Assign App Layers to users elastically (Elastic Layers)

In this article:

Assign apps elastically

Wouldn't it be nice to drastically reduce the number of images you have to manage? What if you could leave apps that only a few users need out of your base image? And, assign the layers to specific users elastically on top of the base image. With the Elastic App Layers feature, you can do just that.

An Elastic App Layer is a Unidesk App Layer that you configure to be delivered to specific users and groups, based on user entitlements, when the users log onto their session hosts or standalone desktops. With Elastic App Layers, you can give each user his/her own unique set of applications in addition to the base Layered Image that is used across sessions in the case of session hosts), and across floating pools/shared groups in the case of desktops.

As this diagram shows, once you add Elastic Assignments to an App Layer, a copy of the Layer is stored in the ELM's Network File Share, and delivered to individual AD users and groups on-demand, in addition to the Layers that they receive via the base image.

To use this feature, you'll add Elastic Assignments specifying which users and groups should receive each of the App Layers that you would like to leave out of your base images. You'll then publish your base image(s) with the Elastic Layering For Session Hosts selected.

How users access Elastic Layers assigned to them

When users log into their Session or Desktop, icons for their Elastic Layers will appear as shortcuts on the desktop.

A user receives an Elastic Layer in the following cases:

• The user (an AD user in the Unidesk Management Console) is assigned the Layer.
• An AD group that the user belongs to is assigned the Layer.
• A machine that the user logs into is a member of an AD Group that receives the Elastic Layer.
• A machine that the user logs into is associated (via the UMC) with an AD Group that is assigned the Layer via the UMC.

If more than one version of the same Layer is assigned to a user

If a Layer is assigned directly to the user and indirectly to one or more of the user's groups, the user receives the most recent version of the Layer assigned directly to her/him. For example, if a user is assigned Version 2, and a group that the user belongs to is assigned Version 3, the user will get Version 2.

If the user is assigned a Layer via one or more group assignments, the user receives the most recent version of the Layer.

If a user has an App Layer in their Layered Image, and the Layer is also assigned to them elastically

If a user has an App Layer in the Layered Image and the user is also assigned the Layer elastically, they will receive the Elastic Layer, even if the version in the base image is more recent.

Prerequisites and limitations

Prerequisites

• The ELM's Network File Share must be configured correctly:
  • The Share must be configured using SMB technology. When using Elastic Layer assignments, NFS technology is not supported.
  • The Share must be set up by the admin to be readonly for all users except for the one configured in the ELM. This secures the Layers and other files stored on the Share.
  • The User named in this configuration must have Read/Write permissions on the root of the network file share. Select System > Settings and Configuration and scroll to Network File Share.
  • Make sure that any users who will be assigned Elastic Layers have Read only access for the root directory of the Network File Share.
• .NET Framework 4.5 is required on any Layered Image where Elastic Layers are enabled.

• The App Layers you want to elastically assign.

  Note: App Layers must be created using the same OS Layer used to create the Layered Image that you enable to deliver the Elastic App Layer to users.

Elastic Layering Limitations

You cannot elastically layer the following:

• Microsoft Office Add-ons and extensions in individual Unidesk Layers. A user must have all of their add-ons in one Layer. Note: Please use the recipe for elastically layering MS Office.
• Applications with drivers that use the driver store. For example, a printer driver.
• Applications that modify the network stack or hardware. For example, a VPN client.
• Applications that have boot level drivers. For example, a virus scanner.

Enable Elastic Layering in the base image

When you publish the Layered Image that the users will log into to get the Elastic App Layer(s):

1. In the Image Template Wizard, on the Layered Image Disk tab, select Elastic Layering For Session Hosts.

2. Finish publishing the Layered Image.

3. Provision your Session Hosts with the new base image.

   When the users log in, they should see an icon for each Elastic App Layer they've been assigned.

Run the Elastic Fit Analyzer on App Layers (Unidesk Labs)

Before assigning an App Layer elastically, use the Elastic Fit Analyzer to determine the likelihood that the Layer assignment will be successful.

Elastic Fit Analysis

In the Layer Details, the Elastic Fit rating indicates how likely it is that the Layer will work when elastically assigned.

Elastic Fit Details

You can learn more about the Elastic Fit of a Layer by expanding the Elastic Fit Analysis. If the Elastic Fit is less than ideal, the list of violated rules will be displayed.

Enable Elastic Fit in Unidesk Labs

To use this Unidesk Labs feature, you must enable it. To enable Elastic Fit:

1. In the Unidesk Management Appliance (UMC), select System > Settings and Configuration.
2. Click Edit Unidesk Labs.
3. Select the Elastic Fit check box.
4. Click Save.

