Deploy elastic layers

With the Elastic layers feature, you can deliver narrowly targeted apps outside of the base image. In fact, you can assign layers to specific users on demand that are delivered during logon to Windows.

About elastic layers

An elastic layer is an app layer that you assign to individual users and groups for delivery on demand. Users receive the elastic layers assigned to them in addition to the apps included in the base image.

Elastic layers allow you to give each user a unique set of applications along with the common apps included in the base image. On session hosts, an elastic layer is used across sessions. On standalone desktops, elastic layers are used across floating pools and shared groups.

Studio App Packaging based assignment

Elastic Layers can be assigned through Studio App Packages, enabling you to use a single workflow, from a single console, to deliver applications to all of your Citrix non-persistent workspaces. For more information, see Studio App Packaging based assignments.

App Layering based assignment

App Layering allows you to assign elastic layers to AD users, groups, and machines. For more information, see App Layering based assignments.

Elastic Layering Limitations

You cannot use elastic layer for the following:

• Microsoft Office, Office 365, Visual Studio.
• Applications with drivers that use the driver store. Example: a printer driver.
• Applications that modify the network stack or hardware. Example: a VPN client.
• Applications that have boot level drivers. Example: a virus scanner.

An app layer does not preserve a local user or administrator that you add for an app that requires it, but the OS layer does. Therefore, add the local user or administrator to the OS layer before installing the application. Once the app layer is working, you can assign it as an elastic layer.

The user account used to attach elastic layers

By default, when the first user assigned an elastic layer logs on to a machine, all elastic layers assigned to the user are mounted. Other users who log on to the same machine use the same connection as the first user. The connection lasts for 10 hours after the first login, and then all elastic layers are disconnected if the first user is no longer logged in. In a shift-based environment, users on the second shift would be impacted about two hours into the shift (or, 10 hours after the initial user logged on for the first shift).

If you are delivering elastic layers in a shift-based environment, you can change the account used to attach elastic layers. Instead of attaching as the first user who logs in, you can change the user used to attach all elastic layers to the ulayer service, which runs under the local SYSTEM account. The SYSTEM account corresponds to the domain machine account of the machine that the ulayer service is running on when accessing the share. This account must have read-only access to the file share containing your elastic layers.

• To change the account used to attach elastic layers to SYSTEM, create the registry DWORD value, and set it to 1:

  HKEY_LOCAL_MACHINE\Software\Unidesk\Ulayer:AsSelfAppAttach to **1**

• To revert to attaching elastic layers using the account of the first user to log in, set the registry DWORD value to 0:

  HKEY_LOCAL_MACHINE\Software\Unidesk\Ulayer:AsSelfAppAttach to **0**

• To revert to the default behavior, remove the DWORD value:

  HKEY_LOCAL_MACHINE\Software\Unidesk\Ulayer:AsSelfAppAttach

Note:

For multi-session use cases, it is recommended to change the account used to attach elastic layers to the SYSTEM account.

Run the Elastic Fit analyzer on app layers

Before assigning an app layer elastically, use the Elastic Fit Analyzer to determine the likelihood that the layer assignment will be successful.

Elastic Fit analysis

In the Layer Details, the Elastic Fit rating indicates how likely it is that the layer works when elastically assigned.

Good Elastic Fit. This layer works when deployed elastically.

Poor Elastic Fit. Delivering the layer elastically is not likely to work when deployed elastically. The layer can behave differently than it does when it is deployed in a layered image.

Elastic Fit details

You can learn more about an app layer’s Elastic Fit rating by expanding the Elastic Fit Analysis. If the Elastic Fit is less than ideal, the list of violated rules is displayed.

Low Severity Warning. Delivering the layer elastically is unlikely to cause any change in behavior or functionality for most applications.

Medium Severity Warning. Delivering the layer elastically can cause minor changes in behavior or functionality for some applications.

High Severity Warning. Delivering the layer elastically is likely to cause significant changes in behavior or functionality for many applications.

Note:

If you receive a warning that a master key file change has been detected, and you did not intentionally change that file, set the value of the DeleteMasterKeys flag in the registry location HKLM\System\ControlSet001\Services\Uniservice to 1 (true). Now when the app layer is finalized, master key files are deleted from the layer. This value is not persistent and only works per revision. It must be set each time a revision of the layer is created.

Analyze an app layer’s Elastic Fit

All new versions of a layer version are analyzed for elastic layering compatibility when they are finalized. To analyze existing app layers for Elastic Fit:

1. Log in to the management console.
2. Select Layers > App Layers.
3. Select the layer to analyze, and click Analyze Layer.
4. On the Select Versions tab, choose the Layer Versions to analyze.
5. On the Confirm and Complete tab, click Analyze Layer Versions. The analysis takes seconds.
6. To see the Elastic Fit Analysis, select the app layers module, move the mouse pointer over the layer icon and click the Info icon.
7. Expand the Version Information for each layer version, and look for the Elastic Fit rating.
8. For a detailed report, expand the Elastic Fit Details. If the Elastic Fit is less than ideal, the list of violated rules will be displayed.
9. You can display the AD tree and hide the violated rules by clicking a button acknowledging that the layer is unlikely to work as expected.

Upgrading from earlier releases

After upgrading from an early App Layering release, the Elastic Fit Detail shows that existing layer versions have not been analyzed. The versions have a single High severity Elastic Fit Detail, and a Poor Elastic Fit. For an accurate reading, run the analysis on existing layer versions.

Troubleshooting elastic layer issues

You can diagnose the source of an elastic layering issue by finding out whether the layer is being delivered, and whether the layer is working correctly. If needed, collect data for support, as described here.

Is the issue with layer delivery?

Are the things that you’d expect to see when this app is installed there?

• Do you see the files and registry entries for the layer?
• If the app is supposed to be in the Start menu, is it there?
• If you expect there to be a shortcut for the app on the user’s desktop, is there one?

If you discover that app delivery is an issue, you can collect the following data, open a case, and send the data to support.

1. Collect the data from these logs:

   • Windows App Event log – In the Windows Event Viewer under Windows Logs, export the application event log as an EVTX file.
   • App Layering Service log (ulayersvc.log) – C:\ProgramData\Unidesk\Logs\ulayersvc.log

2. Collect the values of these Registry keys:

   • HKEY_LOCAL_MACHINE\SOFTWARE\Unidesk\ULayer:AssignmentFile
   • HKEY_LOCAL_MACHINE\SOFTWARE\Unidesk\ULayer:RepositoryPath

3. Collect the contents of the assignment (ElasticLayerAssignments.json) and Layers (Layers.json) files from the Repository Path.

4. Contact Support.

Is the issue an operational one?

Any of these behaviors can indicate an elastic layering issue:

• The app is being delivered but doesn’t launch correctly.
• An operation within the app doesn’t work correctly.
• A licensing problem or a security issue.
• The app launches, but then misbehaves, for example, it crashes on startup, or starts up but doesn’t work right.

If the problem with the layer is operational, test the app layer in the base image to rule out general layering issues:

1. Add the app layer to an image template, and publish a layered image that includes the app layer.
2. Log in as a user who is not assigned the layer elastically, and make sure that the application is operational in the base image.
3. Contact Support with your findings.