Create Platform layer

A Platform Layer includes the platform software and settings required for your layers and layered images to run flawlessly in your environment.

You can create Platform Layers for two purposes:

  • For creating and packaging layers: Use this type of Platform layer for creating App layers when you’ve imported the operating system for your OS layer from a different hypervisor than the one on which you are building your layers.

  • For publishing layered images: Use this type of Platform layer in your image template so that the published layered images run flawlessly in your environment.

Platform layers for packaging layers or publishing Layered Images

Use the following table to determine whether you need a Platform layer, and if you do, what software to install on it.

  Packaging layers Publishing layered images
Platform layer required? Only required if the OS image originated in a different hypervisor. Required when publishing to a provisioning service and/or using a connection broker.
What to install Hypervisor tools, that is, when OS originated on different hypervisor. Provisioning service and connection broker software and settings. And, if publishing to a different hypervisor than the OS originated from, include hypervisor tools.
Values to select Select your hypervisor. Select your hypervisor, provisioning service and connection broker.
What you need Installer for hypervisor Installers for provisioning service and connection broker.

Other software and settings to include in the Platform layer

Besides the platform software specified above, you must include the following settings and software in the Platform layer:

  • Domain join
  • NVIDIA Drivers, if applicable
  • Citrix Receiver, for the Single Sign-on component
  • Citrix Workspace Environment Management(WEM) agent
  • Any software that impacts the logon stack, for example, Imprivata
  • Citrix Provisioning on Hyper-V: Requires a Legacy Network Adapter to PXE boot.

Process for creating a Platform layer

The general steps for creating a Platform Layer are to:

  1. Complete the Create Platform Layer wizard in the management console.
  2. Connect to and log into the packaging machine.
  3. Install your provisioning service and connection broker software.
  4. If the App Layering appliance is installed on a different hypervisor than the one you are creating layers for or publishing images to, also install the hypervisor tools in this layer.
  5. Verify the layer and shutdown the packaging machine.
    • If the connector configuration selected in the wizard is set to use Offload Compositing, the layer is automatically finalized.
    • If the connector configuration is not set to Offload Compositing, finalize the layer manually, as described in the detailed steps in this article.


When creating a Platform layer, the software installers for your platform must be available in a location that’s accessible to the packaging machine where you are creating the layer. This includes your provisioning service and connection broker. And if the appliance is running on a different hypervisor, include the hypervisor tools for the platform you are layering and publishing.

For detailed requirements, select the environment where your layers will be created and packaged, or your layered images published:

A word on optimizations

Since the platform layer is the highest priority layer you might think it would be the best layer to include optimizations. However, with Windows 10, any optimization that removes Windows Apps only works when run in the OS layer. Otherwise, the apps are integrated with the Windows Store and the store can only be modified in the OS layer. Recently Citrix has developed an excellent Optimizer (CTXOE). This tool is highly recommend to use for optimizations, as it can apply them and also usually reverse them, if needed.

You may be able to speed up user logins by doing the following. After joining the domain login using a network user account, you then reboot the desktop, log on as administrator, and delete the profile created. When the first network user logs on, some system files must be updated, but logins may be faster.

Start a new Platform layer

To create a Platform layer you prepare the layer using the Create Platform Layer wizard, deploy a packaging machine in your environment, install the tools and configure the settings for your environment, and finalize the Layer.

  1. Select Layers > Platform Layers and select Create Platform Layer in the Action bar. This opens the Create Platform Layer wizard.

  2. In the Layer Details tab, enter a Layer Name and Version, both required values. Optionally, you can also enter other values.

  3. In the Version Details tab:

    1. (Required) Enter a name for the New Version. This can be the software version or other identifying information.
    2. If you are adding a version to an existing layer, the Base Version field lets you choose which version to use as the starting point. The default choice is the latest version.
  4. In the OS layer tab, select the OS layer you want to associate with this Platform layer.

  5. In the Connector tab, choose a Connector Configuration for the platform where you are creating this layer. If the configuration you need isn’t listed, select New. Then,add a connector configuration, and select it.

  6. In the Platform Types tab, select This platform will be used for publishing layered images, or This platform will be used for packaging, and the hypervisor, provisioning service, and connection broker to which you will be publishing the layered image. Note: If you are not using a provisioning service or a connection broker, select None for each of those.

  7. In the Packaging Disk tab, enter a file name for the packaging disk. This disk will be used for the packaging machine (the virtual machine) where you will install the tools, as described in the next two sections.

  8. In the Icon Assignment tab, select an icon to assign to the layer. This icon represents the layer in the Layers module.

