App Layering based assignments

App Layering allows you to assign elastic layers to AD users, groups, and machines.

Prerequisites

• .NET Framework 4.6.2 or higher is required on any image where elastic layers are deployed.
• The app layers that you want to assign as elastic layers.

Elastic layer assignments

You can deliver a specific app layer version to members of a group each time they log in to their desktops. You assign the app layer version as an elastic layer. A copy of the layer is then stored in the appliance’s Network File Share, and delivered on-demand to the assigned AD users and groups, in addition to the layers that they receive via the base image.

To use this feature, you add Elastic Assignments specifying which users and groups receive each revision of the app layer. You then publish your base image with the Elastic Layering setting enabled.

How users access elastic layers assigned to them

When a user logs in to their session or desktop, they receive an elastic layer in the following cases:

• The user (an AD user in the management console) is assigned the layer.
• An AD group that the user belongs to is assigned the layer.
• The machine that the user is logging into is a member of an AD Group that receives the elastic layer.
• The machine that the user is logging into is associated with an AD Group that is assigned to the layer via the management console.

When a user is assigned more than one version of a layer

When a layer is assigned directly to a user, and indirectly to one or more of the user’s groups, they receive the most recent directly assigned version. For example:

• If the user is assigned Version 2, and a group that the user belongs to is assigned Version 3, the user gets Version 2.

• If two or more groups that the user belongs to are assigned different versions of the same layer, the user receives the most recent version of the layer assigned.

When a user receives an app layer both in the base image, and as an elastic layer

When an app layer is included in the base image, do not assign it to the same user as an elastic layer. If the user does end up with the same layer assigned both ways, they receive the elastic layer, no matter the version.

Enable elastic layers on your base images

You can enable elastic layers on your base (layered) images by configuring the image template that you use to publish them:

1. In the management console, select the image template to use for publishing your layered images.

2. Select the Images tab, and then the image template on which you want to enable elastic layering.

3. Select Edit Template from the Action bar.

4. Select the Layered Image Disk tab.

5. In the Elastic layering field, select Application Layering.

6. Select the Confirm and Complete tab, and click Save Template and Publish.

7. Use your provisioning system to distribute the virtual machines.

   When the users log in, the desktop includes an icon for each of their elastic app layers.

Elastically assign an app layer to AD users and groups

The first time you assign an app layer elastically, we recommend starting with a simple app like Notepad++ or GIMP.

1. Log in to the management console as an Admin user, and select Layers > App Layers.
2. Select an app layer that you do not plan to include in the base image, and select the app version you want to assign.
3. Click Update Assignments.
4. Select the version of the app layer that you want to assign users.
5. Skip Image Template Assignment. This is for assigning the layer to an image template.
6. Select the users and groups that you want to receive this app layer version.
7. Review your selections, and click Assign Layers.

When the users log in, there is an icon for each elastic layer they’ve been assigned.

Elastically assign an app layer to users via machine assignments and associations

You can assign layers to a machine by adding the machine to, or associating the machine with, the AD Group. Then elastically assign the app layers to the AD Group.

The layers assigned to the machine are available to every user who successfully logs into that machine. The App Layering Service scans for changes to the machine’s AD group memberships and associations every 10 minutes. When the users log in, they see an icon for each elastic app layer they’ve been assigned.

Use Active Directory to add the machine to the AD Group

Assuming you have a published layered image booted in your environment, you can add the machine to an AD Group, and assign elastic layers to the AD Group.

1. Use Active Directory (AD) to add the machine to an AD Group.

2. Select an app layer that you do not plan to include in the base image, and elastically assign the layer to an AD Group.

3. You can wait for AD to propagate the changes and for the App Layering Service, or you can force the App Layering Service to update its list of machine groups by doing one of the following:

   • Wait for the App Layering Service to detect the changes (within 10 minutes by default).

   • Restart the App Layering Service.

   • Reboot the App Layering Service Machine.

   • Run the refresh.groups command:

     C:\Program Files\Unidesk\Layering Services\ulayer.exe refresh.groups

Example

You start with an AD User, and AD Group, and a machine that you provisioned using a layered image.

