Citrix Profile Management Settings

Note:

Some options work only with specific versions of Profile Management. Consult the Profile Management documentation for details.

Workspace Environment Management (WEM) supports all versions of Citrix Profile Management through the current version.

In the console (Configuration Set > Profiles > Profile Management Settings), you can configure all settings for the current version of Citrix Profile Management.

In addition to using WEM to configure Citrix Profile Management features, you can use Active Directory GPOs, Citrix Studio policies, or .ini files on the VDA. We recommend that you use the same method consistently.

Profile Management settings

When enabled, you can configure and apply your settings. Enabling this option creates Profile Management related registries in the user environment. The option controls whether WEM deploys the Profile Management settings you configure in the console to the agent. If disabled, none of the Profile Management settings are deployed to the agent.

By default, most Profile Management settings work only at the machine level. You can enable certain Profile Management settings to work at the user level, so that you can tailor the profile experience for specific users. See User-level Profile Management settings.

You can select tags to filter the profile management settings as needed. Settings associated with the selected tags get displayed and the rest are hidden.

• File-based. Settings that support file-based solution.
• Container-based. Settings that support container-based solution.
• App access control. Settings related to app access control.

When you switch between views, the selected set of tags get saved as a part of administrator preferences for further usage.

Quick setup

To quickly set up Profile Management, you can restore your settings from a backup or start with a template.

Restore from backup

Backups containing Profile Management settings are shown. To upload backups containing Profile Management settings, see Back up Profile Management settings.

Select one backup from the list. Click Preview to see the settings and make adjustments as needed. Other types of settings (if any) in the backup are ignored.

Note:

• To restore Profile Management settings, you can also use the back up and restore feature.
• When restoring Profile Management settings from a backup, the SMB shares selected for relevant services to use are also restored.

Start with template

Important:

If you already have Profile Management configured, keep in mind that using a template overwrites all existing settings.

There are two types of user stores based on how profiles are handled:

• File-based. User profiles are fetched from the remote user store to the local computer on logon and written back on logoff.

• Container-based. User profiles are stored in profile containers. Those containers are attached on logon and detached on logoff.

To set up Profile Management quickly for your use case, choose a template.

User-level Profile Management settings

This feature lets you configure certain Profile Management settings at the user level for customization and precise control. Use this feature to apply specific Profile Management settings to individual users or user groups, tailoring the profile experience as needed.

There are two ways to configure Profile Management settings at the user level:

• Use the Workspace Environment Management web console
• Use the user-level policy setting available with Profile Management

The web console offers a user-friendly, UI-based interface for configuring Profile Management user-level settings.

To configure user-level settings using the web console, complete the following steps.

• On the Profile Management Settings page, click the user-level settings link.
• On the user-level settings page, you can do the following:
  • Add configuration.
  • Set priority order for groups.
  • Toggle between the two views: View by configuration and View by user/group.

Add configuration

To add a configuration, complete the following steps.

1. Name your configuration.

2. Add individual users or user groups to which you want to apply this configuration.

   Note:

   Active Directory (AD) and Azure Active Directory (AAD) are supported.

3. Add settings that you want to apply to those users.

   Note:

   • Only settings available to users are shown in the UI.
   • You can edit or delete settings as needed.

Each time you add a configuration, it appears in Actions > Group Policy settings > Others. For your user-level settings to take effect, you must enable GPO processing (enable the Process GPOs option in Group Policy Settings).

Set priority order for groups

When a session starts, Profile Management determines which policy settings to apply, by prioritizing user settings over user group settings, and user group settings over machine settings.

You can set the priority order for groups to handle the situation (where a user belongs to multiple groups with conflicting settings) by completing the following steps.

1. Select Enable priority order for groups option.
2. Click Add to add groups.

3. Arrange the groups in descending order of priority.

   Note:

   When a user belongs to multiple groups with conflicting settings, the group that appears higher in the list takes precedence.

4. On completion, click Save to exit.

View by configuration or user/group

You can toggle between the two views to view the user-level settings categorized by user/group, or by configuration.

Basic settings

Get started with Profile Management by applying basic settings. Basic settings include processed groups, excluded groups, user store, and more.

