admin |
+WebAppError |
+An error occurred while verifying Service Principal Name (SPN) registration. EventDetails:{ExceptionMessage} |
+To perform SPN verification, MBAM queries Active Directory to retrieve a list of SPNs mapped execution account. MBAM also queries the "ApplicationHost.config" to obtain MBAM website bindings. This error message indicates that MBAM could not communicate with Active Directory or it could not load the applicationHost.config file. +Verify that the execution account (app pool account) has permissions to query AD or the ApplicationHost.config file. Also verify the site binding entries in ApplicationHost.config file. |
+
200 |
+Microsoft-Windows-MBAM-Web/Operational |
+HelpDeskInformation |
+The administration website application successfully found and connected to a supported version of the Recovery database. -or- +The administration website application successfully found and connected to a supported version of the Compliance database. |
+Indicates successful connection to the Recovery/Compliance database from the MBAM Helpdesk website. |
+
201 |
+Microsoft-Windows-MBAM-Web/Operational |
+SelfServicePortalInformation |
+The Self-Service Portal application successfully found and connected to a supported version of the Recovery database. -or- +The Self-Service Portal application successfully found and connected to a supported version of the Compliance database. |
+Indicates successful connection to the Recovery/Compliance database from the MBAM Self-Service Portal. |
+
202 |
+Microsoft-Windows-MBAM-Web/Operational |
+WebAppInformation |
+Application has its SPNs registered correctly. |
+Indicates that the SPNs required for the MBAM Helpdesk website are correctly registered against the executing account. |
+
Column Name | +Description | +
---|---|
Managed Computers |
+Number of computers that MBAM manages. |
+
% Compliant |
+Percentage of compliant computers in the enterprise. |
+
% Non-Compliant |
+Percentage of non-compliant computers in the enterprise. |
+
% Exempt |
+Percentage of computers exempt from the BitLocker encryption requirement. |
+
% Non-Exempt |
+Percentage of computers not exempt from the BitLocker encryption requirement. |
+
Compliant |
+Percentage of compliant computers in the enterprise. |
+
Non-Compliant |
+Percentage of non-compliant computers in the enterprise. |
+
Exempt |
+Total computers that are exempt from the BitLocker encryption requirement. |
+
Non-Exempt |
+Total computers that are not exempt from the BitLocker encryption requirement. |
+
Column Name | +Description | +
---|---|
Computer Name |
+User-specified DNS name that is managed by MBAM. |
+
Domain Name |
+Fully qualified domain name where the client computer resides and is managed by MBAM. |
+
Compliance Status |
+State of compliance for the computer, according to the policy specified for the computer. The states are Noncompliant and Compliant. See the following Enterprise Compliance Report Compliance States table for more information about how to interpret compliance states. |
+
Exemption |
+Status that indicates whether this computer is exempt from the BitLocker policy. |
+
Compliance Status Details |
+Error and status messages about the compliance state of the computer in accordance to the policy specified. |
+
Last Contact |
+Date and time when the computer last contacted the server to report compliance status. The contact frequency is configurable. For more information, see the MBAM Group Policy settings. |
+
Column Name | +Description | +
---|---|
Computer Name |
+User-specified DNS computer name that is managed by MBAM. |
+
Domain Name |
+Fully qualified domain name where the client computer resides and is managed by MBAM. |
+
Computer Type |
+Type of computer. Valid types are Non-Portable and Portable. |
+
Operating System |
+Operating system type found on the client computer that is managed by MBAM. |
+
Compliance Status |
+Overall compliance status of the computer that is managed by MBAM. Valid states are Compliant and Noncompliant. +Notice that the compliance status per drive (see the following table) may indicate different compliance states. However, this field represents that compliance state, according to the specified policy. |
+
Policy Cipher Strength |
+Cipher strength selected by the administrator during MBAM policy specification (for example, 128-bit with diffuser). |
+
Policy Operating System Drive |
+Indicates if encryption is required for the operating system and shows the appropriate protector type. |
+
Policy-Fixed Data Drive |
+Indicates if encryption is required for the fixed data drive. |
+
Policy Removable Data Drive |
+Indicates if encryption is required for the removable drive. |
+
Device Users |
+Known users on the computer that is managed by MBAM. |
+
Exemption |
+Status that indicates whether this computer is exempt from the BitLocker policy. |
+
Manufacturer |
+Computer manufacturer name, as it appears in the computer BIOS. |
+
Model |
+Computer manufacturer model name, as it appears in the computer BIOS. |
+
Compliance Status Details |
+Error and status messages about the compliance state of the computer, in accordance with the specified policy. |
+
Last Contact |
+Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable. For more information, see the MBAM Group Policy settings. |
+
Column Name | +Description | +
---|---|
Drive Letter |
+Computer drive letter that was assigned to the particular drive by the user. |
+
Drive Type |
+Type of drive. Valid values are Operating System Drive and Fixed Data Drive. These are physical drives rather than logical volumes. |
+
Cipher Strength |
+Cipher strength selected by the administrator during MBAM policy specification. |
+
Protector Type |
+Type of protector selected through the Group Policy setting used to encrypt an operating system or fixed data volume. |
+
Protector State |
+Indicates that the computer being managed by MBAM has enabled the protector type that is specified in the policy. The valid states are ON or OFF. |
+
Encryption State |
+Encryption state of the drive. Valid states are Encrypted, Not Encrypted, and Encrypting. |
+
Compliance Status |
+State that indicates whether the drive is in accordance with the policy. States are Noncompliant and Compliant. |
+
Compliance Status Details |
+Error and status messages of the compliance state of the computer, according to the specified policy. |
+
Column Name | +Description | +
---|---|
Request Date and Time |
+Date and time that a key retrieval request was made by an end user or Help Desk user. |
+
Audit Request Source |
+The site from which the request was initiated. This entry will have one of two values: Self-Service Portal or Helpdesk. |
+
Request Status |
+Status of the request. Valid statuses are Successful (the key was retrieved), or Failed (the key was not retrieved). |
+
Helpdesk User |
+Help Desk user who initiated the request for key retrieval. +
+Note
+
+If an Advanced Helpdesk User recovers the key without specifying the end user, the End User field will be blank. A standard Helpdesk User must specify the end user, and that user will appear in this field. +A recovery via the Self-Service Portal will list the requesting end user both in this field and in the End User field. +
+
+ |
+
End User |
+End user who initiated the request for key retrieval. |
+
Computer |
+Computer name of the computer that was recovered. |
+
Key Type |
+Type of key that was requested by the Help Desk user or the end user. The three types of keys that MBAM collects are: +
|
+
Reason Description |
+Reason the specified key type was requested by the Help Desk user or the end user. The reasons are specified in the Drive Recovery and Manage TPM features of the Administration and Monitoring Website. The valid entries are user-entered text or one of the following reason codes: +
|
+
+ | BitLocker Encryption Options (MBAM) | +BitLocker Drive Encryption (Windows) | +
---|---|---|
Tasks you can do |
+
|
+
|
+
How the Control Panel item is created |
+Created in Control Panel when you install the MBAM Client. This item cannot be hidden. +
+Note
+
+This item appears in addition to, but does not replace, the default BitLocker Drive Encryption Control Panel item. +
+
+ |
+Appears by default in Control Panel as part of the Windows operating system, but you can hide it. +To hide it, see [Hiding the Default BitLocker Drive Encryption Item in Control Panel](hiding-the-default-bitlocker-drive-encryption-item-in-control-panel-mbam-25.md). |
+
+ | When MBAM Client is installed | +When MBAM Client is not installed | +
---|---|---|
Visibility of shortcut menu |
+The Manage BitLocker option is hidden. +To make the Manage BitLocker option visible on the shortcut menu, which displays the option to decrypt a drive, delete the following registry key: +
|
+The Manage BitLocker option appears on the shortcut menu. |
+
What users can do |
+With the shortcut hidden, users can open the BitLocker Drive Encryption Control Panel item, but the option to decrypt a drive is not available. |
+With the shortcut visible, selecting the Manage BitLocker option opens the BitLocker Drive Encryption Control Panel item, which displays the option to decrypt a drive. |
+
What to know before you start | +Details | +||||||
---|---|---|---|---|---|---|---|
If you are installing the MBAM websites on one server and the web services on another server, you have to use Windows PowerShell cmdlets to configure them. |
+The MBAM Server Configuration wizard does not support configuring the websites on one server and the web services on a different server. |
+||||||
If you are upgrading to MBAM 2.5 or 2.5 SP1 from MBAM 2.0 or 2.0 SP1 in Windows Server 2008 R2: +The Administration and Monitoring Website and the Self-Service Portal will not work if you install the required .NET Framework 4.5 software after Internet Information Services (IIS) is already installed. +This issue occurs because ASP.NET cannot be registered correctly with IIS if the .NET Framework is installed after IIS has already been installed. |
+To resolve this issue: +Run aspnet_regiis –i from the following location: +C:\windows\microsoft.net\Framework\v4.0.30319 +For more information, see: [ASP.NET IIS Registration Tool](http://go.microsoft.com/fwlink/?LinkId=393272). |
+||||||
Register an SPN on the application pool account if all of the following are true: +
|
+For instructions, see [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md#bkmk-registerspn). +
|
+
Name | +Description | +
---|---|
Get-MbamBitLockerRecoveryKey |
+Requests an MBAM recovery key that enables users to unlock a computer or encrypted drive. |
+
Get-MbamTPMOwnerPassword |
+Provides users with a TPM owner password that they can use to unlock a Trusted Platform Module (TPM) when the TPM has locked them out and will no longer accept their PIN. |
+
Windows PowerShell Help format | +More information | +
---|---|
At a Windows PowerShell command prompt, type Get-Help <cmdlet> |
+To upload the latest Windows PowerShell cmdlets, follow the instructions in [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md#bkmk-loadposhhelp) |
+
On TechNet as webpages |
+http://go.microsoft.com/fwlink/?LinkId=393498 |
+
On the Download Center as a Word .docx file |
+http://go.microsoft.com/fwlink/?LinkId=393497 |
+
On the Download Center as a .pdf file |
+http://go.microsoft.com/fwlink/?LinkId=393499 |
+
Version of Configuration Manager | +How to view the reports | +
---|---|
System Center 2012 Configuration Manager |
+
|
+
Configuration Manager 2007 |
+
|
+
Column Name | +Description | +
---|---|
Managed Computers |
+Number of computers that MBAM manages. |
+
% Compliant |
+Percentage of compliant computers in the enterprise. |
+
% Non-Compliant |
+Percentage of non-compliant computers in the enterprise. |
+
% Unknown Compliance |
+Percentage of computers with a compliance state that is not known. |
+
% Exempt |
+Percentage of computers exempt from the BitLocker encryption requirement. |
+
% Non-Exempt |
+Percentage of computers not exempt from the BitLocker encryption requirement. |
+
Compliant |
+Percentage of compliant computers in the enterprise. |
+
Non-Compliant |
+Percentage of non-compliant computers in the enterprise. |
+
Unknown Compliance |
+Percentage of computers with a compliance state that is not known. |
+
Exempt |
+Total computers that are exempt from the BitLocker encryption requirement. |
+
Non-Exempt |
+Total computers that are not exempt from the BitLocker encryption requirement. |
+
Compliance Status | +Exemption | +Description | +
---|---|---|
Noncompliant |
+Not exempt |
+The computer is noncompliant, according to the specified policy. |
+
Compliant |
+Not exempt |
+The computer is compliant in accordance with the specified policy. |
+
Column Name | +Description | +
---|---|
Managed Computers |
+Number of computers that MBAM manages. |
+
% Compliant |
+Percentage of compliant computers in the enterprise. |
+
% Non-Compliant |
+Percentage of non-compliant computers in the enterprise. |
+
% Unknown Compliance |
+Percentage of computers with a compliance state that is not known. |
+
% Exempt |
+Percentage of computers exempt from the BitLocker encryption requirement. |
+
% Non-Exempt |
+Percentage of computers not exempt from the BitLocker encryption requirement. |
+
Compliant |
+Percentage of compliant computers in the enterprise. |
+
Non-Compliant |
+Percentage of non-compliant computers in the enterprise. |
+
Unknown Compliance |
+Percentage of computers with a compliance state that is not known. |
+
Exempt |
+Total computers that are exempt from the BitLocker encryption requirement. |
+
Non-Exempt |
+Total computers that are not exempt from the BitLocker encryption requirement. |
+
Column Name | +Description | +
---|---|
Computer Name |
+User-specified DNS computer name that is being managed by MBAM. |
+
Domain Name |
+Fully qualified domain name, where the client computer resides and is managed by MBAM. |
+
Compliance Status |
+Overall compliance status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. Notice that the compliance status per drive (see the table that follows) may indicate different compliance states. However, this field represents that compliance state, in accordance with the policy specified. |
+
Exemption |
+Status that indicates whether the user is exempt or non-exempt from the BitLocker policy. |
+
Device Users |
+User of the device. |
+
Compliance Status Details |
+Error and status messages about the compliance state of the computer in accordance with the policy specified. |
+
Last Contact |
+Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable through the Group Policy settings. |
+
Column Name | +Description | +
---|---|
Computer Name |
+User-specified DNS computer name that is being managed by MBAM. |
+
Domain Name |
+Fully qualified domain name, where the client computer resides and is managed by MBAM. |
+
Computer Type |
+Type of computer. Valid types are Non-Portable and Portable. |
+
Operating System |
+Operating System type found on the MBAM managed client computer. |
+
Overall Compliance |
+Overall compliance status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. Notice that the compliance status per drive (see the table that follows) may indicate different compliance states. However, this field represents that compliance state in accordance with the policy specified. |
+
Operating System Compliance |
+Compliance status of the operating system that is managed by MBAM. Valid states are Compliant and Noncompliant. |
+
Fixed Data Drive Compliance |
+Compliance status of the fixed data drive that is managed by MBAM. Valid states are Compliant and Noncompliant. |
+
Last Update Date |
+Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable through the Group Policy settings. |
+
Exemption |
+Status that indicates whether the user is exempt or non-exempt from the BitLocker policy. |
+
Exempted User |
+User who is exempt from the BitLocker policy. |
+
Exemption Date |
+Date on which the exemption was granted. |
+
Compliance Status Details |
+Error and status messages about the compliance state of the computer in accordance with the policy specified. |
+
Policy Cipher Strength |
+Cipher strength selected by the Administrator during the MBAM policy specification (for example, 128-bit with diffuser). |
+
Policy: Operating System Drive |
+Indicates if encryption is required for the operating system and the appropriate protector type. |
+
Policy: Fixed Data Drive |
+Indicates if encryption is required for the fixed data drive. |