    • To use an existing image, select an image in the image box.
    • To import a new image, click Browse and select an image in PNG or JPG format.
    • If you are using a connector with Offload Compositing selected, and you choose one of the icons that came with App Layering, the packaging machine attempts to assign an icon based on the layer’s contents when the layer is finalized.
  9. In the Confirm and Complete tab, review the details of the App layer, enter a comment if required, and click Create Layer. Any comments you enter will appear in the Information view Audit History.

  10. Expand the tasks bar at the bottom of the UI, and double-click the Packaging Disk task to show the full task description.

    Once the packaging disk has been created, the Tasks bar displays the location of the packaging disk in your environment.

Next, you can deploy the packaging machine for your layer.

Deploy a Packaging Machine

When you’ve completed the Create Layer wizard, the App Layering system creates a packaging machine (a virtual machine) in the location defined in the connector configuration. The packaging machine is a temporary virtual machine where you install the software to be included in the layer. It is deleted once the layer has been finalized.

Citrix Hypervisor, Hyper-V, Nutanix AHV, VMware vSphere

The appliance creates the packaging machine in the location defined in the connector configuration.

  1. Go to the App Layering management console, expand the Tasks bar at the bottom of the console, and open the Create Platform layer task to get the name of the packaging machine.
  2. Log into your hypervisor management console. (Citrix Hypervisor, Azure, Hyper-V, Nutanix, or VMware)
  3. From the hypervisor manager console, navigate to the packaging machine. If the packaging machine is not yet powered on, do so now.

Citrix Provisioning for Hyper-V: Configuring two network cards

When using dual network cards and running Citrix Provisioning for Hyper-V, you must configure the cards as follows on every new version of the Platform layer.

After installing Provisioning, and after all required reboots have been completed:

  1. Open an administrative command prompt on the packaging machine.
  2. Run the command:

    ipconfig /all

  3. Match the IP address of the streaming NIC (Legacy Network Adapter in Hyper-V) with the correct adapter name.
  4. Renew the DHCP lease on the streaming NIC.
  5. Again in an administrative command prompt run ipconfig /release adapter-name followed by ipconfig /renew adapter-name. This forces the App Layering drivers to select this adapter as the “primary NIC”.
  6. Run Shutdown for Finalize and finalize the layer as you normally would.


If you select Shutdown for Finalize, but then need to turn the machine back on for any reason, you must re-run the release and renew commands.


  1. Go to the App Layering management console, expand the Tasks bar at the bottom of the console. Open the Create App layer task details.
  2. Use the link in the task details to navigate to the packaging machine in Azure. The Custom deployment panel opens.
  3. Log into the Azure portal (
  4. Set the Azure parameters.
    • Packaging Machine Name - must conform to Azure virtual machine name requirements.
    • Size – virtual machine size.
    • Virtual Network and Subnet - for deploying the packaging machine. IMPORTANT: Make sure the value for the Resource group location matches the Storage account location that you configured in the connector configuration. If these locations are not the same, the packaging machine fails to deploy. If your deployment does fail, you can paste the link into the browser again and start over.
  5. Once your packaging machine is powered on, you can install the application(s) you want to include in the layer.

Any other Hypervisor (via Network File Share)

  1. Locate the Packaging Disk in the following directory on the Network File Share: \Unidesk\Packaging Disks

  2. Copy the Packaging Disk to a separate location on your hypervisor. This allows space for the files generated by your hypervisor when you use the disk to create a new virtual machine.

    IMPORTANT: Do not copy the disk to the Finalize folder until it is ready to finalize. A disk in the Finalize folder cannot be attached to the new virtual machine that you are going to create next.

  3. Create a virtual machine using the packaging disk as the boot disk.

  4. Power on the packaging machine.

Once your packaging machine is powered on, you can install your platform tools in the layer.

Install the platform tools on the packaging machine

Now it’s time to install the software for the platform where you are publishing your layered images. This includes the provisioning service, connection broker software that your layered images will need to run in the target environment. Keep in mind that the state of the software before you finalize the layer is what the image will use.

  1. Remote log into the packaging machine. Be sure to log in using the User account you used to create the OS.
  2. Install the tools that your layered image will need to run in your environment. This includes any provisioning service, connection broker, and hypervisor tools you are using, along with any drivers, boot-level applications, and files needed.
  3. If the installation requires a system restart, restart it manually. The packaging machine does not restart automatically.
  4. Make sure the packaging machine is in the state you want it to be in when the image is booted:
    • If the tools you install require any post-installation setup or registration, complete those steps now.
    • Remove any settings, configurations, files, mapped drives, or applications that you do not want to include on the packaging machine.