Enable Profile Management. Controls whether to enable the Profile Management service on the agent machine. If disabled, the Profile Management service does not work.

You might want to disable Profile Management completely so that settings already deployed to the agent will no longer be processed. To achieve the goal, do the following:

1. Clear the Enable Profile Management checkbox and wait for the change to apply automatically or apply the change manually for immediate effect.

   Note:

   The change takes some time to take effect, depending on the value you specified for SQL Settings Refresh Delay in Advanced Settings. For the change to take effect immediately, refresh agent host settings and then reset Profile Management settings for all related agents. See Administration.

2. After the change takes effect, disable Profile Management Settings.

Set processed groups. Lets you specify which groups are processed by Profile Management. Only the specified groups have their Profile Management settings processed. If left empty, all groups are processed.

Set excluded groups. Lets you specify which groups are excluded from Profile Management.

Process logons of local administrators. If enabled, local administrator logons are treated the same as non-administrator logons for Profile Management.

Set path to user store. Lets you specify the path to the user store — the central location for Citrix user profiles. Enter an absolute UNC path or a path relative to the home directory. Example path:

• \\<IP address or FQDN>\<user store directory>\%USERNAME%.%USERDOMAIN%\!CTX_OSNAME!!CTX_OSBITNESS!

Migrate user store. Lets you specify the path to the folder where the user settings (registry changes and synchronized files) were saved. Enter the user store path that you previously used. Use this option along with the Set path to user store option.

Enable active write back. If enabled, profiles are written back to the user store during the user session, preventing data loss.

• Enable active write back registry. If enabled, registry entries are written back to the user store during the user session, preventing data loss.

• Enable active write back on session lock and disconnection. If enabled, profile files and folders are written back only when a session is locked or disconnected. With both this option and the Enable active write back registry option enabled, registry entries are written back only when a session is locked or disconnected.

Enable offline profile support. If enabled, profiles are cached locally for use while not connected.

Profile container

Configure profile container settings. Profile containers are VHDX disks stored on the network and attached during logon and detached during logoff.

Enable Profile Container. Lets you add the folders you want to include in the profile container. To put an entire user profile in its profile container, add an asterisk (*) instead. If enabled, Profile Management maps the listed folders to the profile disk stored on the network, thus eliminating the need to save a copy of the folders to the local profile. Specify at least one folder to include in the profile container.

• Enable local caching for profile container. If enabled, each local profile serves as a local cache of its profile container. This option requires you to put an entire user profile in its profile container.

• Log off users when profile container is not available during logon. Lets you specify whether to force log-off users when the profile container is unavailable during user logon. Enabling this option displays a notification message to users and logs them off after they click OK.

Enable folder exclusions. If enabled, Profile Management excludes the listed folders from the profile container. Specify at least one folder to exclude from the profile container.

Enable file exclusions. If enabled, Profile Management excludes the listed files from the profile container. Specify at least one file to exclude from the profile container.

Enable folder inclusions. If enabled, Profile Management keeps the listed folders in the profile container when their parent folders are excluded. Folders on this list must be subfolders of the excluded folders. This means that you must use this option with the Enable folder exclusions option. Specify at least one folder to include in the profile container.

Enable file inclusions. If enabled, Profile Management keeps the listed files in the profile container when their parent folders are excluded. Files on this list must be contained in the excluded folders. This means that you must use this option with the Enable folder exclusions option. Specify at least one file to include in the profile container.

TIP:

When adding files or folders, you can use wildcards. For more information, see Wildcard support.

When adding profile container content, exclusions, and inclusions, you can add them individually and in bulk. When adding them in bulk, enter paths separated by line breaks. After that, click Run validation to validate items you are about to add. Only valid items can be added. Invalid items are skipped.

Also, you can have a hierarchical view of the profile container content, exclusions, and inclusions. To do that, click View hierarchy.

Enable VHD auto-expansion for profile container. If enabled, when the profile container reaches 90% utilization, it automatically expands by 10 GB, with a maximum capacity of 80 GB. Depending on your needs, you can adjust the default auto-expansion settings using the following options:

• Auto-expansion trigger threshold (%). Lets you specify the utilization percentage of storage capacity at which the profile container triggers auto-expansion.