+
Manufacturer |
+Computer manufacturer name as it appears in the computer BIOS. |
+
Model |
+Computer manufacturer model name as it appears in the computer BIOS. |
+
Device Users |
+Known users on the computer that is being managed by MBAM. |
+
Column Name | +Description | +
---|---|
Drive Letter |
+Computer drive letter that was assigned to the particular drive by the user. |
+
Drive Type |
+Type of drive. Valid values are Operating System Drive and Fixed Data Drive. These are physical drives rather than logical volumes. |
+
Cipher Strength |
+Cipher strength selected by the Administrator during MBAM policy specification. |
+
Protector Types |
+Type of protector selected through the policy used to encrypt an operating system or fixed data drive. The valid protector types for an operating system are TPM or TPM+PIN. The valid protector type for a fixed data drive is a password. |
+
Protector State |
+Indicates that the computer being managed by MBAM has enabled the protector type specified in the policy. The valid states are ON or OFF. |
+
Encryption State |
+Encryption state of the drive. Valid states are Encrypted, Not Encrypted, and Encrypting. |
+
Report information | +Link to detailed information | +
---|---|
Report descriptions - MBAM Stand-alone topology |
+[Understanding MBAM 2.5 Stand-alone Reports](understanding-mbam-25-stand-alone-reports.md) |
+
Instructions for generating reports - MBAM Stand-alone topology |
+[Generating MBAM 2.5 Stand-alone Reports](generating-mbam-25-stand-alone-reports.md) |
+
Value | +Configuration | +Result | +
---|---|---|
DisablePasswordSaving |
+Disabled |
+The MED-V prompt is presented and a check box to accept is available and cleared. If the end user selects the check box, credentials are cached for subsequent use. The end user also has the benefit of only being prompted when the password expires. + |
+
+ | + | If the end user does not select the check box, the Remote Desktop Connection (RDC) Client prompt is presented instead of the MED-V prompt, and the check box to accept is cleared. If the end user selects the check box, the RDC Client credential is stored for later use. +
+Important
+
+RDC does not validate credentials when the end user enters them. If the end user caches the credentials through the RDC prompt, there is a risk that incorrect credentials might be stored. In this case, the incorrect credentials must be deleted in the Windows Credential Manager. +
+
+ |
+
DisablePasswordSaving |
+Enabled |
+
+Note
+
+This configuration is more secure because it does not allow end user credentials to be cached. +
+
+ |
+
Installation File | +Argument | +Accepted Values | +Type | +Description | +Default | +
---|---|---|---|---|---|
Host Agent |
+MEDVDIR |
+<install path> |
+Installation |
+Change installed directory |
+Installation goes to Program Files\Microsoft Enterprise Desktop Virtualization. |
+
MED-V Workspace Packager |
+MEDVDIR |
+<install path> |
+Installation |
+Change installed directory |
+Installation goes to Program Files\Microsoft Enterprise Desktop Virtualization. |
+
MED-V workspace |
+INSTALLDIR |
+<install path> |
+Installation |
+Change installed directory |
+Installation goes to ProgramData\Microsoft\Medv\Workspace. |
+
MED-V workspace |
+OVERWRITE VHD |
+0 or 1 |
+Installation |
+Fail installation if VHD exists(0) or overwrite existing VHD(1). |
+Overwrite does not occur and installation fails if a virtual hard disk (VHD) already exists. |
+
MED-V workspace |
+SUPPRESSMEDVLAUNCH |
+0 or 1 |
+Installation |
+Start(0) or do not start(1) MED-V after MED-V workspace is installed. |
+If the MED-V workspace was installed with the user interface (UI), a check box on the Finish page controls whether to start MED-V. |
+
MED-V workspace |
+DELETEDIFFDISKS |
+0 or 1 |
+Uninstallation |
+Keep(0) or delete(1) VHDs created by MED-V |
+No VHDs are deleted. |
+
Package Information |
+ Specify a name for the MED-V workspace and select a folder where the MED-V workspace package files are saved. |
+
Select Windows XP Image |
+ Specify your prepared Windows XP Virtual PC image. |
+
First Time Setup |
+ Specify the setup process that MED-V follows during first time setup. |
+
MED-V Messages |
+ Specify the messages and optional URL for Help information that the end user sees during first time setup. |
+
Naming Computers |
+ Specify how the MED-V virtual machine is named. |
+
Copy Settings from Host |
+ Specify how the settings for the MED-V workspace are defined. |
+
Startup and Networking |
+ Specify the settings for starting the MED-V workspace, networking, and user credentials. |
+
Web Redirection |
+ Specify a text file or a list of the URLs you want redirected to Internet Explorer in the MED-V workspace. |
+
Summary |
+ Verify your MED-V workspace settings and start to build your MED-V workspace deployment package. |
+
Copy regional settings |
+ Select this check box to copy the regional settings from the host computer to the MED-V workspace. |
+
+ | If you select this check box, the following settings are set in the Sysprep.inf file: +
|
+
Copy user settings |
+ Select this check box to copy certain user settings, such as user name and company name, from the host to the MED-V workspace. |
+
+ | If you select this check box, the following settings are set in the Sysprep.inf file: +
+
+ Note
+
+ Personal settings, such as Internet browsing history, are not copied over to the MED-V workspace. +
+
+ |
+
Copy domain name |
+ Select this check box to let the guest join the same domain as the host. |
+
+ |
+ Important
+
+ The MED-V guest must be configured to join a domain that lets users log on by using the credentials that they use to log on to the MED-V host. +
+
+ |
+
Copy domain organizational unit |
+ Select this check box to copy the domain organizational unit from the host computer to the MED-V workspace. This check box is only enabled if you select to copy the domain name from the host computer. |
+
Start MED-V workspace |
+ Choose whether to start the MED-V workspace at user logon, at first use, or to let the end user decide when the MED-V workspace starts. |
+
+ | The MED-V workspace starts in one of two ways: either when the end user logs on or when they first start an action that requires MED-V, such as opening a published application or entering a URL that requires redirection. +You can either define this setting for the end user or let the end user control how MED-V starts. +
+ Note
+
+ If you specify that the end user decides, the default behavior they experience is that the MED-V workspace starts when they log on. They can change the default by right-clicking the MED-V icon in the notification area and selecting MED-V User Settings. If you define this setting for the end user, they cannot change how MED-V starts. +
+
+ |
+
Networking |
+ Select Shared or Bridged for your networking setting. The default is Shared. |
+
+ | Shared - The MED-V workspace uses Network Address Translation (NAT) to share the host's IP for outgoing traffic. +Bridged - The MED-V workspace has its own network address, typically obtained through DHCP. |
+
Store credentials |
+ Choose whether you want to store the end user credentials. |
+
+ | The default behavior is that credential storing is disabled so that the end user must be authenticated every time that they log on. +
+ Important
+
+ Even though caching the end user’s credentials provides the best user experience, you should be aware of the risks involved. +The end user’s domain credential is stored in a reversible format in the Windows Credential Manager. As a result, an attacker could write a program that retrieves the password and could gain access to the user’s credentials. You can only lessen this risk by disabling the storing of end-user credentials. +
+
+ |
+
Step | +Reference | +
---|---|
Review the components of a MED-V deployment. |
+[High-Level Architecture](high-level-architecturemedv2.md) |
+
Ensure that your computing environment meets the supported configurations required for installing MED-V 2.0. |
+[MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) |
+
Determine how you want to design your MED-V deployment. |
+[Define and Plan your MED-V Deployment](define-and-plan-your-med-v-deployment.md) |
+
Review the list of best practices for ensuring that your MED-V deployment environment is more secure. |
+[Security and Protection for MED-V](security-and-protection-for-med-v.md) |
+
Step | +Reference | +
---|---|
Create a virtual machine that is running Windows XP SP3 with updates and additions. |
+[Creating a Windows Virtual PC Image for MED-V](creating-a-windows-virtual-pc-image-for-med-v.md) |
+
Install any predeployment software that you want on the MED-V image. |
+[Installing Applications on a Windows Virtual PC Image](installing-applications-on-a-windows-virtual-pc-image.md) |
+
Package the MED-V image by using Sysprep. |
+[Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md) |
+
Step | +Reference | +
---|---|
Determine how you can use MED-V to help solve your application compatibility issues. |
+[Planning for Application Operating System Compatibility](planning-for-application-operating-system-compatibility.md) |
+
Plan an end-to-end deployment scenario for your organization. |
+[End-to-End Planning Scenario for MED-V 2.0](end-to-end-planning-scenario-for-med-v-20.md) |
+
Define the project scope by defining the end users and determining the MED-V images to be managed. |
+[Define and Plan your MED-V Deployment](define-and-plan-your-med-v-deployment.md) |
+
Review the list of best practices for ensuring that your MED-V deployment is more secure. |
+[Security and Protection for MED-V](security-and-protection-for-med-v.md) |
+
Step | +Reference | +
---|---|
Ensure that your computing environment meets the supported configurations that are required for installing MED-V 2.0. |
+[MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) |
+
Plan and design the MED-V deployment. |
+[Planning for MED-V](planning-for-med-v.md) |
+
Verify that the required installation prerequisites are configured. |
+[Configure Installation Prerequisites](configure-installation-prerequisites.md) |
+
Install the MED-V Host Agent and MED-V Workspace Packager. |
+[Deploy the MED-V Components](deploy-the-med-v-components.md) |
+
Step | +Reference | +
---|---|
Prepare the MED-V image for deployment. |
+[Prepare a MED-V Image](prepare-a-med-v-image.md) |
+
Create the MED-V workspace deployment package. |
+[Create a MED-V Workspace Package](create-a-med-v-workspace-package.md) |
+
Test the MED-V workspace installer package. |
+[Testing the MED-V Workspace Package](testing-the-med-v-workspace-package.md) |
+
Deploy the MED-V workspace installer package. |
+[Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md) |
+
Argument | +Description | +
---|---|
/norestart |
+Prevents the installation of Windows Virtual PC and the Windows Virtual PC update from restarting the host computer. |
+
/quiet |
+Installs the MED-V components in quiet mode without user interaction. |
+
/qn |
+Installs the MED-V components without a user interface. |
+
IGNORE_PREREQUISITES |
+Installs without checking for Windows Virtual PC. +
+Note
+
+Only specify this argument if you are installing Windows Virtual PC as part of this installation. +
+
+ |
+
OVERWRITEVHD |
+Forces the installation of the MED-V workspace and prevents any prompts that it might generate. |
+
Argument | +Description | +
---|---|
/norestart |
+Prevents the installation of Windows Virtual PC and the Windows Virtual PC update from restarting the host computer. |
+
/quiet |
+Installs the MED-V components in quiet mode without user interaction. |
+
/qn |
+Installs the MED-V components without a user interface. |
+
IGNORE_PREREQUISITES |
+Installs without checking for Windows Virtual PC. +
+Note
+
+Only specify this argument if you are installing Windows Virtual PC as part of this installation. +
+
+ |
+
OVERWRITEVHD |
+Forces the installation of the MED-V workspace and prevents any prompts that it might generate. |
+
Type | +Location | +Files | +
---|---|---|
Base VHD |
+%ProgramData%\Microsoft\Medv\Workspace |
+InternalName.vhd - Where InternalName is the name of the virtual hard disk that you selected in the MED-V Workspace Packager. |
+
Differencing Disk |
+%LocalAppData%\Microsoft\MEDV\v2\Virtual Machines |
+WorkspaceName.vhd |
+
Saved State File |
+%LocalAppData%\Microsoft\MEDV\v2\Virtual Machines |
+WorkspaceName.vsv |
+
Name | +Type | +Data/Default | +Description | +
---|---|---|---|
EventLogLevel |
+DWORD |
+Default=3 |
+The type of information that is logged in the event log. Levels include the following: 0 (None), 1 (Error), 2 (Warning), 3 (Information), 4 (Debug). |
+
Name | +Type | +Data/Default | +Description | +
---|---|---|---|
AddUserToAdminGroupEnabled |
+DWORD |
+Default=0 |
+Configures whether first time setup automatically adds the end user to the administrator's group. 0 = false; 1 = true. |
+
+ | + | + | 0 = false: First time setup does not automatically add the end user to the administrator's group. |
+
+ | + | + | 1 = true: First time setup automatically adds the end user to the administrator's group. |
+
ComputerNameMask |
+SZ |
+MEDV* |
+The computer name mask that is used to create the guest virtual machine's computer name. |
+
+ | + | + | The mask can contain a %username% tag to insert the username as part of the computer name. Likewise, the %hostname% tag inserts the name of the host computer. +Every "#" character in the mask is replaced by a random digit. An asterisk (*) character at the end of the mask is replaced by random alphanumeric characters. +A specific number of characters from %hostname% and %username% can be captured by using square brackets. For example, "%username%[3]" would use the first three characters of the username. |
+
DeleteVMStateTimeout |
+DWORD |
+Default=90 |
+The time-out value, in seconds, when first time setup tries to delete the virtual machine. Range = 0 to 2147483647. |
+
DetachVfdTimeout |
+DWORD |
+Default=120 |
+The time-out value, in seconds, when first time setup tries to detach the virtual floppy disk from the virtual machine. Range = 0 to 2147483647. |
+
DialogUrl |
+SZ |
++ | Customizable URL that links to internal webpage and is displayed by first time setup dialog messages. |
+
ExplorerTimeout |
+DWORD |
+Default=900 |
+The time-out value, in seconds, that first time setup waits for Windows Explorer. Range = 0 to 2147483647. |
+
FailureDialogMsg |
+MULTI_SZ |
+Message is found in resource file |
+Customizable message that is displayed to the end user when first time setup cannot be completed. |
+
GiveUserGroupRightsMaxRetryCount |
+DWORD |
+Default=3 |
+The maximum number of times that MED-V tries to give an end user group rights. Exceeding the specified retry value without being able to successfully give an end user group rights most likely causes a virtual machine preparation failure that is then subject to the MaxRetryCount value. Range = 0 to 2147483647. |
+
GiveUserGroupRightsTimeout |
+DWORD |
+Default=300 |
+The time-out value, in seconds, when giving a user group rights. Range = 0 to 2147483647. |
+
LogFilePaths |
+MULTI_SZ |
++ | A list of the log file paths that MED-V collects during first time setup. |
+
MaxPostponeTime |
+DWORD |
+Default=120 |
+The maximum number of hours that first time setup can be postponed by the end user. Range = 0 to 2147483647. |
+
MaxRetryCount |
+DWORD |
+Default=3 |
+The maximum number of times that MED-V tries to prepare a virtual machine if each attempt ends in a failure other than a software error. When virtual machine preparation fails and the number of first time setup retries is exceeded, then MED-V informs the end user about the failure and does not give the option to retry. The count is re-set every time that MED-V is started. Range = 0 to 2147483647. |
+
Mode |
+SZ |
+Default=Unattended |
+Configures how first time setup interacts with the user. Possible values are as follows: |
+
+ | + | + | Attended. The end user must enter information during first time setup. +
+Note
+
+If you created the Sysprep.inf file so that Mini-Setup requires user input to complete, then you must select Attended mode or problems might occur during first time setup. +
+
+ |
+
+ | + | + | Unattended. The virtual machine is not shown to the end user during first time setup, but the end user is prompted before first time setup starts. |
+
+ | + | + | Silent. The virtual machine is not shown to the end user at all during first time setup. |