Verify the Layer and shut down the Packaging Machine

Once the tools are installed on the Packaging Machine, the next step is to verify that the Layer is ready to finalize. At this point, any required post-installation processing needs to be completed. For example, a reboot may be required, or a Microsoft NGen process may need to complete.

To verify that any outstanding processes are complete, you can run the Shutdown For Finalize tool (icon below), which appears on the packaging machine’s desktop.

Shut down the packaging machine so you can finalize the layer

  1. If you are not logged into the packaging machine, remote login using the account set up during OS layer creation.
  2. Double-click the Shutdown For Finalize icon. A command line window displays messages detailing the layer verification process.
  3. If there is an outstanding operation that must be completed before the layer can be finalized, you are prompted to complete the process. For example, if a Microsoft NGen operation needs to complete, you may be able to expedite the NGen operation, as detailed below.
  4. Once any pending operations are complete, double-click the Shutdown For Finalize icon again. This shuts down the packaging machine.

The Layer is now ready to finalize.

  • If the connector configuration selected is set to Offload Compositing, the layer is automatically finalized.
  • If you are not using Offload Compositing, finalize the layer manually.

Layer integrity messages you may see during the finalization process

Layer integrity messages let you know what queued tasks must be completed before a Layer is finalized.

The new Layer or Version can only be finalized when the following conditions have been addressed:

  • A reboot is pending to update drivers on the boot disk - please check and reboot the Packaging Machine.
  • A post-installation reboot is pending - please check and reboot the Packaging Machine.
  • An MSI install operation is in progress - please check the Packaging Machine.
  • A Microsoft NGen operation is in progress in the background.

Note: If a Microsoft NGen operation is in progress, you may be able to expedite it, as described in the next section.

Expediting a Microsoft NGen operation

NGen is the Microsoft Native Image Generator. It is part of the .NET system, and basically re-compiles .NET byte code into native images and constructs the registry entries to manage them. Windows will decide when to run NGen, based on what is being installed and what Windows detects in the configuration. When NGen is running, you must let it complete. An interrupted NGen operation can leave you with non-functioning .NET assemblies or other problems in the .NET system.

You have the choice of waiting for the NGen to complete in the background, or you can force the NGen to the foreground. You can also check the status of the NGen operation, as described below. However, every time you check the queue status, you are creating foreground activity, which might cause the background processing to temporarily pause.

Forcing the NGen to the foreground will allow you to view the progress and once the output has completed, you should be able to finalize the layer.

  1. Force an NGen operation to the foreground.

    Normally, NGen is a background operation and will pause if there is foreground activity. Bringing the task into the foreground can help the task to complete as quickly as possible. To do this:

    1. Open a command prompt as Administrator.

    2. Go to the Microsoft .NET Framework directory for the version currently in use:

      cd C:\Windows\Microsoft.NET\FrameworkNN\vX.X.XXXXX

    3. Enter the NGen command to execute the queued items:

      ngen update /force

      This brings the NGen task to the foreground in the command prompt, and lists the assemblies being compiled.

      Note: It’s okay if you see several compilation failed messages.

    4. Look in the Task Manager to see if an instance of MSCORSVW.EXE is running. If it is, you must allow it to complete, or re-run ngen update /force. Do not reboot to stop the task. You must allow it to complete.

  2. Check the status of an NGen operation

    1. Open a command prompt as Administrator.
    2. Check status by running this command:

      ngen queue status

    3. When you receive the following status, the NGen is complete, and you can finalize the Layer.

      The .NET Runtime Optimization Service is stopped.

Finalize the layer manually

Once the software has been installed and the packaging machine has been verified and shut down, you are ready to finalize the layer.

Citrix Hypervisor, Azure, Hyper-V, Nutanix AHV, VMware vSphere

Now that the layer has been verified and shut down, it is ready to finalize.


If you are using a connector with Offload Compositing selected, this finalization process is automated and you do not have to do these manual steps.

  1. Return to the management console.
  2. Select Layers > Platform layers, and the layer you just prepared.
  3. Select Finalize in the Action bar. The Finalize wizard opens.
  4. Click Finalize to finish creating the layer.
  5. Monitor the task bar to verify that the action completes successfully.

Once the layer is verified, the packaging machine is removed to minimize storage space used.

Any other hypervisor (via Network File Share)

Now that the Layer has been verified and shut down, it is ready to finalize.

  1. Copy the Packaging Disk from the folder containing the packaging machine files to the Finalize folder on the Network File Share: \Unidesk\Finalize

  2. Return to the management console.

  3. Select Layers > Platform Layers.

  4. Select Finalize in the Action bar.

  5. Monitor the Task bar to verify that the action completes successfully and that the layer is deployable.