• Auto-expansion increment (GB). Lets you specify the amount of storage capacity (in GB) by which the profile container automatically expands when auto-expansion is triggered.

• Auto-expansion limit (GB). Lets you specify the maximum storage capacity (in GB) to which the profile container can automatically expand when auto-expansion is triggered.

Set users and groups to access profile container. Lets you specify which AD domain users and groups have Read & Execute permission on profile containers. By default, a profile container is accessible only to its owner.

Profile handling

Specify how Profile Management handles user profiles.

Delete locally cached profiles on logoff. If enabled, locally cached profiles are deleted when the user logs off.

• Set delay before deleting cached profiles. Lets you specify a delay (in seconds) before cached profiles are deleted on logoff. Supported values: 0–600.

Enable migration of existing profiles. If enabled, existing Windows profiles are migrated to Profile Management on logon. Specify the type of user profiles to migrate if the user store is empty. Types include:

• Local and roaming
• Local
• Roaming

Automatic migration of existing application profiles. If enabled, existing application profiles are migrated automatically. Profile Management performs the migration when a user logs on and when there are no user profiles in the user store.

Enable local profile conflict handling. Configures how WEM handles cases where Profile Management and Windows profiles conflict. Specify what to do if both a local Windows user profile and a Citrix user profile exist in the user store:

• Use local profile
• Delete local profile
• Rename local profile

Enable template profile. Lets you enter a template profile path. If enabled, Profile Management uses the specified template profile. You can configure additional settings as follows:

• Template profile overrides local profile. If enabled, the template profile overrides local profiles.
• Template profile overrides roaming profile. If enabled, the template profile overrides roaming profiles.
• Use template profile as Citrix mandatory profile for all logons. If enabled, the template profile overrides all other profiles.

Advanced settings

Control the advanced configuration of Profile Management.

Enable search index roaming for Microsoft Outlook users. If enabled, the user-specific Microsoft Outlook offline folder file (*.ost) and Microsoft search database are roamed along with the user profile. This improves the user experience when searching for emails in Microsoft Outlook.

• Outlook search index database – backup and restore. If enabled, Profile Management automatically saves a backup of the last known good copy of the search index database. When there is a corruption, Profile Management reverts to that copy. As a result, you no longer need to manually reindex the database when the search index database becomes corrupted.

• Enable concurrent session support. Provides native Outlook search experience in concurrent sessions. If enabled, each concurrent session uses a separate Outlook OST file.

  • Maximum number of VHDX disks for storing Outlook OST files. Lets you specify the maximum number of VHDX disks for storing Outlook OST files. If unspecified, only two VHDX disks can be used to store Outlook OST files (one file per disk). If more sessions start, their Outlook OST files are stored in the local user profile. Supported values: 1–10.

Enable OneDrive container. If enabled, Profile Management roams OneDrive folders with users by storing the folders on a VHDX disk. The disk is attached during logons and detached during logoffs.

Enable UWP app roaming. If enabled, UWP (Universal Windows Platform) apps roam with users. As a result, users can access the same UWP apps from different devices.

Enable use of application definition files. Lets you enter the path to definition files. If enabled, only the settings included in the definition file are synchronized. Specify a folder where the Citrix virtual apps optimization definition files are located. For more information about creating definition files, see Create a definition file.

Default capacity of VHD containers (GB) Lets you specify the default storage capacity (in GB) of each VHD container.

Customize storage path for VHDX files. Lets you specify a separate path to store VHDX files. By default, VHDX files are stored in the user store. Policies that use VHDX files include the following: Profile container, Search index roaming for Outlook, and Accelerate folder mirroring. If enabled, VHDX files of different policies are stored in different folders under the storage path.

Enable multi-session write-back for profile containers. If enabled, Profile Management saves changes in multi-session scenarios for both FSLogix Profile Container and Citrix Profile Management profile containers. If the same user launches multiple sessions on different machines, changes made in each session are synchronized and saved to the user’s profile container disk.

Enable VHD disk compaction. If enabled, VHD disks are automatically compacted on user logoff when certain conditions are met. This option enables you to save the storage space consumed by profile container, OneDrive container, and mirror folder container.