+
NonInteractiveRetryTimeoutInc |
+DWORD |
+Default=15 |
+The time-out value, in minutes, that first time setup must be completed in first time setup interactive mode when re-attempting setup. Range = 0 to 2147483647. |
+
NonInteractiveTimeout |
+DWORD |
+Default=45 |
+The time-out value, in minutes, that first time setup must be completed in first time setup interactive mode. Range = 0 to 2147483647. |
+
PostponeUtcDateTimeLimit |
+SZ |
++ | The date and time, in UTC DateTime format, that first time setup can be postponed. Enter in the format "yyyy-MM-dd hh:mm" with hours specified by using the 24-hour clock standard. |
+
RetryDialogMsg |
+MULTI_SZ |
+Message is found in resource file |
+Customizable message that is displayed to the end user when first time setup must re-attempt setup. |
+
SetComputerNameEnabled |
+DWORD |
+Default=0 |
+Configures whether the ComputerName entry under the [UserData] section of the Sysprep.inf file in the guest should be updated according to the specified ComputerNameMask. 0 = false; 1 = true. |
+
+ | + | + | 0 = false: The ComputerName entry in the Sysprep.inf file is not updated according to the ComputerNameMask. |
+
+ | + | + | 1 = true: The ComputerName entry in the Sysprep.inf file is updated according to the ComputerNameMask. |
+
SetJoinDomainEnabled |
+DWORD |
+Default=0 |
+Configures whether the JoinDomain setting under the [Identification] section of the Sysprep.inf file in the guest should be updated to match the settings on the host. 0 = false; 1 = true. |
+
+ | + | + | 0 = false: The JoinDomain setting in the Sysprep.inf file is not updated to match the settings on the host. |
+
+ | + | + | 1 = true: The JoinDomain setting in the Sysprep.inf file is updated to match the settings on the host. |
+
SetMachineObjectOUEnabled |
+DWORD |
+Default=0 |
+Configures whether the MachineObjectOU setting under the [Identification] section of the Sysprep.inf file in the guest is updated to match the host. 0 = false; 1 = true. |
+
+ | + | + | 0 = false: The MachineObjectOU setting in the Sysprep.inf file is not updated to match the settings on the host. |
+
+ | + | + | 1 = true: The MachineObjectOU setting in the Sysprep.inf file is updated to match the settings on the host. |
+
SetRegionalSettingsEnabled |
+DWORD |
+Default=0 |
+Configures whether the settings under the [RegionalSettings] section of the Sysprep.inf file in the guest are updated to match the host. 0 = false; 1 = true. +
+Note
+
+By default, the setting for TimeZone in the guest is always synchronized with the TimeZone setting in the host. +
+
+ |
+
+ | + | + | 0 = false: The settings under the [RegionalSettings] section of the Sysprep.inf file in the guest are not updated to match the host. |
+
+ | + | + | 1 = true: The settings under the [RegionalSettings] section of the Sysprep.inf file in the guest are updated to match the host. |
+
SetUserDataEnabled |
+DWORD |
+Default=0 |
+Configures whether the FullName and the OrgName settings under the [UserData] section of the Sysprep.inf file in the guest are updated to match the settings on the host. 0 = false; 1 = true. |
+
+ | + | + | 0 = false: The FullName and OrgName settings in the Sysprep.inf file are not updated to match the settings on the host. |
+
+ | + | + | 1 = true: The FullName and OrgName settings in the Sysprep.inf file are updated to match the settings on the host. |
+
StartDialogMsg |
+MULTI_SZ |
+Message is found in resource file |
+Customizable message that is displayed to the end user when first time setup is ready to start. |
+
TaskCancelTimeout |
+DWORD |
+Default=30 |
+The time-out value, in seconds, that first time setup waits for a response from the virtual machine for a Cancel operation. Range = 0 to 2147483647. |
+
TaskVMTurnOffTimeout |
+DWORD |
+Default=60 |
+The time-out value, in seconds, that first time setup waits for the virtual machine to shut down. Range = 0 to 2147483647. |
+
UpgradeTimeout |
+DWORD |
+Default=600 |
+The time, in seconds, before an attempted upgrade of the MED-V Guest Agent software times out. Range = 0 to 2147483647. |
+
Name | +Type | +Data/Default | +Description | +
---|---|---|---|
AppPublishingEnabled |
+DWORD |
+Default=1 |
+Configures whether application publication from the guest to the host is enabled. 0 = false; 1 = true. |
+
+ | + | + | 0 = false: Disables application publishing from the guest to the host. |
+
+ | + | + | 1 = true: Enables application publishing from the guest to the host. |
+
AudioSharingEnabled |
+DWORD |
+Default=1 |
+Configures whether the sharing of the audio I/O device between the guest and the host is enabled. 0 = false; 1 = true. |
+
+ | + | + | 0 = false: Disables the sharing of the audio I/O device between the guest and the host. |
+
+ | + | + | 1 = true: Enables the sharing of the audio I/O device between the guest and the host. |
+
ClipboardSharingEnabled |
+DWORD |
+Default=1 |
+Configures whether the sharing of the Clipboard between the guest and the host is enabled. 0 = false; 1 = true. |
+
+ | + | + | 0 = false: Disables the sharing of the Clipboard between the guest and the host. |
+
+ | + | + | 1 = true: Enables the sharing of the Clipboard between the guest and the host. |
+
DialogTimeout |
+DWORD |
+Default=300 |
+The time, in seconds, before the first time setup Start Dialog times out. Range = 0 to 2147483647. |
+
HideVmTimeout |
+DWORD |
+Default=30 |
+The time-out value, in minutes, that the full-screen virtual machine window is hidden from the end user during a long logon attempt. |
+
LogonStartEnabled |
+DWORD |
+Default=1 |
+Configures whether the guest should be started when the end user logs on to the desktop or when the first guest application is started. 0 = false; 1 = true. |
+
+ | + | + | 0 = false: The guest is started when the first guest application is started. |
+
+ | + | + | 1 = true: The guest is started when the end user logs on to the desktop. |
+
PrinterSharingEnabled |
+DWORD |
+Default=1 |
+Configures whether the sharing of printers between the guest and the host is enabled. 0 = false; 1 = true. |
+
+ | + | + | 0 = false: Disables the sharing of printers between the guest and the host. |
+
+ | + | + | 1 = true: Enables the sharing of printers between the guest and the host. |
+
RebootAbsoluteDelayTimeout |
+DWORD |
+Default=1440 |
+The time-out value, in minutes, that first time setup waits for a restart. Range = 0 to 2147483647. |
+
RedirectUrls |
+MULTI_SZ |
+Specified URL list |
+Specifies a list of URLs to be redirected from the host to the guest. |
+
SmartCardLogonEnabled |
+DWORD |
+Default=0 |
+Configures whether smart cards can be used to authenticate users to MED-V. 0 = false; 1 = true. |
+
+ | + | + | 0 = false: Does not let Smart Cards authenticate end users to MED-V. |
+
+ | + | + | 1 = true: Lets Smart Cards authenticate end users to MED-V. +
+Important
+
+If SmartCardLogonEnabled and CredentialCacheEnabled are both enabled, SmartCardLogonEnabled overrides CredentialCacheEnabled. +
+
+ |
+
SmartCardSharingEnabled |
+DWORD |
+Default=1 |
+Configures whether the sharing of Smart Cards between the guest and the host is enabled. 0 = false; 1 = true. |
+
+ | + | + | 0 = false: Disables the sharing of Smart Cards between the guest and the host. |
+
+ | + | + | 1 = true: Enables the sharing of Smart Cards between the guest and the host. |
+
USBDeviceSharingEnabled |
+DWORD |
+Default=1 |
+Configures whether the sharing of USB devices between the guest and the host is enabled. 0 = false; 1 = true. |
+
+ | + | + | 0 = false: Disables the sharing of USB devices between the guest and the host. |
+
+ | + | + | 1 = true: Enables the sharing of USB devices between the guest and the host. |
+
Name | +Type | +Data/Default | +Description | +
---|---|---|---|
CloseAction |
+SZ |
+Default=HIBERNATE |
+The action that the virtual machine performs after the last application that is running is closed. This setting is ignored if the LogonStartEnabled value is enabled. Possible options are as follows: |
+
+ | + | + | HIBERNATE . This option releases all physical resources that the virtual machine is using, such as memory and CPU, and saves the state of all running applications and operations. |
+
+ | + | + | SHUTDOWN . This option shuts down the guest operating system safely and then releases all physical resources that the virtual machine is using, such as memory and CPU. |
+
+ | + | + | TURN-OFF. This option can cause data loss because it is the same as turning off the power button or pulling out the power cord on a physical computer. Use this option only if you cannot use one of the other two options. |
+
GuestMemFromHostMem |
+MULTI_SZ |
+378, 512, 1024, 1536, 2048 |
+A list of memory (MB) values for the guest. This value is used to determine how much RAM is available to the guest. Combined with HostMemToGuestMem, a lookup table is created to determine how much RAM to allocate on the guest virtual machine. Possible values can be from 128 to 3712. |
+
GuestUpdateDuration |
+DWORD |
+Default=240 |
+The number of minutes that MED-V should keep the guest awake for automatic updating, starting at the time specified in the GuestUpdateTime value. Range = 0 to 1440. Setting this value to zero (0) disables the guest patching functionality. +For more information about guest patching for automatic updating, see [Managing Automatic Updates for MED-V Workspaces](managing-automatic-updates-for-med-v-workspaces.md). |
+
GuestUpdateTime |
+SZ |
+Default=00:00 |
+The hour and minute each day when MED-V should wake up the guest for automatic updating, by using the 24-hour clock standard. Specify the time in the format HH:MM +For more information about guest patching for automatic updating, see [Managing Automatic Updates for MED-V Workspaces](managing-automatic-updates-for-med-v-workspaces.md). |
+
HostMemToGuestMem |
+MULTI_SZ |
+1024, 2048, 4096, 8192, 16384 |
+A list of memory (MB) values for the guest, determined by the RAM available on the host. Combined with GuestMemFromHostMem, a lookup table is created to determine how much RAM to allocate on the guest virtual machine. Possible values can be from 1024 to 16384. |
+
HostMemToGuestMemCalcEnabled |
+DWORD |
+Default=1 |
+Configures whether the memory allocated for the guest is calculated from the memory present on the host. 0 = false; 1 = true. |
+
+ | + | + | 0 = false: The memory allocated for the guest is not calculated from the memory present on the host. |
+
+ | + | + | 1 = true: The memory allocated for the guest is calculated from the memory present on the host. |
+
Memory |
+DWORD |
+Default=512 |
+The RAM (MB) that should be allocated for the guest virtual machine. This setting is ignored if the HostMemToGuestMemEnabled setting is enabled. Range=128 to 2048. |
+
MultiUserEnabled |
+DWORD |
+Default=0 |
+Configures whether multiple users share the same MED-V workspace. 0 = false; 1 = true. |
+
+ | + | + | 0 = false: Multiple users do not share the same MED-V workspace. |
+
+ | + | + | 1 = true: Multiple users share the same MED-V workspace. |
+
NetworkingMode |
+SZ |
+Default=NAT |
+The kind of network connection used on the guest. Possible values are as follows: |
+
+ | + | + | Bridged. MED-V has its own network address, typically obtained through DHCP. |
+
+ | + | + | NAT. MED-V uses Network Address Translation (NAT) to share the host's IP for outgoing traffic. |
+
TaskTimeout |
+DWORD |
+Default=600 |
+A general time-out value, in seconds, that MED-V waits for a task to be completed, such as restarting and shutting down. Range = 0 to 2147483647. |
+
Name | +Type | +Data/Default | +Description | +
---|---|---|---|
EnableGPWorkarounds |
+DWORD |
+Default=1 |
+Configures how MED-V handles the keys BufferPolicyReads and GroupPolicyMinTransferRate. |
+
+ | + | + | By default, MED-V sets these keys as follows: +BufferPolicyReads=1 and GroupPolicyMinTransferRate=0. +Create the EnableGPWorkarounds key, if it is necessary, and set the key to zero if you do not want MED-V to change the default settings of BufferPolicyReads and GroupPolicyMinTransferRate. +
+Note
+
+If your MED-V workspace is running in NAT mode, EnableGPWorkarounds affects the registry keys BufferPolicyReads and GroupPolicyMinTransferRate. If your MED-V workspace is running in BRIDGED mode, EnableGPWorkarounds only affects the registry key BufferPolicyReads. +
+
+
+1=true: MED-V sets the keys BufferPolicyReads=1 and GroupPolicyMinTransferRate=0 (if running in NAT mode) or just BufferPolicyReads=1 (if running in BRIDGED mode). +0=false: MED-V does not make any changes to the keys BufferPolicyReads and GroupPolicyMinTransferRate. |
+
Start MED-V workspace |
+ Choose whether to start the MED-V workspace at user logon, at first use, or to let the end user decide when the MED-V workspace starts. |
+
+ | The MED-V workspace starts in one of two ways: either when the end user logs on or when they first perform an action that requires MED-V, such as opening a published application or entering a URL that requires redirection. +You can either define this setting for the end user or let the end user control how MED-V starts. +
+ Note
+
+ If you specify that the end user decides, the default behavior they experience is that the MED-V workspace starts when they log on. They can change the default by right-clicking the MED-V icon in the notification area and selecting MED-V User Settings. If you define this setting for the end user, they cannot change the way in which MED-V starts. +
+
+ |
+
Networking |
+ Select Shared or Bridged for your networking setting. The default is Shared. |
+
+ | Shared - The MED-V workspace uses Network Address Translation (NAT) to share the host's IP for outgoing traffic. +Bridged - The MED-V workspace has its own network address, typically obtained through DHCP. |
+
Store credentials |
+ Choose whether you want to store the end user credentials. |
+
+ | The default behavior is that credential storing is disabled so that the end user must be authenticated every time that they log on. +
+ Important
+
+ Even though caching the end user’s credentials provides the best user experience, you should be aware of the risks involved. +The end user’s domain credential is stored in a reversible format in the Windows Credential Manager. An attacker could write a program that retrieves the password and thus gain access to the user’s credentials. You can only lessen this risk by disabling the storing of end user credentials. +
+
+ |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows 7 |
+Professional, Enterprise, or Ultimate |
+None or SP1 |
+x86 or x64 |
+
Operating System | +Minimum Required RAM | +
---|---|
Windows 7 x86 |
+2GB |
+
Windows 7 x64 |
+2GB |
+
Operating System | +Edition | +Service Pack | +System Architecture | +
---|---|---|---|
Windows XP |
+Professional Edition |
+SP3 |
+x86 |
+
Property | +Description | +
---|---|
Machine |
+Read Only property that contains the name of the guest virtual machine provisioned by first time setup. This key contains the name that the guest would have had on first time setup failure. |
+
StatusCode |
+Read Only property that contains zero if first time setup succeeded. Any other value returned equals the event ID for the error that is logged. |
+
Time |
+The UTC time that first time setup completed. |
+
User |
+The user for which first time setup was run. |
+
File type | +File location | +
---|---|
Group Policy template (.admx) |
+
|
+
Group Policy language file (.adml) |
+
|
+
File type | +File location | +
---|---|
Group Policy template (.admx) |
+
|
+
Group Policy language file (.adml) |
+
For example, the U.S. English ADML language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us. |
+
MDOP Technology | +Version bundles | +Notes | +
---|---|---|
Application Virtualization (App-V) |
+App-V 5.0 and App-V 5.0 Service Packs |
+[How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy](../appv-v5/how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md) |
+
User Experience Virtualization (UE-V) |
+UE-V 2.0 and UE-V 2.1 |
+[Configuring UE-V 2.x with Group Policy Objects](../uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md) |
+
+ | UE-V 1.0 including 1.0 SP1 |
+[Configuring UE-V with Group Policy Objects](../uev-v1/configuring-ue-v-with-group-policy-objects.md) |
+
Microsoft BitLocker Administration and Monitoring (MBAM) |
+MBAM 2.5 |
+[Planning for MBAM 2.5 Group Policy Requirements](../mbam-v25/planning-for-mbam-25-group-policy-requirements.md) |
+
+ | MBAM 2.0 including 2.0 SP1 |