Analyze an App Layer for Elastic Fit

All new Layer Versions will be analyzed for elastic layering compatibility when they are finalized. To analyze existing App Layers for Elastic Fit:

1. Log into the Unidesk Management Console (UMC) .
2. Select Layers > App Layers.
3. Select the Layer to analyze, and click Analyze Layer.
4. On the Select Versions tab, choose the Layer Versions to analyze.
5. On the Confirm and Complete tab, click Analyze Layer Versions. The analysis takes seconds.
6. To see the Elastic Fit Analysis, select the App Layers module, move the mouse pointer over the Layer icon and click the Info icon.
7. Expand the Version Information for each Layer Version, and look for the Elastic Fit rating.
8. For a detailed report, expand the Elastic Fit Details. If the Elastic Fit is less than ideal, the list of violated rules will be displayed.
9. You can display the AD tree and hide the violated rules by clicking a button acknowledging that the layer is unlikely to work as expected.

Upgrading from Earlier Releases

After upgrading from an earlier Unidesk release, the Elastic Fit Detail shows that any existing Layer Version(s) have not been analyzed. Until you run the analysis on existing Layer Versions, the Versions will have a single High severity Elastic Fit Detail, and a Poor Elastic Fit.

Elastically assign an App Layer to AD Users and Groups

The first time you assign an App Layer elastically, we recommend starting with an app like Notepad++ or GIMP, because they are simple to .

1. Log into the Unidesk Management Console (UMC) as an Admin user, and select Layers > App Layers.
2. Select an App Layer that is not going to be included in the base image, and select Add Assignments.
3. In the wizard that opens, select the Version of the App Layer that you want to assign users.
4. Skip the Image Template Assignment tab. This tab is for assigning the Layer to an Image Template.
5. In the Elastic Assignment tab, select the users and groups who should get this App Layer.
6. In the Confirm and Complete tab, review your selections, and click Assign Apps.

When the users log in, they should see an icon for each Elastic App Layer they've been assigned.

Elastically assign an App Layer to users via machine assignments and associations

Any machine running the Unidesk Layering Service (ULayer.exe) can have Elastic Layers assigned to it. You can accomplish this by either adding the machine to or associating it with the AD Group, and then elastically assigning the App Layers to the AD Group.

The Layers assigned to the machine will be available to every User who successfully logs into that machine. The Unidesk Layering Service will scan for changes to the machine's AD group memberships and associations every 10 minutes. When the users log in, they should see an icon for each Elastic App Layer they've been assigned.

Use Active Directory to add the machine to the AD Group

Assuming you have a published Layered Image booted in your environment, you can add the machine to an AD Group, and assign Elastic Layers to the AD Group.

1. Use Active Directory (AD) to add the machine to an AD Group.
2. Select an App Layer that is not going to be included in the base image, and elastically assign the Layer(s) to an AD Group.

3. You can wait for AD to propagate the changes and be recognized by the Unidesk Layering Service, or you can force the Unidesk Layering Service to update its list of machine groups by doing one of the following:

   • Wait for the Unidesk Layering Service to detect the changes (within 10 minutes by default).

   • Restart the Unidesk Layering Service.

   • Reboot the Unidesk Layering Service Machine.

   • Execute the refresh.groups command:

     C:\Program Files\Unidesk\Layering Services\ulayer.exe refresh.groups

Example

You start with an AD User, and AD Group, and a machine that you provisioned using a Layered Image.

• AD User: Kenya
  • Kenya has no elastic assignments.
• AD Group: Marketing
  • The Marketing group includes the member Kenya.
• Machine: ElasticTestMachine
  • The ElasticTestMachine base image includes the MS Office App Layer.

In this example, you elastically assign the Chrome App Layer to ElasticTestMachine:

1. In AD, you add the machine ElasticTestMachine to the Marketing AD Group.
2. In the Unidesk Management Console (UMC) you elastically assign the Chrome App Layer to the Marketing Group.
3. When Kenya, who is part of the Marketing group, logs into ElasticTestMachine, she receives both the MS Office App Layer, which is in the base image, and the Chrome App Layer.
4. When any user who is not in the Marketing group logs into ElasticTestMachine, they also receive both Layers: MS Office because it is in the base image, and Chrome because the ElasticTestMachine is a member of the Marketing AD Group.

Use the UMC to associate the machine with an AD Group

Associating a set of machines with an AD Group allows any machine running the Unidesk Layering Service to have Layers elastically assigned to it via AD group membership.

Elastic Layers granted via Machine association can be thought of as extending the layers assigned to a user. For example, if a machine matches multiple Machine Associations, only the unique layers will be added to the ones the user already has.

In the UMC, you use asterisk (*) wildcards in a machine name pattern to specify a set of machine names. For example:

You can create Machine Associations before or after elastically assigning App Layers to the AD Group. Also, the machines do not need to exist when you add the associations, as the associations exist within Unidesk only, and AD is not aware of them.