Depending on your needs and the resources available, you can adjust the default VHD compaction settings and behavior using the following options:

• Set free space ratio to trigger VHD disk compaction. Lets you specify the free space ratio to trigger VHD disk compaction. When the free space ratio exceeds the specified value on user logoff, disk compaction is triggered.

  Free space ratio = (current VHD file size – required minimum VHD file size*) ÷ current VHD file size

  * Obtained using the GetSupportedSize method of the MSFT_Partition class from the Microsoft Windows operating system.

• Set number of logoffs to trigger VHD disk compaction. Lets you specify the number of user logoffs to trigger VHD disk compaction.

  When the number of logoffs since the last compaction reaches the specified value, disk compaction is triggered again.

• Disable defragmentation for VHD disk compaction. Lets you specify whether to disable file defragmentation for VHD disk compaction.

  When VHD disk compaction is enabled, the VHD disk file is first automatically defragmented using the Windows built-in defrag tool, and then compacted. VHD disk defragmentation produces better compaction results while disabling it can save system resources.

Enable exclusive access to profile container. If enabled, the profile container allows one access at a time.

Enable exclusive access to OneDrive container. If enabled, the OneDrive container allows one access at a time.

Set number of retries when accessing locked files. Configures the number of times the WEM agent retries accessing locked files. Supported values: 0–100.

Replicate user stores. If enabled, Profile Management replicates a user store to multiple paths on each logoff, in addition to the path that the Set path to user store option specifies. To synchronize to the user stores files and folders modified during a session, enable active write-back. Enabling the option can increase system I/O and might prolong logoffs.

By default, when multiple user stores are available, Profile Management selects the store with the latest profile data. If more than one store has the latest profile, Profile Management selects the one configured earliest. With the User store selection method option, you can now enable Profile Management to select the store with the best access performance.

Enable credential-based access to user store. If disabled, Profile Management impersonates the current user to access user stores. Thus, make sure that the current user can directly access the user stores. If enabled, Profile Management accesses the user stores on behalf of the user through the connections configured for relevant services in Advanced Settings > File Shares > SMB shares. (When needed, Profile Management accesses the selected SMB shares that host the user stores.) Enabling this setting lets you put user stores in file shares (for example, Azure Files) that the current user has no permission to access. When using this option, consider the following:

• To add SMB shares hosting your user stores, go to Advanced Settings > File Shares > SMB shares.

• SMB shares you select in File Shares for relevant services appear here. Profile Management accesses the selected SMB shares as needed.

IMPORTANT:

Disabling this setting deletes all user store connections that the WEM agent previously established.

• When adding or editing credentials, complete the following fields:

  • Server share. Enter a UNC path that specifies a server share.
  • User name. Enter the name in the form domain\username.
  • Password. Enter the password to be used to access the server share.
  • Show password. Control whether to show or hide the password.

Disable automatic configuration. If enabled, dynamic configuration is disabled.

Enable asynchronous processing for user Group Policy on logon. If enabled, Profile Management roams with users a registry value that Windows uses to determine the processing mode for the next user logon — synchronous or asynchronous processing mode. If the registry value does not exist, synchronous mode is applied. Enabling the option ensures that the actual processing mode is applied each time users log on. If disabled, asynchronous mode can’t be applied as expected if users:

Process Internet cookie files on logoff. If enabled, stale cookies are deleted on logoff.

Log off user if problems occur. If enabled, users are logged off rather than switched to a temporary profile if a problem occurs.

• Log on to different machines.
• Log on to the same machine where the Delete locally cached profiles on logoff option is enabled.

Join the Citrix Customer Experience Improvement Program. If enabled, Profile Management uses the Customer Experience Improvement Program (CEIP) to help improve the quality and performance of Citrix products by collecting anonymous statistics and usage information. For more information on the CEIP, see About the Citrix Customer Experience Improvement Program (CEIP).

File system

Specify which files and folders in a profile are excluded from synchronization, which ones are synchronized to the user store, and how to synchronize them.

Enable exclusion check on logon. If enabled, configures what Profile Management does when a user logs on when a profile in the user store contains excluded files or folders. (If disabled, the default behavior is Synchronize excluded files or folders). You can select one of the following behaviors in the list:

• Synchronize excluded files or folders (default). Profile Management synchronizes these excluded files or folders from the user store to local profile when a user logs on.
• Ignore excluded files or folders. Profile Management ignores the excluded files or folders in the user store when a user logs on.
• Delete excluded files or folders. Profile Management deletes the excluded files or folders in the user store when a user logs on.