+[Planning for MBAM 2.0 Group Policy Requirements](../mbam-v2/planning-for-mbam-20-group-policy-requirements-mbam-2.md) +[Deploying MBAM 2.0 Group Policy Objects](../mbam-v2/deploying-mbam-20-group-policy-objects-mbam-2.md) |
+
+ | MBAM 1.0 |
+[How to Edit MBAM 1.0 GPO Settings](../mbam-v1/how-to-edit-mbam-10-gpo-settings.md) |
+
UE-V Agent | +UE-V Generator | +
---|---|
|
+
|
+
0 |
+Setup completed successfully. |
+
2 |
+An older version of UE-V was used in attempting to uninstall. To uninstall UE-V, use the same version of UE-V that was used to install. |
+
3 |
+A newer version of UE-V was used to uninstall. To uninstall UE-V, use the same version of UE-V that was used to install. |
+
4 |
+Unexpected error from the setup program. |
+
5 |
+The Full version of UE-V cannot be installed on top of the Trial (Evaluation) version. Uninstall the Trial version and try again. |
+
6 |
+Unexpected error during installation. |
+
7 |
+The .NET 3.5 Framework was not found on Windows 7 or Windows Server2008 R2 computer. |
+
8 |
+The Offline Files feature is not enabled. |
+
9 |
+The UE-V setup program cannot determine whether UE-V is already installed or there was an error in the setup file. |
+
Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.) +20 Roszel Road +Princeton, NJ 08540 |
++ |
Telephone number from within the United States: |
+(800) 221-4792 |
+
Telephone number from outside the United States and Canada: |
+(609) 452-0606 |
+
Fax: |
+(609) 987-8116 |
+
[http://www.learningally.org/](http://go.microsoft.com/fwlink/p/?linkid=239) |
+Web addresses can change, so you might be unable to connect to the website or sites that are mentioned here. |
+
Task name | +Default trigger | +
---|---|
\Microsoft\UE-V\Template Auto Update |
+3:30 AM every day |
+
Task name | +Default trigger | +
---|---|
\Microsoft\UE-V\Settings Storage Location Status |
+ At logon of any user – After triggered, repeat every 30 minutes indefinitely. |
+
+ | Description | +
---|---|
![]() |
+Does this application contain settings that the user can customize? |
+
![]() |
+Is it important for the user that these settings roam? |
+
![]() |
+Are these user settings already managed by an application management or settings policy solution? UE-V applies application settings at application launch and Windows settings at logon, unlock, or remote connect events. If you use UE-V with other settings policy solutions, users might experience inconsistency across roamed settings. |
+
![]() |
+Are the application settings specific to the computer? Application preferences and customizations that are associated with hardware or specific computer configurations do not consistently roam across sessions and can cause a poor application experience. |
+
![]() |
+Does the application store settings in the Program Files directory or in the file directory that is located in the Users \ [User name] \ AppData \ LocalLow directory? Application data that is stored in either of these locations usually should not roam with the user, because this data is specific to the computer or because the data is too large to roam. |
+
![]() |
+Does the application store any settings in a file that contains other application data that should not roam? UE-V synchronizes files as a single unit. If settings are stored in files that include application data other than settings, then synchronizing this additional data may cause a poor application experience. |
+
![]() |
+How large are the files that contain the settings? The performance of the settings synchronization can be affected by large files. Including large files can impact the performance of settings synchronization. |
+
Policy setting name |
+Target |
+Policy setting description |
+Configuration options |
+
Use User Experience Virtualization (UE-V) |
+Computers and Users |
+This policy setting allows you to enable or disable User Experience Virtualization (UE-V). |
+Enable or disable this policy setting. |
+
Settings storage path |
+Computers and Users |
+This policy setting configures where the user settings will be stored. |
+Provide a Universal Naming Convention (UNC) path and variables such as \\Server\SettingsShare\%username%. |
+
Settings template catalog path |
+Computers Only |
+This policy setting configures where custom settings location templates are stored. This policy setting also configures whether the catalog will be used to replace the default Microsoft templates that are installed with the UE-V agent. |
+Provide a Universal Naming Convention (UNC) path such as \\Server\TemplateShare or a folder location on the computer. + +Select the check box to replace the default Microsoft templates. |
+
Do not use Offline Files |
+Computers and Users |
+This policy setting allows you to configure whether UE-V will use the Windows Offline Files feature. This policy setting also allows you to enable notification to occur when the import of user settings is delayed. |
+To configure the UE-V Agent to not use offline files, enable this setting. + +Specify if notifications should be given when settings import is delayed. + +Specify the length of time in seconds to wait before the notification appears. |
+
Synchronization timeout |
+Computers and Users |
+This policy setting configures the number of milliseconds that the computer waits before a timeout when retrieving user settings from the remote settings location. If the remote storage location is unavailable, the application launch is delayed by this many milliseconds. |
+Specify the preferred synchronization timeout in milliseconds. The default value of 2000 milliseconds. |
+
Package size warning threshold |
+Computers and Users |
+This policy setting allows you to configure the UE-V agent to report when a settings package file size reaches a defined threshold. |
+Specified the preferred threshold for settings package sizes in kilobytes. +By default, the UE-V agent does not have a package file size threshold. |
+
Roaming Application settings |
+Users Only |
+This policy setting configures the roaming of user settings of applications. |
+Select which Windows settings will roam between computers. +By default, the user settings of applications with settings template provided by UE-V are roamed between computers. |
+
Roaming Windows settings |
+Users Only |
+This policy setting configures the roaming of Windows settings. |
+Select which applications will roam between computers. +By default, Windows themes are roamed between computers of the same operating system version. Windows desktop settings and Ease of Access settings are not roamed. |
+
User account | +Recommended permissions | +
---|---|
Everyone |
+ No Permissions |
+
Security group of UE-V users |
+ Full Control |
+
User account | +Recommended permissions | +Folder | +
---|---|---|
Creator/Owner |
+ Full Control |
+ Subfolders and Files Only |
+
Security group of UE-V users |
+ List Folder/Read Data, Create Folders/Append Data |
+ This Folder Only |
+
User account | +Recommend permissions | +
---|---|
Everyone |
+ No Permissions |
+
Domain Computers |
+ Read Permission Levels |
+
Administrators |
+ Read/Write Permission Levels |
+
User Account | +Recommended Permissions | +Apply To | +
---|---|---|
Creator/Owner |
+ Full Control |
+ This Folder, Subfolders and Files |
+
Domain Computers |
+ List Folder Contents and Read |
+ This Folder, Subfolders and Files |
+
Everyone |
+ No Permissions |
+ No Permissions |
+
Administrators |
+ Full Control |
+ This Folder, Subfolders and Files |
+
Command-line parameter | +Definition | +Notes | +
---|---|---|
/help or /h or /? |
+Displays the AgentSetup.exe usage dialog. |
++ |
SettingsStoragePath |
+Indicates the Universal Naming Convention (UNC) path that defines where settings are stored. |
+%username% or %computername% environment variables are accepted. Scripting may require escaped variables. +Default: <none> (Active Directory user home) |
+
SettingsTemplateCatalogPath |
+Indicates the Universal Naming Convention (UNC) path that defines the location that was checked for new settings location templates. |
+Only required for custom settings location templates |
+
RegisterMSTemplates |
+Specifies whether the default Microsoft templates should be registered during installation. |
+True | False +Default: True |
+
SyncMethod |
+Specifies which synchronization method should be used. |
+OfflineFiles | None +Default: OfflineFiles |
+
SyncTimeoutInMilliseconds |
+Specifies the number of milliseconds that the computer waits before timeout when it retrieves user settings from the settings storage location. |
+Default: 2000 milliseconds +(wait up to 2 seconds) |
+
SyncEnabled |
+Specifies whether UE-V synchronization is enabled or disabled. |
+True | False +Default: True |
+
MaxPackageSizeInBytes |
+Specifies a settings package file size in bytes when the UE-V agent reports that files exceed the threshold. |
+<size> +Default: none (no warning threshold) |
+
CEIPEnabled |
+Specifies the setting for participation in the Customer Experience Improvement program. If set to true, then installer information is uploaded to the Microsoft Customer Experience Improvement Program site. If set to false, then no information is uploaded. |
+True | False +Default: False |
+
Deployment type | +Deployment description | +Example | +
---|---|---|
Command prompt |
+When you install the UE-V agent from a command prompt, use the %^username% variable format. If quotation marks are needed because of spaces in the settings storage path, use a batch script file for deployment. + |
+
|
+
Batch script |
+When you install the UE-V Agent from a batch script file, use the %%username%% variable format. If you use this install method, you must escape the variable with the %% characters. Without this character, the script expands the username variable at install time, rather than at run time, causing UE-V to use a single settings storage location for all users. |
+
|
+
PowerShell |
+When you install the UE-V agent from a PowerShell prompt or PowerShell script, use the %username% variable format. |
+
|
+
Electronic software distribution, such as deployment of Configuration Manager Software Deployment) |
+When you install the UE-V Agent with Configuration Manager, use the ^%username^% variable format. |
+
|
+
PowerShell command |
+ Description |
+
Get-UevConfiguration + |
+ View the effective UE-V agent settings. User-specific settings have precedence over the computer settings. |
+
Get-UevConfiguration - CurrentComputerUser + |
+ View the UE-V agent settings values for the current user only. |
+
Get-UevConfiguration -Computer |
+ View the UE-V agent configuration settings values for all users on the computer. |
+
Set-UevConfiguration -Computer -SettingsStoragePath <path to _settings_storage_location> |
+ Define a per-computer settings storage location. |
+
Set-UevConfiguration -CurrentComputerUser -SettingsStoragePath <path to _settings_storage_location> |
+ Define a per-user settings storage location. |
+
Set-UevConfiguration -Computer -SyncTimeoutInMilliseconds <timeout in milliseconds> |
+ Set the synchronization timeout in milliseconds |
+
Set-UevConfiguration -CurrentComputerUser -SyncTimeoutInMilliseconds <timeout in milliseconds> |
+ Set the synchronization timeout for the current user. |
+
Set-UevConfiguration -Computer -MaxPackageSizeInBytes <size in bytes> |
+ Configure the UE-V agent to report when a settings package file size reaches a defined threshold. Set the threshold package size in bytes. |
+
Set-UevConfiguration -CurrentComputerUser -MaxPackageSizeInBytes <size in bytes> |
+ Set the package size warning threshold for the current user. |
+
Set-UevConfiguration –Computer –SettingsTemplateCatalogPath <path to catalog> |
+ Set the settings template catalog path. |
+
Set-UevConfiguration -Computer -SyncMethod <sync method> |
+ Set the synchronization method: OfflineFiles or None. |
+
Set-UevConfiguration -CurrentComputerUser -SyncMethod <sync method> |
+ Set the synchronization method for the current user: OfflineFiles or None. |
+
Set-UEVConfiguration -Computer –EnableSettingsImportNotify |
+ Enable notification to occur when the import of user settings is delayed. +Use –DisableSettingsImportNotify to disable notification. |
+
Set-UEVConfiguration - CurrentComputerUser -EnableSettingsImportNotify |
+ Enable notification for the current user when the import of user settings is delayed. +Use –DisableSettingsImportNotify to disable notification. |
+
Set-UEVConfiguration -Computer -SettingsImportNotifyDelayInSeconds |
+ Specify the time in seconds before the user is notified |
+
Set-UEVConfiguration - CurrentComputerUser -SettingsImportNotifyDelayInSeconds |
+ Specify the time in seconds before notification for the current user. |
+
Set-UevConfiguration –Computer –DisableSync |
+ Disable UE-V for all the users on the computer. +Use –EnableSync to enable or re-enable. |
+
Set-UevConfiguration –CurrentComputerUser -DisableSync |
+ Disable UE-V for the current user on the computer. +Use –EnableSync to enable or re-enable. |
+
Clear-UevConfiguration –Computer -<setting name> |
+ Clear a specific setting for all users on the computer. |
+
Clear-UevConfiguration –CurrentComputerUser -<setting name> |
+ Clear a specific setting for the current user only. |
+
Export-UevConfiguration <settings migration file> |
+ Export the UE-V computer configuration to a settings migration file. The extension of the file must be “.uev”. +The export cmdlet exports all UE-V agent settings that are configurable with the -computer parameter. |
+
Import-UevConfiguration <settings migration file> |
+ Import the UE-V computer configuration from a settings migration file (.uev file). |
+
PowerShell command |
+ Description |
+
Export-UevPackage MicrosoftCalculator6.pkgx |
+ Extracts the settings from a Microsoft Calculator package file and converts them into a human-readable format in XML. |
+
Repair-UevTemplateIndex |
+ Repairs the index of the UE-V settings location templates. |
+
PowerShell command | +Description | +
---|---|
Get-WmiObject -Namespace root\Microsoft\UEV Configuration + |
+ View the active UE-V agent settings. User-specific settings have precedence over the computer settings. |
+
Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguration |
+ View the UE-V agent configuration that is defined for user. |
+
Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration |
+ View the UE-V agent configuration that is defined for computer. |
+
$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration +$config.SettingsStoragePath = <path_to_settings_storage_location> +$config.Put() |
+ Define a per-computer settings storage location. |
+
$config = Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguration +$config.SettingsStoragePath = <path_to_settings_storage_location> +$config.Put() |
+ Define a per-user settings storage location. |
+
$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration +$config.SyncTimeoutInMilliseconds = <timeout_in_milliseconds> +$config.Put() |
+ Set the synchronization timeout in milliseconds. |
+
$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration +$config.MaxPackageSizeInBytes = <size_in_bytes> +$config.Put() |
+ Configure the UE-V agent to report when a settings package file size reaches a defined threshold. Set the threshold package file size in bytes. |
+
$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration +$config.SyncMethod = <sync_method> +$config.Put() |
+ Set the synchronization method: OfflineFiles or None. |
+
$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration +$config.<setting name> = <setting value> +$config.Put() |
+ Update a specific per-computer setting. To clear the setting, use $null as the setting value. |
+
$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration +$config.<setting name> = <setting value> +$config.Put() |
+ Update a specific per-user setting. To clear the setting, use $null as the setting value. |
+
PowerShell command | +Description | +
---|---|
Get-UevTemplate |
+ Lists all the settings location templates registered on the computer. |
+
Register-UevTemplate |
+ Registers a settings location template with UE-V. Once a template is registered, UE-V will synchronize the settings that are defined in the template between computers that have the template registered. |
+
Unregister-UevTemplate |
+ Unregisters a settings location template with UE-V. As soon as a template is unregistered, UE-V will no longer synchronize the settings that are defined in the template between computers. |
+
Update-UevTemplate |