• AD User: Kenya
  • Kenya has no elastic assignments.
• AD Group: Marketing
  • The Marketing group includes the member Kenya.
• Machine: ElasticTestMachine
  • The ElasticTestMachine base image includes the MS Office App Layer.

In this example, you elastically assign the Chrome App layer to ElasticTestMachine:

1. In AD, you add the machine ElasticTestMachine to the Marketing AD Group.
2. In the management console you elastically assign the Chrome App Layer to the Marketing Group.
3. When Kenya, who is part of the Marketing group, logs into ElasticTestMachine, she receives both the MS Office App layer, which is in the base image, and the Chrome App layer.
4. When any user who is not in the Marketing group logs into ElasticTestMachine, they also receive both Layers: MS Office because it is in the base image, and Chrome because the ElasticTestMachine is a member of the Marketing AD Group.

Manage elastic assignments

You can:

• Add an elastic assignment.
• Update an app layer and elastically assign the new version of the layer.
• Remove elastic assignments.
• Debug an elastic assignment.

Update an app layer and its elastic assignments

You’ve added elastic assignments to an app layer, and users are accessing the app as expected. A new version of the application is released, so you update it with a new version to the layer. Now you need to assign the new version to the users who have the layer.

1. Log in to the management console and select Layers > App Layers.

2. Select the elastically assigned app layer that you updated.

3. Click Version Information > Update Assignments.

4. Select the new version.

5. Skip the Image Template Assignment tab.

6. In the Elastic Assignment tab, there’s a list of Users and Groups who have been assigned a different version of the selected layer. Select the users and groups to whom you want to assign the new version of the layer.

   Notes:

   • If the list is long, use the Search field to filter the results.
   • If the list is empty, click the check box called, Show AD users and groups already at this version. A list of grayed out names appears. These users have already been assigned the version.

7. On the Confirm and Complete tab, verify the Users and Groups that you want to receive the new version.

8. Click Update Assignments.

Remove a layer’s elastic assignments

1. Log in to the management console and select Layers > App Layers.

2. Select the app layer for which you want to remove assignments, and select Remove Assignments.

3. Select the assigned templates from which you want to remove the layer. The assignments for the layer are listed.

   If the list is long, use the Search field to filter the results.

4. On the Confirm and Complete tab, verify that the correct image templates are selected to receive the new version.

5. Click Remove Assignments.

OS layer switching for elastic layers

For best results, when assigning app layers as elastic layers, you can assign app layers that have the same OS layer as the one used in the layered image. However, with this traditional approach, you might need to create and manage additional copies of some app layers, one for each OS layer you deploy with.

For greater flexibility and to reduce the need to duplicate app layers, you can assign an elastic layer to users on layered images that use a different OS layer. You can enable this ability in the application layer properties by selecting the Allow this App Layer to be elastically assigned to all Layered Images, regardless of OS layer check box. All elastic layering limitations are valid when switching OS layers.

When it might work well

For simple applications that can be installed on any OS. Example: Notepad++, WinRAR, 7Zip

When it might not work well

For complex applications whose installation depends on the OS installed. Example:

• If you use a Windows 11 OS layer to create the app layer, and the image assigned as a Server 2022 OS layer, then the application might not work as expected.
• Applications that are dependent on a specific version of .Net might not run successfully if the new OS doesn’t have the correct version of .Net installed.

Note:

• It is recommended that you use the same OS class and OS revisions that are close to each other. Example: You can use two Windows 11 25H2 revisions that are one week apart.

Elastic layer compatibility mode

By default, elastic layers assigned through App Layering are composited into the image after the user logs on. If an elastic layer doesn’t load correctly, try enabling Elastic Layer Compatibility Mode. With Compatibility Mode enabled, the elastic layer starts loading before login is complete.

Notes:

• Compatibility mode is required when using published applications, as the layer must be mounted before launch
• We recommend disabling compatibility mode unless an elastic layer doesn’t work as expected
• Enabling this setting on too many layers slows login times