Enable default folder exclusions. Provides a default list of folders during synchronization. If enabled, folders that are selected in this list are excluded from synchronization.

Enable folder exclusions. If enabled, the listed folders are not included in a user’s profile. This setting lets you exclude specific folders containing a large amount of data that users do not need as part of their profile. The list is pre-populated with default Windows 7 exclusions, and can be pre-populated with default Windows XP exclusions instead.

Enable file exclusions. If enabled, the listed files are not included in a user’s profile. This setting lets you exclude specific files containing a large amount of data that users do not need as part of their profile. The list is pre-populated with default Windows 7 exclusions, and can be pre-populated with default Windows XP exclusions instead.

Enable folder inclusions. If enabled, folders you add are forcibly synchronized to the user store.

Enable file inclusions. If enabled, files you add are forcibly synchronized to the user store.

TIP:

When adding files or folders, you can use wildcards. For more information, see Wildcard support.

Enable folder mirroring. If enabled, the folders you add are mirrored to the user store on logoff, ensuring that files and subfolders in mirrored folders stored in the user store are exactly the same as the local versions. See below for more information about how folder mirroring works.

Accelerate folder mirroring. By default, Profile Management copies necessary transactional folders between the user store and local profiles. Mirroring ensures the integrity of those folders. This option eliminates the need to copy them by using a container-based solution, thus accelerating folder mirroring. Profile Management attaches the virtual disk during logons and detaches it during logoffs, eliminating the need to copy the folders between the user store and local profiles. Files in mirrored folders will always overwrite files stored in the user store on session logoff, irrespective of whether they are modified. If extra files or subfolders are present in the user store compared to the local versions in mirrored folders, those extra files and subfolders are deleted from the user store on session logoff.

• Add folders to mirror. By default, Profile Management copies necessary transactional folders between the user store and local profiles. A transactional folder is a folder containing interdependent files, where one file references other files. You can add more as needed.

Enable large file handling. If enabled, large files are redirected to the user store, thus eliminating the need to synchronize those files over the network.

Note:

Some applications do not allow concurrent file access. We recommend that you take application behavior into consideration when you define your large file handling policy.

When adding exclusions, and inclusions, you can add them individually and in bulk. When adding them in bulk, enter paths separated by line breaks. After that, click Run validation to validate items you are about to add. Only valid items can be added. Invalid items are skipped.

Also, you can have a hierarchical view of exclusions and inclusions. To do that, click View hierarchy.

File deduplication

Specify files that you want to include in the shared store for deduplication.

Identical files can exist among various user profiles. Separating those files from the user store and storing them in a central location saves storage space by avoiding duplicates.

You can specify files that you want to include in the shared store on the server hosting the user store. Specify the file names with paths relative to the user profile.

Enable file deduplication. If enabled, Profile Management generates the shared store automatically. It then centrally stores the specified files in the shared store rather than in each user profile in the user store. Doing so reduces the load on the user store by avoiding file duplication, thus reducing your storage cost.

Tip:

When adding files or folders, you can use wildcards. For more information, see Wildcard support.

When adding inclusions and exclusions, you can add them individually and in bulk. When adding them in bulk, enter paths separated by commas or line breaks. After that, click Run validation to validate items you are about to add. Only valid items can be added. Invalid items are skipped.

By default, Profile Management deduplicates files from profile containers only when those files are larger than 256 MB. If necessary, you can increase this threshold size by providing a larger value for Deduplicate files this size or larger (MB).

Enable file exclusions. If enabled, Profile Management excludes the specified files from the shared store. This option is available only after you enable the Enable file deduplication option. Specify at least one file to exclude from the shared store.

Streamed user profiles

Specify how Profile Management processes streamed user profiles.

Enable profile streaming. If disabled, none of the settings in this section are processed.

• Enable profile streaming for folders. If enabled, folders are fetched only when they are being accessed, thus eliminating the need to traverse all folders during logon. This saves bandwidth and reduces the time to synchronize files.