+ Updates a settings location template with a more recent version of the template. The new template should have a version that is later than the existing one. |
+
Disable-UevTemplate |
+ Disables a settings location template for the current user of the computer. |
+
Enable-UevTemplate |
+ Enables a settings location template for the current user of the computer. |
+
Test-UevTemplate |
+ Determines whether a given settings location template complies with its XML schema. |
+
PowerShell command |
+ Description |
+
Get-WmiObject -Namespace root\Microsoft\UEV SettingsLocationTemplate | Select-Object TemplateId,TemplateName, TemplateVersion,Enabled | Format-Table -Autosize |
+ Lists all the settings location templates registered for the computer. |
+
Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Register -ArgumentList <template path > |
+ Registers a settings location template with UE-V. |
+
Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name UnregisterByTemplateId -ArgumentList <template ID> |
+ Unregisters a settings location template with UE-V. As soon as a template is unregistered, UE-V will no longer synchronize the settings that are defined in the template between computers. |
+
Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name EnableByTemplateId -ArgumentList <template ID> |
+ Enables a settings location template with UE-V |
+
Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name DisableByTemplateId -ArgumentList <template ID> |
+ Disables a settings location template with UE-V |
+
Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Update -ArgumentList <template path> |
+ Updates a settings location template with UE-V. The new template should have a version that is higher than the existing one. |
+
Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Validate -ArgumentList <template path> |
+ Determines whether a given settings location template complies with its XML schema. |
+
Application category | +Description | +
---|---|
Microsoft Office 2010 applications |
+Microsoft Word 2010 +Microsoft Excel 2010 +Microsoft Outlook 2010 +Microsoft Access 2010 +Microsoft Project 2010 +Microsoft PowerPoint 2010 +Microsoft Publisher 2010 +Microsoft Visio 2010 +Microsoft SharePoint Workspace 2010 +Microsoft InfoPath 2010 +Microsoft Lync 2010 +Microsoft OneNote 2010 |
+
Browser options (Internet Explorer 8, Internet Explorer 9, and Internet Explorer 10) |
+Favorites, home page, tabs, and toolbars. |
+
Windows accessories |
+Calculator, Notepad, WordPad. |
+
Windows settings | +Description | +Apply on | +Default state | +
---|---|---|---|
Desktop background |
+Currently active desktop background. |
+Logon, unlock, remote connect. |
+Enabled |
+
Ease of Access |
+Accessibility and input settings, magnifier, Narrator, and on-Screen keyboard. |
+Logon, unlock, remote connect. |
+Disabled |
+
Desktop settings |
+Start menu and Taskbar settings, Folder options, default desktop icons, additional clocks, and region and Language settings. |
+Logon only. |
+Disabled |
+
PowerShell cmdlet | +Description | +
---|---|
Restore-UevUserSetting |
+ Restores the user settings for an application or restores a group of Windows settings |
+
WMI command | +Description | +
---|---|
Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserSettings -Name RestoreByTemplateId -ArgumentList <template_ID> |
+ Restores the user settings for an application or restores a group of Windows settings |
+
Operating system | +Edition | +Service pack | +System architecture | +Microsoft .NET Framework | +
---|---|---|---|---|
Windows 7 |
+Ultimate, Enterprise, or Professional Edition |
+SP1 |
+32-bit or 64-bit |
+.NET Framework 3.5 SP1 +.NET Framework 4 (Generator) |
+
Windows Server 2008 R2 |
+Standard, Enterprise, Data Center, or Web Server |
+SP1 |
+64-bit |
+.NET Framework 3.5 SP1 +.NET Framework 4 (Generator) |
+
Windows 8 |
+Enterprise or Professional Edition |
+None |
+32-bit or 64-bit |
+.NET Framework 4 or .NET Framework 3.5 SP1 (Agent) +.NET Framework 4 (Generator) |
+
Windows Server 2012 |
+Standard or Datacenter |
+None |
+64-bit |
+.NET Framework 4 or .NET Framework 3.5 SP1 (Agent) +.NET Framework 4 (Generator) |
+
User account | +Recommended permissions | +
---|---|
Everyone |
+ No Permissions |
+
Security group of UE-V |
+ Full Control |
+
User account | +Recommended permissions | +Folder | +
---|---|---|
Creator/Owner |
+ No Permissions |
+ No Permissions |
+
Domain Admins |
+ Full Control |
+ This Folder, Subfolders and Files |
+
Security group of UE-V users |
+ List Folder/Read Data, Create Folders/Append Data |
+ This Folder Only |
+
Everyone |
+ Remove all Permissions |
+ No Permissions |
+
User account | +Recommend permissions | +
---|---|
Everyone |
+ No Permissions |
+
Domain Computers |
+ Read Permission Levels |
+
Administrators |
+ Read/Write Permission Levels |
+
User account | +Recommended permissions | +Apply to | +
---|---|---|
Creator/Owner |
+ Full Control |
+ This Folder, Subfolders and Files |
+
Domain Computers |
+ List Folder Contents and Read |
+ This Folder, Subfolders and Files |
+
Everyone |
+ No Permissions |
+ No Permissions |
+
Administrators |
+ Full Control |
+ This Folder, Subfolders and Files |
+
Task | +References | +
---|---|
Review the Getting Started information about UE-V to gain a basic understanding of the product before you begin the deployment planning. |
+[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) |
+
Prepare your environment for UE-V 1.0 deployment. |
+[Preparing Your Environment for UE-V](preparing-your-environment-for-ue-v.md) |
+
Plan which applications end users can synchronize with UE-V 1.0. |
+[Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md) |
+
Custom settings templates only - create custom settings location templates and then define a setting template catalog. |
+[Deploying the Settings Template Catalog for UE-V 1.0](deploying-the-settings-template-catalog-for-ue-v-10.md) +[Create UE-V Settings Location Templates with the UE-V Generator](create-ue-v-settings-location-templates-with-the-ue-v-generator.md) |
+
Decide which method of configuration (Group Policy, PowerShell, ESD-command line, or batch file) works best for your environment and plan how to configure UE-V 1.0. |
+[Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md) |
+
Deploy the network share to store settings packages. |
+[Deploying the Settings Storage Location for UE-V 1.0](deploying-the-settings-storage-location-for-ue-v-10.md) |
+
Custom settings templates only – deploy the features that are required to create and store applications other than the UE-V default applications. |
+[Deploying the Settings Template Catalog for UE-V 1.0](deploying-the-settings-template-catalog-for-ue-v-10.md) +[Installing the UE-V Generator](installing-the-ue-v-generator.md) +[Using the UE-V Generator](4ee6e2f1-35ee-426e-9aaa-528c3f04a305) |
+
Familiarize yourself with the administration and management tasks for UE-V. |
+[Administering UE-V 1.0](administering-ue-v-10.md) |
+
Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.) +20 Roszel Road +Princeton, NJ 08540 |
++ |
Telephone number from within the United States: |
+(800) 221-4792 |
+
Telephone number from outside the United States and Canada: |
+(609) 452-0606 |
+
Fax: |
+(609) 987-8116 |
+
[http://www.learningally.org/](http://go.microsoft.com/fwlink/p/?linkid=239) |
+Web addresses can change, so you might be unable to connect to the website or sites that are mentioned here. |
+
Element |
+Data Type |
+Mandatory |
+
Filename |
+FilenameString |
+True |
+
Architecture |
+Architecture |
+False |
+
ProductName |
+String |
+False |
+
FileDescription |
+String |
+False |
+
ProductVersion |
+ProcessVersion |
+False |
+
FileVersion |
+ProcessVersion |
+False |
+
Element |
+Description |
+
Asynchronous |
+Asynchronous settings packages are applied without blocking the application startup so that the application start proceeds while the settings are still being applied. This is useful for settings that can be applied asynchronously, such as those |
+
PreventOverlappingSynchronization |
+By default, UE-V only saves settings for an application when the last instance of an application using the template is closed. When this element is set to ‘false’, UE-V exports the settings even if other instances of an application are running. Suited templates – those that include a Common element section– that are shipped with UE-V use this flag to enable shared settings to always export on application close, while preventing application-specific settings from exporting until the last instance is closed. |
+
AlwaysApplySettings |
+(introduced in 2.1) +This parameter forces an imported settings package to be applied even if there are no differences between the package and the current state of the application. This parameter should be used only in special cases since it can slow down settings import. |
+
Field/Type |
+Description |
+
Name |
+Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name21). |
+
ID |
+Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see [ID](#id21). |
+
Description |
+An optional description of the template. |
+
LocalizedNames |
+An optional name displayed in the UI, localized by a language locale. |
+
LocalizedDescriptions |
+An optional template description localized by a language locale. |
+
Version |
+Identifies the version of the settings location template for administrative tracking of changes. For more information, see [Version](#version21). |
+
DeferToMSAccount |
+Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled. |
+
DeferToOffice365 |
+Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled. |
+
FixedProfile (Introduced in 2.1) |
+Specifies that this template can only be associated with the profile specified within this element, and cannot be changed via WMI or PowerShell. |
+
Processes |
+A container for a collection of one or more Process elements. For more information, see [Processes](#processes21). |
+
Settings |
+A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in [Data types](#data21). |
+
Field/Type |
+Description |
+
Name |
+Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name21). |
+
ID |
+Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see [ID](#id21). |
+
Description |
+An optional description of the template. |
+
LocalizedNames |
+An optional name displayed in the UI, localized by a language locale. |
+
LocalizedDescriptions |
+An optional template description localized by a language locale. |
+
Version |
+Identifies the version of the settings location template for administrative tracking of changes. For more information, see [Version](#version21). |
+
DeferToMSAccount |
+Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled. |
+
DeferToOffice365 |
+Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled. |
+
FixedProfile (Introduced in 2.1) |
+Specifies that this template can only be associated with the profile specified within this element, and cannot be changed via WMI or PowerShell. |
+
Settings |
+A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in [Data types](#data21). |
+
Field/Type |
+Description |
+
Name |
+Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name21). |
+
ID |
+Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see [ID](#id21). |
+
Description |
+An optional description of the template. |
+
LocalizedNames |
+An optional name displayed in the UI, localized by a language locale. |
+
LocalizedDescriptions |
+An optional template description localized by a language locale. |
+
Element | +Data Type | +Mandatory | +
---|---|---|
Filename |
+FilenameString |
+True |
+
Architecture |
+Architecture |
+False |
+
ProductName |
+String |
+False |
+
FileDescription |
+String |
+False |
+
ProductVersion |
+ProcessVersion |
+False |
+
FileVersion |
+ProcessVersion |
+False |
+
Element | +Description | +
---|---|
Asynchronous |
+Asynchronous settings packages are applied without blocking the application startup so that the application start proceeds while the settings are still being applied. This is useful for settings that can be applied asynchronously, such as those |
+
PreventOverlappingSynchronization |
+By default, UE-V only saves settings for an application when the last instance of an application using the template is closed. When this element is set to ‘false’, UE-V exports the settings even if other instances of an application are running. Suited templates – those that include a Common element section– that are shipped with UE-V use this flag to enable shared settings to always export on application close, while preventing application-specific settings from exporting until the last instance is closed. |
+
Field/Type | +Description | +
---|---|
Name |
+Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name). |
+
ID |
+Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see [ID](#id). |
+
Description |
+An optional description of the template. |
+
LocalizedNames |
+An optional name displayed in the UI, localized by a language locale. |
+
LocalizedDescriptions |
+An optional template description localized by a language locale. |
+
Version |
+Identifies the version of the settings location template for administrative tracking of changes. For more information, see [Version](#version). |
+
DeferToMSAccount |
+Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled. |
+
DeferToOffice365 |
+Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled. |
+
Processes |
+A container for a collection of one or more Process elements. For more information, see [Processes](#processes). |
+
Settings |
+A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in [Data types](#data). |
+
Field/Type | +Description | +
---|---|
Name |
+Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name). |
+
ID |
+Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see [ID](#id). |
+
Description |
+An optional description of the template. |
+
LocalizedNames |
+An optional name displayed in the UI, localized by a language locale. |
+
LocalizedDescriptions |
+An optional template description localized by a language locale. |
+
Version |
+Identifies the version of the settings location template for administrative tracking of changes. For more information, see [Version](#version). |
+
DeferToMSAccount |
+Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled. |
+
DeferToOffice365 |
+Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled. |
+
Settings |
+A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in [Data types](#data). |
+
Field/Type | +Description | +
---|---|
Name |
+Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name). |
+
ID |
+Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see [ID](#id). |
+
Description |
+An optional description of the template. |
+
LocalizedNames |
+An optional name displayed in the UI, localized by a language locale. |
+
LocalizedDescriptions |
+An optional template description localized by a language locale. |
+
Task name | +Default event | +
---|---|
\Microsoft\UE-V\Collect CEIP data |
+Logon |
+
Task name | +Default event | +
---|---|
\Microsoft\UE-V\Monitor Application Status |
+Logon |
+
Task name | +Default event | +
---|---|
\Microsoft\UE-V\Sync Controller Application |
+Logon, and every 30 minutes thereafter |
+
Task name | +Default event | +
---|---|
\Microsoft\UE-V\Synchronize Settings at Logoff |
+Logon |
+
Task name | +Default event | +
---|---|
\Microsoft\UE-V\Template Auto Update |
+System startup and at 3:30 AM every day, at a random time within a 1-hour window |
+
Task name | +Default event | +
---|---|
\Microsoft\UE-V\Upload CEIP data |
+At logon and every 4 hours |
+
Task Name (file name) |
+Default Frequency |
+Power Toggle |
+Idle Only |
+Network Connection |
+Description |
+
Monitor Application Settings (UevAppMonitor.exe) |
+Starts 30 seconds after logon and continues until logoff. |
+No |
+Yes |
+N/A |
+Synchronizes settings for Windows (AppX) apps. |
+
Sync Controller Application (Microsoft.Uev.SyncController.exe) |
+At logon and every 30 min thereafter. |
+Yes |
+Yes |
+Only if Network is connected |
+Starts the Sync Controller which synchronizes local settings with the settings storage location. |
+
Synchronize Settings at Logoff (Microsoft.Uev.SyncController.exe) |
+Runs at logon and then waits for Logoff to Synchronize settings. |
+No |
+Yes |
+N/A |
+Start an application at logon that controls the synchronization of applications at logoff. |
+
Template Auto Update (ApplySettingsCatalog.exe) |
+Runs at initial logon and at 3:30 AM every day thereafter. |
+Yes |
+No |
+N/A |