Associate a set of machines with an AD Group

1. Log into the Unidesk Management Console (UMC) as an Admin user, and select Users > Tree.

2. Expand the Tree, select the appropriate Group and click Edit Properties in the Action bar. This opens the Edit Group Wizard.

   

3. Select the checkbox, Associate machines with this AD Group. This reveals the Machine Name Pattern field:

   

4. Specify a set of machines to associate with the AD group by entering a machine name pattern. For examples, see the above table of Machine name patterns.

5. On the Confirm and Complete tab, select Update Group. Notice the shape of a computer monitor superimposed over the group icon. This indicates that machines are associated with the group.

   

   When you click the group's icon, the Detail view now includes a field called, Associate With Machines where the pattern.

   

Example

You start with the machine, Mach1, the AD Group, MachineGroup, and the App Layers for Firefox and MS Office.

• Machine: Mach1
• AD Group: MachineGroup
• App Layers: Firefox, MS Office

Further, you have elastically assigned the Firefox and MS Office Layers to the AD Group.

If you add a Machine Association to MachineGroup with a name pattern of "Mach*", when any domain user logs into Mach1, they will receive the Firefox and MS Office Elastic App Layers.

Manage Elastic Assignments

You can:

• View a user's Elastic Layer assignments.
• Update an App Layer and elastically assign the new Version of the Layer.
• Remove Elastic Assignments.
• Debug an Elastic Assignments.

View a user's Elastic Layer assignments

1. Log into the UMC and select Users > Tree.
2. Select an AD User or Group, and click the "i" icon to the right of the name. If the user or group is assigned any Elastic Layers, the Layers are listed just below the user's or group's profile information in the Details window that appears.

Update an App Layer and its Elastic Assignments

You've added Elastic Assignments to an App Layer, and users are accessing the app as expected. A new version of the application is released, so you update it by adding a new Version to the Layer. Now you need to assign the new version to the users who have the Layer.

1. Log into the UMC and select Layers > App Layers.
2. Select the elastically assigned App Layer that you just updated.
3. Right-click the Layer icon and select Update Assignments.
4. In the wizard that opens, select the new Version.
5. Skip the Image Template Assignment tab.

6. In the Elastic Assignment tab, there's a list of Users and Groups who have been assigned a different version of the selected Layer. Select the users and groups to whom you want to assign the new Version of the Layer.

   Notes:

   • If the list is long, use the Search field to filter the results.
   • If the list is empty, click the check box called, Show AD users and groups already at this version. A list of grayed out names may appear. These users have already been assigned the Version.
7. On the Confirm and Complete tab, verify the Users and Groups selected to receive the new Version, and click Update Assignments.

Remove a Layer's Elastic Assignments

1. Log into the UMC and select Layers > App Layers.

2. Select the App Layer for which you want to remove assignments, and select Remove Assignments..

3. In the wizard that opens, select the assigned templates from which you want to remove the Layer. All of the assignments for that layer are listed.

   If the list is long, use the Search field to filter the results.

4. On the Confirm and Complete tab, verify the Image Templates selected to receive the new Version, and click Update Assignments.

Debug an Elastic Layer

If you have an Elastic Layering issue, you can diagnose the problem by finding out whether the layer is being delivered, and if so, whether it is working correctly. If needed, collect data for Unidesk Support, as described here.

Is this a Delivery issue?

Are the things you'd expect to see if this app were installed actually there as expected?

• Do you see the files and registry entries for the layer?
• If the app is supposed to be in the Start menu, is it there?
• If there should be a shortcut for the app on the user's desktop, is there one?

If you discover that app delivery is an issue, you can collect the following data, open a case, and send the data to Unidesk Support.

1. Collect the data from these logs:

   • Windows App Event log – In the Windows Event Viewer under Windows Logs, export the Application event log as an EVTX file.
   • Unidesk Layering Service log (ulayersvc.log) – C:\ProgramData\Unidesk\Logs\ulayersvc.log

2. Collect the values of these Registry keys:

   • HKEY_LOCAL_MACHINE\SOFTWARE\Unidesk\ULayer:AssignmentFile
   • HKEY_LOCAL_MACHINE\SOFTWARE\Unidesk\ULayer:RepositoryPath

3. Collect the contents of the Assignment (ElasticLayerAssignments.json) and Layers (Layers.json) files from the Repository Path.

4. Contact Support.

Is this an operational issue?

One of these issues could indicate that this is an Elastic Layering issue:

• The app is being delivered but doesn't launch correctly.
• An operation within the app doesn't work correctly.
• A licensing problem or a security issue.
• The app launches, but then misbehaves, for example, it crashes on startup, or starts up but doesn't work right.

If the problem with the Layer is operational, test the App Layer in the base image to rule out general layering issues:

1. Add the App Layer to an Image Template, and publish a Layered Image that includes the App Layer.
2. Log in as a user who is not assigned the Layer elastically, and make sure that the application is operational in the base image.
3. Contact Support with your findings.