Product Documentation

Monitor Personal vDisks

Jul 07, 2014
You can use a diagnostic tool to monitor the changes made by users to both parts of their Personal vDisks (the user data and the application parts). These changes include applications that users have installed and files they have modified. The changes are stored in a set of reports.
  1. On the machine you want to monitor, run C:\Program Files\Citrix\personal vDisk\bin\CtxPvdDiag.exe.
  2. Browse to a location where you want to store the reports and logs, select the reports to generate, and then click OK. The available reports are listed below.
Software hive report: This report generates two files: Software.Dat.Report.txt and Software.Dat.delta.txt.

The Software.Dat.Report.txt file records the changes made by the user to the HKEY_LOCAL_MACHINE\Software hive. It contains the following sections:

  • List of Applications installed on the base — Applications that were installed in Layer 0.
  • List of user installed software — Applications the user installed on the application part of the personal vDisk.
  • List of software uninstalled by user — Applications the user removed that were originally in Layer 0.

See the hive delta report for information about the Software.Dat.delta.txt.

System hive report: The generated SYSTEM.CurrentControlSet.DAT.Report.txt file records changes the user made to the HKEY_LOCAL_MACHINE\System hive. It contains the following sections:

  • List of user installed services — services and drivers the user installed.
  • Startup of following services were changed — services and drivers whose start type the user modified.

Security hive report: The generated SECURITY.DAT.Report.txt file monitors all changes that the user makes in the HKEY_LOCAL_MACHINE\Security hive.

Security Account Manager (SAM) hive report: The generated SAM.DAT.Report.txt file monitors all changes that the user makes in the HKEY_LOCAL_MACHINE\SAM hive.

Hive delta report: The generated Software.Dat.delta.txt file records all registry keys and values added or removed, and all values the user modified in the HKEY_LOCAL_MACHINE\Software hive.

Personal vDisk logs: The log files Pud-IvmSupervisor.log, PvDActivation.log, PvDSvc.log, PvDWMI.log, SysVol-IvmSupervisor.log, and vDeskService-<#>.log are generated by default in P:\Users\<user account>\AppData\Local\Temp\PVDLOGS, but are moved to the selected location.

Windows operating system logs

  • EvtLog_App.xml and EvtLog_System.xml are the application and system event logs in XML format from the personal vDisk volume.
  • Setupapi.app.log and setuperr.log contain log messages from when msiexec.exe was run during personal vDisk installation.
  • Setupapi.dev.log contains device installation log messages.
  • Msinfo.txt contains the output of msinfo32.exe. For information, see the Microsoft documentation.

File system report: The generated FileSystemReport.txt file records changes the user made to the file system in the following sections:

  • Files Relocated — Files in Layer 0 that the user moved to the vDisk. Layer 0 files are inherited from the master image by the machine to which the personal vDisk is attached.
  • Files Removed — Files in Layer 0 that were hidden by a user's action (for example, removing an application).
  • Files Added (MOF,INF,SYS) — Files with .mof, .inf, or .sys extensions that the user added to the personal vDisk (for example, when they installed an application such as Visual Studio 2010 that registers a .mof file for autorecovery).
  • Files Added Other — Other files that the user added to the vDisk (for example, when installing an application).
  • Base Files Modified But Not Relocated — Files in Layer 0 that the user modified but that the personal vDisk Kernel-Mode drivers did not capture in the vDisk.