+Checks the settings template catalog for new, updated, or removed templates. This task only runs if SettingsTemplateCatalog is configured. |
+
Collect CEIP data (UevSqmSession.exe) |
+At logon launches service |
+No |
+Yes |
+N/A |
+If the user or administrator opts in to the Customer Experience Improvement Program (CEIP), this task collects data that helps improve UE-V future releases. |
+
Upload CEIP Data (UevSqmUploader.exe) |
+Runs at logon and at 4:00 AM every day thereafter. |
+No |
+Yes |
+Only if Network is connected |
+If the user or administrator opts in to the Customer Experience Improvement Program (CEIP), this task uploads the data to the CEIP servers. |
+
Group Policy setting name | +Target | +Group Policy setting description | +Configuration options | +
---|---|---|---|
Contact IT Link Text |
+Computers Only |
+This Group Policy setting specifies the text of the Contact IT URL hyperlink in the Company Settings Center. |
+If you enable this Group Policy setting, the Company Settings Center displays the specified text in the link to the Contact IT URL. |
+
Contact IT URL |
+Computers Only |
+This Group Policy setting specifies the URL for the Contact IT link in the Company Settings Center. |
+If you enable this setting, the Company Settings Center Contact IT text links to the specified URL. The link can be of any standard protocol, such as HTTP or mailto. |
+
Do not use the sync provider |
+Computers and Users |
+By using this Group Policy setting, you can configure whether UE-V uses the sync provider feature. This policy setting also lets you enable notification to appear when the import of user settings is delayed. |
+Enable this setting to configure the UE-V Agent not to use the sync provider. |
+
First Use Notification |
+Computers Only |
+This Group Policy setting enables a notification in the notification area that appears when the UE-V +agent runs for the first time. |
+The default is enabled. |
+
Roam Windows settings |
+Computers and Users |
+This Group Policy setting configures the synchronization of Windows settings. |
+Select which Windows settings synchronize between computers. +By default, Windows themes, desktop settings, and Ease of Access settings synchronize settings between computers of the same operating system version. |
+
Settings package size warning threshold |
+Computers and Users |
+This Group Policy setting lets you configure the UE-V Agent to report when a settings package file size reaches a defined threshold. |
+Specify the preferred threshold for settings package sizes in kilobytes (KB). +By default, the UE-V Agent does not have a package file size threshold. |
+
Settings storage path |
+Computers and Users |
+This Group Policy setting configures where the user settings are to be stored. |
+Enter a Universal Naming Convention (UNC) path and variables such as \\Server\SettingsShare\%username%. |
+
Settings template catalog path |
+Computers Only |
+This Group Policy setting configures where custom settings location templates are stored. This policy setting also configures whether the catalog is to be used to replace the default Microsoft templates that are installed with the UE-V Agent. |
+Enter a Universal Naming Convention (UNC) path such as \\Server\TemplateShare or a folder location on the computer. +Select the check box to replace the default Microsoft templates. |
+
Sync settings over metered connections |
+Computers and Users |
+This Group Policy setting defines whether UE-V synchronizes settings over metered connections. |
+By default, the UE-V Agent does not synchronize settings over a metered connection. |
+
Sync settings over metered connections even when roaming |
+Computers and Users |
+This Group Policy setting defines whether UE-V synchronizes settings over metered connections outside of the home provider network, for example, when the data connection is in roaming mode. |
+By default, UE-V does not synchronize settings over a metered connection when it is in roaming mode. |
+
Synchronization timeout |
+Computers and Users |
+This Group Policy setting configures the number of milliseconds that the computer waits before a time-out when it retrieves user settings from the remote settings location. If the remote storage location is unavailable, and the user does not use the sync provider, the application start is delayed by this many milliseconds. |
+Specify the preferred synchronization time-out in milliseconds. The default value is 2000 milliseconds. |
+
Tray Icon |
+Computers Only |
+This Group Policy setting enables the User Experience Virtualization (UE-V) tray icon. |
+The default is enabled. |
+
Use User Experience Virtualization (UE-V) |
+Computers and Users |
+This Group Policy setting lets you enable or disable User Experience Virtualization (UE-V). |
+Enable or disable this Group Policy setting. |
+
Group Policy setting name | +Target | +Group Policy setting description | +Configuration options | +
---|---|---|---|
Do not synchronize Windows Apps |
+Computers and Users |
+This Group Policy setting defines whether the UE-V Agent synchronizes settings for Windows apps. |
+The default is to synchronize Windows apps. |
+
Windows App List |
+Computer and User |
+This setting lists the family package names of the Windows apps and states expressly whether UE-V synchronizes that app’s settings. |
+You can use this setting to specify that settings of an app are never synchronized by UE-V, even if the settings of all other Windows apps are synchronized. |
+
Sync Unlisted Windows Apps |
+Computer and User |
+This Group Policy setting defines the default settings sync behavior of the UE-V Agent for Windows apps that are not explicitly listed in the Windows app list. |
+By default, the UE-V Agent only synchronizes settings of those Windows apps that are included in the Windows app list. |
+
Max package size |
+ Enable/disable Windows app sync |
+ Wait for sync on application start |
+
Setting import delay |
+ Sync unlisted Windows apps |
+ Wait for sync on logon |
+
Settings import notification |
+ IT contact URL |
+ Wait for sync timeout |
+
Settings storage path |
+ IT contact descriptive text |
+ Settings template catalog path |
+
Sync enablement |
+ Tray icon enabled |
+ Start/Stop UE-V agent service |
+
Sync method |
+ First use notification |
+ Define which Windows apps will roam settings |
+
Sync timeout |
+ + | + |
User account | +Recommended permissions | +
---|---|
Everyone |
+ No permissions |
+
Security group of UE-V users |
+ Full control |
+
User account | +Recommended permissions | +Folder | +
---|---|---|
Creator/owner |
+ Full control |
+ Subfolders and files only |
+
Security group of UE-V users |
+ List folder/read data, create folders/append data |
+ This folder only |
+
Deployment type | +Deployment description | +Example | +
---|---|---|
Command prompt |
+When you install the UE-V Agent at a command prompt, use the %^username% variable format. If quotation marks are required because of spaces in the settings storage path, use a batch script file for deployment. + |
+
|
+
Batch script |
+When you install the UE-V Agent from a batch script file, use the %%username%% variable format. If you use this installation method, you must escape the variable with the %% characters. Without this character, the script expands the username variable at installation time, rather than at run time, which causes UE-V to use a single settings storage location for all users. |
+
|
+
Windows PowerShell |
+When you install the UE-V Agent from a Windows PowerShell prompt or a Windows PowerShell script, use the %username% variable format. |
+
|
+
Electronic software distribution, such as deployment of Configuration Manager Software Deployment |
+When you install the UE-V Agent by using Configuration Manager, use the ^%username^% variable format. |
+
|
+
Command-line parameter | +Definition | +Notes | +
---|---|---|
/help or /h or /? |
+Displays the AgentSetup.exe usage dialog box. |
++ |
SettingsStoragePath |
+Indicates the Universal Naming Convention (UNC) path that defines where settings are stored. |
+
+Important
+
+You must specify a SettingsStoragePath in UE-V 2.1 and UE-V 2.1 SP1. You can set the AdHomePath string to specify that the user's Active Directory home path is used. For example, In UE-V 2.0, you can leave SettingsStoragePath blank to use the Active Directory home path instead. +
+
+
+%username% or %computername% environment variables are accepted. Scripting can require escaped variables. +Default: <none> |
+
SettingsStoragePathReg |
+Gets the SettingsStoragePath value from the registry during installation. |
+At the command prompt, type the following example to force UE-V to use the Active Directory home path instead of a specific UNC. +
|
+
SettingsTemplateCatalogPath |
+Indicates the Universal Naming Convention (UNC) path that defines the location that was checked for new settings location templates. |
+Only required for custom settings location templates |
+
RegisterMSTemplates |
+Specifies whether the default Microsoft templates should be registered during installation. |
+True | False +Default: True |
+
SyncMethod |
+Specifies which synchronization method should be used. |
+SyncProvider | None +Default: SyncProvider |
+
SyncTimeoutInMilliseconds |
+Specifies the number of milliseconds that the computer waits before time-out when it retrieves user settings from the settings storage location. |
+Default: 2000 milliseconds +(wait up to 2 seconds) |
+
SyncEnabled |
+Specifies whether UE-V synchronization is enabled or disabled. |
+True | False +Default: True |
+
MaxPackageSizeInBytes |
+Specifies a settings package file size in bytes when the UE-V Agent reports that files exceed the threshold. |
+<size> +Default: none (no warning threshold) |
+
CEIPEnabled |
+Specifies the setting for participation in the Customer Experience Improvement program. If set to True, installer information is uploaded to the Microsoft Customer Experience Improvement Program site. If set to False, no information is uploaded. |
+True | False +Default: False |
+
NoRestart |
+Supports deferral of the restart of the computer after the UE-V Agent is installed. |
++ |
INSTALLFOLDER |
+Enables a different installation folder to be set for the UE-V Agent or UE-V Generator. |
++ |
MUENABLED |
+Enables Setup to accept the option to be included in the Microsoft Update program. |
++ |
ACCEPTLICENSETERMS |
+Lets UE-V be installed silently. This must be set to True to install UE-V silently and bypass the requirement that the user accepts the UE-V license terms. If set to False or left empty, the user receives an error message and UE-V is not installed. |
+
+Important
+
+This parameter is required to install UE-V silently. +
+
+ |
+
NORESTART |
+Prevents a mandatory restart after the UE-V Agent is installed. |
++ |
User account | +Recommended permissions | +
---|---|
Everyone |
+ No Permissions |
+
Domain Computers |
+ Read Permission Levels |
+
Administrators |
+ Read/Write Permission Levels |
+
User account | +Recommended permissions | +Apply to | +
---|---|---|
Creator/Owner |
+ Full Control |
+ This Folder, Subfolders and Files |
+
Domain Computers |
+ List Folder Contents and Read |
+ This Folder, Subfolders and Files |
+
Everyone |
+ No Permissions |
+ No Permissions |
+
Administrators |
+ Full Control |
+ This Folder, Subfolders and Files |
+
Operating system | +Edition | +Service pack | +System architecture | +Windows PowerShell | +Microsoft .NET Framework | +
---|---|---|---|---|---|
Windows 7 |
+Ultimate, Enterprise, or Professional Edition |
+SP1 |
+32-bit or 64-bit |
+Windows PowerShell 3.0 or higher |
+.NET Framework 4 or higher |
+
Windows Server 2008 R2 |
+Standard, Enterprise, Datacenter, or Web Server |
+SP1 |
+64-bit |
+Windows PowerShell 3.0 or higher |
+.NET Framework 4 or higher |
+
Windows 8 and Windows 8.1 |
+Enterprise or Pro |
+None |
+32-bit or 64-bit |
+Windows PowerShell 3.0 or higher |
+.NET Framework 4.5 |
+
Windows Server 2012 or Windows Server 2012 R2 |
+Standard or Datacenter |
+None |
+64-bit |
+Windows PowerShell 3.0 or higher |
+.NET Framework 4.5 |
+
User account | +Recommended permissions | +
---|---|
Everyone |
+ No permissions |
+
Security group of UE-V users |
+ Full control |
+
User account | +Recommended permissions | +Folder | +
---|---|---|
Creator/owner |
+ Full control |
+ Subfolders and files only |
+
Security group of UE-V users |
+ List folder/read data, create folders/append data |
+ This folder only |
+
Component | +Function | +
---|---|
UE-V Agent |
+Installed on every computer that needs to synchronize settings, the UE-V Agent monitors registered applications and the operating system for any settings changes, then synchronizes those settings between computers. |
+
Settings packages |
+Application settings and Windows settings are stored in settings packages created by the UE-V Agent. Settings packages are built, locally stored, and copied to the settings storage location. +
The sync provider determines when the application or operating system settings are read from the Settings Packages and synchronized. |
+
Settings storage location |
+This is a standard network share that your users can access. The UE-V Agent verifies the location and creates a hidden system folder in which to store and retrieve user settings. |
+
Settings location templates |
+UE-V uses XML files as settings location templates to monitor and synchronize desktop application settings and Windows desktop settings between user computers. By default, some settings location templates are included in UE-V . You can also create, edit, or validate custom settings location templates by [managing settings synchronization for custom applications](#customapps). +
+Note
+
+Settings location templates are not required for Windows apps. +
+
+ |
+
Windows app list |
+Settings for Windows apps are captured and applied dynamically. The app developer specifies the settings that are synchronized for each app. UE-V determines which Windows apps are enabled for settings synchronization using a managed list of apps. By default, this list includes most Windows apps. +You can add or remove applications in the Windows app list by following the procedures shown [here](http://technet.microsoft.com/library/dn458925.aspx). |
+
UE-V Generator |
+Use the UE-V Generator to create custom settings location templates that you can then distribute to user computers. The UE-V Generator also lets you edit an existing template or validate a template that was created by using another XML editor. |
+
Settings template catalog |
+The settings template catalog is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores the custom settings location templates. The UE-V Agent checks this location once a day, retrieves new or updated templates, and updates its synchronization behavior. +If you use only the UE-V default settings location templates, then a settings template catalog is unnecessary. For more information about settings deployment catalogs, see [Configure a UE-V settings template catalog](http://technet.microsoft.com/library/dn458942.aspx#deploycatalogue). |
+
Feature | +Synchronize Profiles using Windows 7 | +Synchronize Profiles using Windows 8 | +Synchronize Profiles using Windows 10 | +Microsoft account | +UE-V 2.0 | +UE-V 2.1 and 2.1 SP1 | +
---|---|---|---|---|---|---|
Synchronize settings between multiple computers |
+● |
+● |
+● |
+● |
+● |
+● |
+
Synchronize settings between physical and virtual apps |
++ | + | + | + | ● |
+● |
+
Synchronize Windows app settings |
++ | + | + | ● |
+● |
+● |
+
Manage via WMI |
++ | ● |
+● |
++ | ● |
+● |
+
Synchronize settings changes on a regular basis |
++ | + | + | ● |
+● |
+● |
+
Minimal configuration for Setup |
+● |
+● |
+● |
+● |
+● |
+● |
+
Supported on non-domain joined computers |
++ | + | + | ● |
++ | + |
Supports Primary Computer Active Directory attribute |
++ | ● |
+● |
++ | + | + |
Synchronizes settings between virtual desktop infrastructure (VDI)/Remote Desktop Services (RDS) and rich desktops |
++ | + | + | + | ● |
+● |
+
Unlimited setting storage space |
+● |
+● |
+● |
++ | ● |
+● |
+
Choice in which app settings to synchronize |
++ | + | + | + | ● |
+● |
+
Backup/Restore for IT Pro |
++ | + | + | ● |
+Partial |
+● |
+
Windows PowerShell cmdlet | +Description | +
---|---|
|
+ Restores the user settings for an application or restores a group of Windows settings. |
+
WMI command | +Description | +
---|---|
|
+ Restores the user settings for an application or restores a group of Windows settings. |