Always cache. If enabled, files of the specified size (in MB) or larger are always cached. Supported values: 0–20,000.

Set timeout for files in pending area when user store remains locked. Lets you specify the number of days after which user’s files are written back to the user store from the pending area when the user store remains locked. Supported values: 1–30.

Set streamed user profile groups. Lets you add user groups for which streamed profiles are used.

Set excluded folders. If enabled, Profile Management does not stream folders in this list, and all the folders are fetched immediately from the user store to the local machine when users log on.

Enable profile streaming for pending area. If enabled, files in the pending area are fetched to the local profile only when they are requested. This ensures optimum logon experience in concurrent session scenarios. The pending area is used to ensure profile consistency while profile streaming is enabled. It temporarily stores profile files and folders changed in concurrent sessions. By default, this option is disabled. All files and folders in the pending area are fetched to the local profile during logon.

Log settings

Configure Profile Management logging.

Enable logging. Enables or disables logging of Profile Management operations.

Include more information in the logs. Lets you specify more information (or types of events) in the logs, including:

• Common warnings
• Common information
• File system notifications
• File system actions
• Registry actions
• Registry differences on logoff
• Active Directory actions
• Policy values on logon and logoff
• Logon
• Logoff
• Personalized user information

Set maximum size of the log file. Lets you specify a maximum allowed size for the Profile Management log file. If the log file grows beyond the maximum size, its backup (.bak) is deleted, the log file is renamed to .bak, and a new log file is created. Supported values: 1–100.

Set path to log file. Lets you specify the location where the log file is created.

Registry

Specify which registry keys are included or excluded from Profile Management processing.

NTUSER.DAT backup. If enabled, Profile Management maintains a last known good backup of the NTUSER.DAT file. If Profile Management detects corruption, it uses the last known good backup copy to recover the profile.

Enable default registry exclusions. Provides a default list of registry keys in the HKCU hive that are not synchronized to the user profile. If enabled, registry settings that are selected in this list are forcibly excluded from Profile Management profiles.

Enable registry exclusions. If enabled, registry settings you add are forcibly excluded from Profile Management profiles.

Enable registry inclusions. If enabled, registry settings you add are forcibly included in Profile Management profiles.

App access control

Add rules to control user access to items such as files, folders, and registries. A typical use case is to apply rules to control user access to apps installed on machines — whether to make apps invisible to relevant users.

Suppose you need to provide applications (App1, App2, App3, and App4) in desktops assigned to users from three departments: HR, Sales, and R&D.

• Only users from the HR department can access App1.
• Only users from the Sales department can access App2.
• Only users from the R&D department can access App3.
• All users can access App4.

To achieve the goal, you can deploy rules using just one image. The image contains applications App1, App2, App3, and App4. You then set up application rules as follows:

• Create a rule for App1. Add objects associated with App1 and users from the Sales and R&D departments.
• Create a rule for App2. Add objects associated with App2 and users from the HR and R&D departments.
• Create a rule for App3. Add objects associated with App3 and users from the HR and Sales departments.

There are two ways you can create application rules:

• GUI-based tool - WEM Tool Hub > Rule Generator for App Access Control
• PowerShell tool – available with the Profile Management installation package

To get the application rules deployed, use app access control in the web console.

Enable app access control. If enabled, Profile Management processes the app rules. When adding rules, you can browse to a .rule file generated using WEM Tool Hub > Rule Generator for App Access Control or paste data from the clipboard. After adding rules, click Manage to view, edit, or update the rules. When viewing rules, you can switch between category view and raw data view.

Wildcard support

When adding files or folders, you can use wildcards. Wildcards in file names are applied recursively while wildcards in folder names are not. You can use the vertical bar (|) to restrict the policy only to the current folder so that the policy does not apply to its subfolders.

Examples:

• AppData\*.tmp excludes all files with the extension .tmp in the folder AppData and its subfolders.
• AppData\*.tmp| excludes all files with the extension .tmp in the folder AppData.
• Downloads\*\a.txt excludes a.txt in any immediate subfolder of the Downloads folder. Remember: wildcards in folder names are not applied recursively.
• Downloads\* excludes all immediate subfolders of the Downloads folder.