+
Windows PowerShell command | +Description | +
---|---|
|
+ Gets the effective UE-V Agent settings. User-specific settings have precedence over the computer settings. |
+
|
+ Gets the UE-V Agent settings values for the current user only. |
+
|
+ Gets the UE-V Agent configuration settings values for all users on the computer. |
+
|
+ Gets the details for each configuration setting. Displays where the setting is configured or if it uses the default value. Is displayed if the current setting is valid. |
+
|
+ Sets the text that is displayed in the Company Settings Center for the help link. |
+
|
+ Sets the URL of the link in the Company Settings Center for the help link. Any URL protocol can be used. |
+
|
+ Configures the UE-V Agent to not synchronize any Windows apps for all users on the computer. |
+
|
+ Configures the UE-V Agent to not synchronize any Windows apps for the current computer user. |
+
|
+ Configures the UE-V Agent to display notification the first time the agent runs for all users on the computer. |
+
|
+ Configures the UE-V Agent to not display notification the first time that the agent runs for all users on the computer. |
+
|
+ Configures the UE-V Agent to notify all users on the computer when settings synchronization is delayed. +Use the DisableSettingsImportNotify parameter to disable notification. |
+
|
+ Configures the UE-V Agent to notify the current user when settings synchronization is delayed. +Use the DisableSettingsImportNotify parameter to disable notification. |
+
|
+ Configures the UE-V Agent to synchronize all Windows apps that are not explicitly disabled by the Windows app list for all users of the computer. For more information, see "Get-UevAppxPackage" in [Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI](managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md). +Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V Agent to synchronize only Windows apps that are explicitly enabled by the Windows App List. |
+
|
+ Configures the UE-V Agent to synchronize all Windows apps that are not explicitly disabled by the Windows app list for the current user on the computer. For more information, see "Get-UevAppxPackage" in [Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI](managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md). +Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V Agent to synchronize only Windows apps that are explicitly enabled by the Windows App List. |
+
|
+ Disables UE-V for all the users on the computer. +Use the EnableSync parameter to enable or re-enable. |
+
|
+ Disables UE-V for the current user on the computer. +Use the EnableSync parameter to enable or re-enable. |
+
|
+ Enables the UE-V icon in the notification area for all users of the computer. +Use the DisableTrayIcon parameter to disable the icon. |
+
|
+ Configures the UE-V agent to report when a settings package file size reaches the defined threshold for all users on the computer. Sets the threshold package size in bytes. |
+
|
+ Configures the UE-V agent to report when a settings package file size reaches the defined threshold. Sets the package size warning threshold for the current user. |
+
|
+ Specifies the time in seconds before the user is notified for all users of the computer |
+
|
+ Specifies the time in seconds before notification for the current user is sent. |
+
|
+ Defines a per-computer settings storage location for all users of the computer. |
+
|
+ Defines a per-user settings storage location. |
+
|
+ Sets the settings template catalog path for all users of the computer. |
+
|
+ Sets the synchronization method for all users of the computer: SyncProvider or None. |
+
|
+ Sets the synchronization method for the current user: SyncProvider or None. |
+
|
+ Sets the synchronization time-out in milliseconds for all users of the computer |
+
|
+ Set the synchronization time-out for the current user. |
+
|
+ Clears the specified setting for all users on the computer. |
+
|
+ Clears the specified setting for the current user only. |
+
|
+ Exports the UE-V computer configuration to a settings migration file. The file name extension must be .uev. +The |
+
|
+ Imports the UE-V computer configuration from a settings migration file. The file name extension must be .uev. |
+
Windows PowerShell command |
+ Description |
+
Export-UevPackage MicrosoftCalculator6.pkgx |
+ Extracts the settings from a Microsoft Calculator package file and converts them into a human-readable format in XML. |
+
Repair-UevTemplateIndex |
+ Repairs the index of the UE-V settings location templates. |
+
Windows PowerShell command |
+ Description | +
---|---|
|
+ Displays the active UE-V Agent settings. User-specific settings have precedence over the computer settings. |
+
|
+ Displays the UE-V Agent configuration that is defined for a user. |
+
|
+ Displays the UE-V Agent configuration that is defined for a computer. |
+
|
+ Displays the details for each configuration item. |
+
$config.Put() |
+ Defines a per-computer settings storage location. |
+
|
+ Defines a per-user settings storage location. |
+
|
+ Sets the synchronization time-out in milliseconds for all users of the computer. |
+
|
+ Configures the UE-V Agent to report when a settings package file size reaches a defined threshold. Set the threshold package file size in bytes for all users of the computer. |
+
|
+ Sets the synchronization method for all users of the computer: SyncProvider or None. |
+
|
+ To enable a specific per-computer setting, clear the setting, and use $null as the setting value. Use UserConfiguration for per-user settings. |
+
|
+ To disable a specific per-computer setting, clear the setting, and use $null as the setting value. Use User Configuration for per-user settings. |
+
|
+ Updates a specific per-computer setting. To clear the setting, use $null as the setting value. |
+
|
+ Updates a specific per-user setting for all users of the computer. To clear the setting, use $null as the setting value. |
+
WMI command | +Description | +
---|---|
|
+ Extracts the settings from a package file and converts them into a human-readable format in XML. |
+
|
+ Repairs the index of the UE-V settings location templates. Must be run as administrator. |
+
Windows PowerShell command | +Description | +
---|---|
|
+ Lists all the settings location templates that are registered on the computer. |
+
|
+ Lists all the settings location templates that are registered on the computer where the application name or template name contains <string>. |
+
|
+ Lists all the settings location templates that are registered on the computer where the template ID contains <string>. |
+
|
+ Lists all the settings location templates that are registered on the computer where the application or template name, or template ID contains <string>. |
+
|
+ Gets the name of the program and version information, which depend on the template ID. |
+
|
+ Gets the effective list of Windows apps. |
+
|
+ Gets the list of Windows apps that are configured for the computer. |
+
|
+ Gets the list of Windows apps that are configured for the current user. |
+
|
+ Registers one or more settings location template with UE-V by using relative paths and/or wildcard characters in file paths. After a template is registered, UE-V synchronizes the settings that are defined in the template between computers that have the template registered. |
+
|
+ Registers one or more settings location template with UE-V by using literal paths, where no characters can be interpreted as wildcard characters. After a template is registered, UE-V synchronizes the settings that are defined in the template between computers that have the template registered. |
+
|
+ Unregisters a settings location template with UE-V. When a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers. |
+
|
+ Unregisters all settings location templates with UE-V. When a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers. |
+
|
+ Updates one or more settings location templates with a more recent version of the template. Use relative paths and/or wildcard characters in the file paths. The new template should be a newer version than the existing template. |
+
|
+ Updates one or more settings location templates with a more recent version of the template. Use full paths to template files, where no characters can be interpreted as wildcard characters. The new template should be a newer version than the existing template. |
+
|
+ Removes one or more Windows apps from the computer Windows app list. |
+
|
+ Removes Windows app from the current user Windows app list. |
+
|
+ Removes all Windows apps from the computer Windows app list. |
+
|
+ Removes one or more Windows apps from the current user Windows app list. |
+
|
+ Removes all Windows apps from the current user Windows app list. |
+
|
+ Disables a settings location template for the current user of the computer. |
+
|
+ Disables one or more Windows apps in the computer Windows app list. |
+
|
+ Disables one or more Windows apps in the current user Windows app list. |
+
|
+ Enables a settings location template for the current user of the computer. |
+
|
+ Enables one or more Windows apps in the computer Windows app list. |
+
|
+ Enables one or more Windows apps in the current user Windows app list. |
+
|
+ Determines whether one or more settings location templates comply with its XML schema. Can use relative paths and wildcard characters. |
+
|
+ Determines whether one or more settings location templates comply with its XML schema. The path must be a full path to the template file, but does not include wildcard characters. |
+
Windows PowerShell command |
+ Description | +
---|---|
|
+ Lists all the settings location templates that are registered for the computer. |
+
|
+ Gets the name of the program and version information, which depends on the template name. |
+
|
+ Gets the effective list of Windows apps. |
+
Get-WmiObject -Namespace root\Microsoft\UEV MachineConfiguredWindows8App |
+ Gets the list of Windows apps that are configured for the computer. |
+
|
+ Gets the list of Windows apps that are configured for the current user. |
+
|
+ Registers a settings location template with UE-V. |
+
|
+ Unregisters a settings location template with UE-V. As soon as a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers. |
+
|
+ Updates a settings location template with UE-V. The new template should be a newer version than the existing one. |
+
|
+ Removes one or more Windows apps from the computer Windows app list. |
+
|
+ Removes one or more Windows apps from the current user Windows app list. |
+
|
+ Disables one or more settings location templates with UE-V. |
+
|
+ Disables one or more Windows apps in the computer Windows app list. |
+
|
+ Disables one or more Windows apps in the current user Windows app list. |
+
|
+ Enables a settings location template with UE-V. |
+
|
+ Enables Windows apps in the computer Windows app list. |
+
|
+ Enables Windows apps in the current user Windows app list. |
+
|
+ Determines whether a given settings location template complies with its XML schema. |
+
KB Article | +Title | +Link | +
---|---|---|
2927019 |
+Hotfix Package 1 for Microsoft User Experience Virtualization 2.0 |
+[support.microsoft.com/kb/2927019](http://support.microsoft.com/kb/2927019) |
+
2903501 |
+UE-V: User Experience Virtualization (UE-V) compatibility with user profiles |
+[support.microsoft.com/kb/2903501/EN-US](http://support.microsoft.com/kb/2903501/EN-US) |
+
2770042 |
+UE-V Registry Settings |
+[support.microsoft.com/kb/2770042/EN-US](http://support.microsoft.com/kb/2770042/EN-US) |
+
2847017 |
+UE-V settings replicated by Internet Explorer |
+[support.microsoft.com/kb/2847017/EN-US](http://support.microsoft.com/kb/2847017/EN-US) |
+
2930271 |
+Understanding the limitations of roaming Outlook signatures in Microsoft UE-V |
+[support.microsoft.com/kb/2930271/EN-US](http://support.microsoft.com/kb/2930271/EN-US) |
+
2769631 |
+How to repair a corrupted UE-V install |
+[support.microsoft.com/kb/2769631/EN-US](http://support.microsoft.com/kb/2769631/EN-US) |
+
2850989 |
+Migrating MAPI profiles with Microsoft UE-V is not supported |
+[support.microsoft.com/kb/2850989/EN-US](http://support.microsoft.com/kb/2850989/EN-US) |
+
2769586 |
+UE-V roams empty folders and registry keys |
+[support.microsoft.com/kb/2769586/EN-US](http://support.microsoft.com/kb/2769586/EN-US) |
+
2782997 |
+How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V) |
+[support.microsoft.com/kb/2782997/EN-US](http://support.microsoft.com/kb/2782997/EN-US) |
+
2769570 |
+UE-V does not update the theme on RDS or VDI sessions |
+[support.microsoft.com/kb/2769570/EN-US](http://support.microsoft.com/kb/2769570/EN-US) |
+
2901856 |
+Application settings do not sync after you force a restart on a UE-V-enabled computer |
+[support.microsoft.com/kb/2901856/EN-US](http://support.microsoft.com/kb/2901856/EN-US) |
+
2850582 |
+How To Use Microsoft User Experience Virtualization With App-V Applications |
+[support.microsoft.com/kb/2850582/EN-US](http://support.microsoft.com/kb/2850582/EN-US) |
+
3041879 |
+Current file versions for Microsoft User Experience Virtualization |
+[support.microsoft.com/kb/3041879/EN-US](http://support.microsoft.com/kb/3041879/EN-US) |
+
2843592 |
+Information on User Experience Virtualization and High Availability |
+[support.microsoft.com/kb/2843592/EN-US](http://support.microsoft.com/kb/2843592/EN-US) |
+
Parameter | +Description | +
---|---|
/ACCEPTLICENSETERMS=True |
+Set this parameter to True to install UE-V silently. Adding this parameter implies that the user accepts the UE-V license terms, which are found (by default) here: %ProgramFiles%\Microsoft User Experience Virtualization\Agent |
+
/NORESTART |
+This parameter prevents the mandatory restart after the UE-V agent is installed. A return code of 3010 indicates that a restart is required prior to using UE-V. |
+
KB Article | +Title | +Link | +
---|---|---|
3018608 |
+UE-V 2.1 - TemplateConsole.exe crashes when UE-V WMI classes are missing |
+[support.microsoft.com/kb/3018608/EN-US](http://support.microsoft.com/kb/3018608/EN-US) |
+
2903501 |
+UE-V: User Experience Virtualization (UE-V) compatibility with user profiles |
+[support.microsoft.com/kb/2903501/EN-US](http://support.microsoft.com/kb/2903501/EN-US) |
+
2770042 |
+UE-V Registry Settings |
+[support.microsoft.com/kb/2770042/EN-US](http://support.microsoft.com/kb/2770042/EN-US) |
+
2847017 |
+UE-V settings replicated by Internet Explorer |
+[support.microsoft.com/kb/2847017/EN-US](http://support.microsoft.com/kb/2847017/EN-US) |
+
2769631 |
+How to repair a corrupted UE-V install |
+[support.microsoft.com/kb/2769631/EN-US](http://support.microsoft.com/kb/2769631/EN-US) |
+
2850989 |
+Migrating MAPI profiles with Microsoft UE-V is not supported |
+[support.microsoft.com/kb/2850989/EN-US](http://support.microsoft.com/kb/2850989/EN-US) |
+
2769586 |
+UE-V roams empty folders and registry keys |
+[support.microsoft.com/kb/2769586/EN-US](http://support.microsoft.com/kb/2769586/EN-US) |
+
2782997 |
+How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V) |
+[support.microsoft.com/kb/2782997/EN-US](http://support.microsoft.com/kb/2782997/EN-US) |
+
2769570 |
+UE-V does not update the theme on RDS or VDI sessions |
+[support.microsoft.com/kb/2769570/EN-US](http://support.microsoft.com/kb/2769570/EN-US) |
+
2850582 |
+How To Use Microsoft User Experience Virtualization With App-V Applications |
+[support.microsoft.com/kb/2850582/EN-US](http://support.microsoft.com/kb/2850582/EN-US) |
+
3041879 |
+Current file versions for Microsoft User Experience Virtualization |
+[support.microsoft.com/kb/3041879/EN-US](http://support.microsoft.com/kb/3041879/EN-US) |
+
2843592 |
+Information on User Experience Virtualization and High Availability |
+[support.microsoft.com/kb/2843592/EN-US](http://support.microsoft.com/kb/2843592/EN-US) |
+
Parameter | +Description | +
---|---|
/ACCEPTLICENSETERMS=True |
+Set this parameter to True to install UE-V silently. Adding this parameter implies that the user accepts the UE-V license terms, which are found (by default) here: %ProgramFiles%\Microsoft User Experience Virtualization\Agent |
+
/NORESTART |
+This parameter prevents the mandatory restart after the UE-V agent is installed. A return code of 3010 indicates that a restart is required prior to using UE-V. |
+
KB Article | +Title | +Link | +
---|---|---|
3018608 |
+UE-V 2.1 - TemplateConsole.exe crashes when UE-V WMI classes are missing |
+[support.microsoft.com/kb/3018608/EN-US](http://support.microsoft.com/kb/3018608/EN-US) |
+
2903501 |
+UE-V: User Experience Virtualization (UE-V) compatibility with user profiles |
+[support.microsoft.com/kb/2903501/EN-US](http://support.microsoft.com/kb/2903501/EN-US) |
+
2770042 |
+UE-V Registry Settings |
+[support.microsoft.com/kb/2770042/EN-US](http://support.microsoft.com/kb/2770042/EN-US) |
+
2847017 |
+UE-V settings replicated by Internet Explorer |
+[support.microsoft.com/kb/2847017/EN-US](http://support.microsoft.com/kb/2847017/EN-US) |
+
2769631 |
+How to repair a corrupted UE-V install |
+[support.microsoft.com/kb/2769631/EN-US](http://support.microsoft.com/kb/2769631/EN-US) |
+
2850989 |
+Migrating MAPI profiles with Microsoft UE-V is not supported |
+[support.microsoft.com/kb/2850989/EN-US](http://support.microsoft.com/kb/2850989/EN-US) |
+
2769586 |
+UE-V roams empty folders and registry keys |
+[support.microsoft.com/kb/2769586/EN-US](http://support.microsoft.com/kb/2769586/EN-US) |
+
2782997 |
+How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V) |
+[support.microsoft.com/kb/2782997/EN-US](http://support.microsoft.com/kb/2782997/EN-US) |
+
2769570 |
+UE-V does not update the theme on RDS or VDI sessions |
+[support.microsoft.com/kb/2769570/EN-US](http://support.microsoft.com/kb/2769570/EN-US) |
+
2850582 |
+How To Use Microsoft User Experience Virtualization With App-V Applications |
+[support.microsoft.com/kb/2850582/EN-US](http://support.microsoft.com/kb/2850582/EN-US) |
+
3041879 |
+Current file versions for Microsoft User Experience Virtualization |
+[support.microsoft.com/kb/3041879/EN-US](http://support.microsoft.com/kb/3041879/EN-US) |
+
2843592 |
+Information on User Experience Virtualization and High Availability |
+[support.microsoft.com/kb/2843592/EN-US](http://support.microsoft.com/kb/2843592/EN-US) |
+
Application category | +Description | +
---|---|
Microsoft Office 2010 applications +([Download a list of all settings synced](http://www.microsoft.com/download/details.aspx?id=46367)) |
+Microsoft Word 2010 +Microsoft Excel 2010 +Microsoft Outlook 2010 +Microsoft Access 2010 +Microsoft Project 2010 +Microsoft PowerPoint 2010 +Microsoft Publisher 2010 +Microsoft Visio 2010 +Microsoft SharePoint Workspace 2010 +Microsoft InfoPath 2010 +Microsoft Lync 2010 +Microsoft OneNote 2010 +Microsoft SharePoint Designer 2010 |
+
Microsoft Office 2013 applications +([Download a list of all settings synced](http://www.microsoft.com/download/details.aspx?id=46367)) |
+Microsoft Word 2013 +Microsoft Excel 2013 +Microsoft Outlook 2013 +Microsoft Access 2013 +Microsoft Project 2013 +Microsoft PowerPoint 2013 +Microsoft Publisher 2013 +Microsoft Visio 2013 +Microsoft InfoPath 2013 +Microsoft Lync 2013 +Microsoft OneNote 2013 +Microsoft SharePoint Designer 2013 +Microsoft Office 2013 Upload Center +Microsoft OneDrive for Business 2013 +The UE-V 2.1 and 2.1 SP1 Microsoft Office 2013 settings location templates include improved Outlook signature support. We’ve added synchronization of default signature settings for new, reply, and forwarded emails. +
+Note
+
+An Outlook profile must be created for any device on which a user wants to sync their Outlook signature. If the profile is not already created, the user can create one and then restart Outlook on that device to enable signature synchronization. +
+
+ |
+
Browser options: Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11 |
+Favorites, home page, tabs, and toolbars. +
+Note
+
+UE-V does not roam settings for Internet Explorer cookies. +
+
+ |
+
Windows accessories |
+Microsoft Calculator, Notepad, WordPad. |
+
Application category | +Description | +
---|---|
Microsoft Office 2007 applications +([Download a list of all settings synced](http://www.microsoft.com/download/details.aspx?id=46367)) |
+Microsoft Access 2007 +Microsoft Communicator 2007 +Microsoft Excel 2007 +Microsoft InfoPath 2007 +Microsoft OneNote 2007 +Microsoft Outlook 2007 +Microsoft PowerPoint 2007 +Microsoft Project 2007 +Microsoft Publisher 2007 +Microsoft SharePoint Designer 2007 +Microsoft Visio 2007 +Microsoft Word 2007 |
+
Microsoft Office 2010 applications +([Download a list of all settings synced](http://www.microsoft.com/download/details.aspx?id=46367)) |
+Microsoft Word 2010 +Microsoft Excel 2010 +Microsoft Outlook 2010 +Microsoft Access 2010 +Microsoft Project 2010 +Microsoft PowerPoint 2010 +Microsoft Publisher 2010 +Microsoft Visio 2010 +Microsoft SharePoint Workspace 2010 +Microsoft InfoPath 2010 +Microsoft Lync 2010 +Microsoft OneNote 2010 +Microsoft SharePoint Designer 2010 |
+
Browser options: Internet Explorer 8, Internet Explorer 9, and Internet Explorer 10 |
+Favorites, home page, tabs, and toolbars. +
+Note
+
+UE-V does not roam settings for Internet Explorer cookies. +
+
+ |
+
Windows accessories |
+Microsoft Calculator, Notepad, WordPad. |
+
Windows settings | +Description | +Apply on | +Export on | +Default state | +
---|---|---|---|---|
Desktop background |
+Currently active desktop background or wallpaper. |
+Logon, unlock, remote connect, Scheduled Task events. |
+Logoff, lock, remote disconnect, user clicking Sync Now in Company Settings Center, or scheduled task interval |
+Enabled |
+
Ease of Access |
+Accessibility and input settings, Microsoft Magnifier, Narrator, and on-Screen Keyboard. |
+Logon only. |
+Logoff, user clicking Sync Now in Company Settings Center, or scheduled task interval |
+Enabled |
+
Desktop settings |
+Start menu and Taskbar settings, Folder options, Default desktop icons, Additional clocks, and Region and Language settings. |
+Logon only. |
+Logoff, user clicking Sync Now in Company Settings Center, or scheduled task |
+Enabled |
+
Settings group | +Category | +Capture | +Apply | +
---|---|---|---|
Application Settings |
+Windows apps |
+Close app +Windows app settings change event |
+Start the UE-V App Monitor at startup +Open app +Windows App Settings change event +Arrival of a settings package |
+
+ | Desktop applications |
+Application closes |
+Application opens and closes |
+
Desktop settings |
+Desktop background |
+Lock or logoff |
+Logon, unlock, remote connect, notification of new package arrival, user clicks Sync Now in Company Settings Center, or scheduled task runs. |
+
+ | Ease of Access (Common – Accessibility, Narrator, Magnifier, On-Screen-Keyboard) |
+Lock or Logoff |
+Logon |
+
+ | Ease of Access (Shell - Audio, Accessibility, Keyboard, Mouse) |
+Lock or logoff |
+Logon, unlock, remote connect, notification of new package arrival, user clicks Sync Now in Company Settings Center, or scheduled task runs |
+
+ | Desktop settings |
+Lock or logoff |
+Logon |
+
+ | Description | +
---|---|
![]() |
+Does this application contain settings that the user can customize? |
+
![]() |
+Is it important for the user that these settings are synchronized? |
+
![]() |
+Are these user settings already managed by an application management or settings policy solution? UE-V applies application settings at application startup and Windows settings at logon, unlock, or remote connect events. If you use UE-V with other settings sharing solutions, users might experience inconsistency across synchronized settings. |
+
![]() |
+Are the application settings specific to the computer? Application preferences and customizations that are associated with hardware or specific computer configurations do not consistently synchronize across sessions and can cause a poor application experience. |
+
![]() |
+Does the application store settings in the Program Files directory or in the file directory that is located in the Users\[User name]\AppData\LocalLow directory? Application data that is stored in either of these locations usually should not synchronize with the user, because this data is specific to the computer or because the data is too large to synchronize. |
+
![]() |
+Does the application store any settings in a file that contains other application data that should not synchronize? UE-V synchronizes files as a single unit. If settings are stored in files that include application data other than settings, then synchronizing this additional data can cause a poor application experience. |
+
![]() |
+How large are the files that contain the settings? The performance of the settings synchronization can be affected by large files. Including large files can affect the performance of settings synchronization. |
+
Operating system | +Edition | +Service pack | +System architecture | +Windows PowerShell | +Microsoft .NET Framework | +
---|---|---|---|---|---|
Windows 7 |
+Ultimate, Enterprise, or Professional Edition |
+SP1 |
+32-bit or 64-bit |
+Windows PowerShell 3.0 or higher |
+.NET Framework 4.5 or higher for UE-V 2.1. +.NET Framework 4 or higher for UE-V 2.0. |
+
Windows Server 2008 R2 |
+Standard, Enterprise, Datacenter, or Web Server |
+SP1 |
+64-bit |
+Windows PowerShell 3.0 or higher |
+.NET Framework 4.5 or higher for UE-V 2.1. +.NET Framework 4 or higher for UE-V 2.0. |
+
Windows 8 and Windows 8.1 |
+Enterprise or Pro |
+None |
+32-bit or 64-bit |
+Windows PowerShell 3.0 or higher |
+.NET Framework 4.5 or higher |
+
Windows 10 +
+Note
+
+Only UE-V 2.1 SP1 supports Windows 10 +
+
+ |
+Enterprise or Pro |
+None |
+32-bit or 64-bit |
+Windows PowerShell 3.0 or higher |
+.NET Framework 4.6 |
+
Windows Server 2012 and Windows Server 2012 R2 |
+Standard or Datacenter |
+None |
+64-bit |
+Windows PowerShell 3.0 or higher |
+.NET Framework 4.5 or higher |
+
User account | +Recommended permissions | +
---|---|
Everyone |
+ No permissions |
+
Security group of UE-V |
+ Full control |
+
User account | +Recommended permissions | +Folder | +
---|---|---|
Creator/Owner |
+ No permissions |
+ No permissions |
+
Domain Admins |
+ Full control |
+ This folder, subfolders, and files |
+
Security group of UE-V users |
+ List folder/read data, create folders/append data |
+ This folder only |
+
Everyone |
+ Remove all permissions |
+ No permissions |
+
User account | +Recommend permissions | +
---|---|
Everyone |
+ No permissions |
+
Domain computers |
+ Read permission Levels |
+
Administrators |
+ Read/write permission levels |
+
User account | +Recommended permissions | +Apply to | +
---|---|---|
Creator/Owner |
+ Full control |
+ This folder, subfolders, and files |
+
Domain Computers |
+ List folder contents and Read permissions |
+ This folder, subfolders, and files |
+
Everyone |
+ No permissions |
+ No permissions |
+
Administrators |
+ Full Control |
+ This folder, subfolders, and files |
+
SyncMethod Configuration |
+V1.0 |
+V2.0 |
+V2.1 and V2.1 SP1 |
+Description |
+
SyncProvider |
+n/a |
+Default |
+Default |
+Settings changes for a specific application or for global Windows desktop settings are saved locally to a cache folder. These changes are then synchronized with the settings storage location when a synchronization trigger event takes place. Pushing out changes will save the local changes to the settings storage path. +This default setting is the gold standard for computers. This option attempts to synchronize the setting and times out after a short delay to ensure that the application or operating system startup isn’t delayed for a long period of time. +This functionality is also tied to the Scheduled task – Sync Controller Application. The administrator controls the frequency of the Scheduled task. By default, computers synchronize their settings every 30 min after logging on. |
+
OfflineFiles |
+Default |
+Deprecated |
+Deprecated |
+Behaves the same as SyncProvider in V2.0. +If Offline files are enabled and the folder is pinned then UE-V will unpin this folder and sync directly to the central SMB directory. +NOTE: In V1.0 if you wanted to use UE-V in a CorpNet disconnected manner (aka traveling with a Laptop), then the guidance is to use Offline Files to ensure that your settings roamed. We received sufficient customer feedback that turning on Offline files is a non-trivial enterprise blocker. So in UE-V 2, we created a tightly coupled synchronization engine to cache your data locally and synchronize the settings to the central server. This feature area does not replace Offline Files or Folder Redirection. +UE-V 2 does not work well with Offline folders so the guidance is not to set the settings storage path to a pinned Offline or CSC folder. |
+
External |
+n/a |
+n/a |
+Supported |
+New in UE-V 2.1, this configuration method specifies that if UE-V settings are written to a local folder on the user computer, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different computers that users access. |
+
None |
+Yes |
+Yes |
+Yes |
+This configuration setting is designed for the Virtual Desktop Infrastructure (VDI) and Streamed Application experience primarily. This setting should be used on Windows Server boxes used in a datacenter, where the connection will always be available. +Any settings changes are saved directly to the server. If the network connection to the settings storage path is not available, then the settings changes are cached on the device and are synchronized the next time that the Sync Provider runs. If the settings storage path is not found and the user profile is removed from a pooled VDI environment on logoff, then these settings changes are lost, and the user must reapply the change when the computer can again reach the settings storage path. +Apps and OS will wait indefinitely for the location to be present. This could cause App load or OS logon time to dramatically increase if the location is not found. |
+
UE-V 2 Trigger Event |
+SyncMethod=SyncProvider |
+SyncMethod=None |
+
Windows Logon |
+
|
+
|
+
Windows Logoff |
+Store changes locally and cache and copy asynchronous and synchronous Windows settings to the settings storage location server, if available |
+Store changes to asynchronous and synchronous Windows settings storage location |
+
Windows Connect (RDP) / Unlock |
+Synchronize any asynchronous Windows settings from settings storage location to local cache, if available. +Apply cached Windows settings |
+Download and apply asynchronous windows settings from settings storage location |
+
Windows Disconnect (RDP) / Lock |
+Store asynchronous Windows settings changes to the local cache. +Synchronize any asynchronous Windows settings from the local cache to settings storage location, if available |
+Store asynchronous Windows settings changes to the settings storage location |
+
Application start |
+Apply application settings from local cache as the application starts |
+Apply application settings from settings storage location as the application starts |
+
Application closes |
+Store any application settings changes to the local cache and copy settings to settings storage location, if available |
+Store any application settings changes to settings storage location |
+
Sync Controller Scheduled Task or “Sync Now” is run from the Company Settings Center + |
+Application and Windows settings are synchronized between the settings storage location and the local cache. +
+Note
+
+Settings changes are not cached locally until an application closes. This trigger will not export changes made to a currently running application. +For Windows settings, this means that any changes will not be cached locally and exported until the next Lock (Asynchronous) or Logoff (Asynchronous and Synchronous). +
+
+
+Settings are applied in these cases: +
|
+NA |
+
Asynchronous Settings updated on remote store* |
+Load and apply new asynchronous settings from the cache. |
+Load and apply settings from central server |
+
Office 2013 templates (UE-V 2.0, available on UE-V gallery): | +Office 2010 templates (UE-V 1.0 & 1.0 SP1): | +
---|---|
MicrosoftOffice2013Win32.xml +MicrosoftOffice2013Win64.xml +MicrosoftLync2013Win32.xml +MicrosoftLync2013Win64.xml |
+MicrosoftOffice2010Win32.xml +MicrosoftOffice2010Win64.xml +MicrosoftLync2010.xml + |
+
Microsoft Access 2013 +Microsoft Lync 2013 +Microsoft Excel 2013 +Microsoft InfoPath 2013 +Microsoft OneNote 2013 +Microsoft Outlook 2013 +Microsoft PowerPoint 2013 +Microsoft Project 2013 +Microsoft Publisher 2013 +Microsoft SharePoint Designer 2013 +Microsoft Visio 2013 +Microsoft Word 2013 +Microsoft Office Upload Manager |
+Microsoft Access 2010 +Microsoft Lync 2010 +Microsoft Excel 2010 +Microsoft InfoPath 2010 +Microsoft OneNote 2010 +Microsoft Outlook 2010 +Microsoft PowerPoint 2010 +Microsoft Project 2010 +Microsoft Publisher 2010 +Microsoft SharePoint Designer 2010 +Microsoft Visio 2010 +Microsoft Word 2010 + |
+