AppSense Environment Manager Policy Configurations Lost
Have you ever seen AppSense items disappearing while users are logged on? Typically this can be a user that misses mapped drives, shortcuts or GPO settings. This is out-of-the-box behavior of AppSense. To understand why this happens and how you can prevent it from happening, please read this post.
When a new AppSense EM policy configuration is applied on a computer, all the settings from the old configuration are erased because they are no longer applicable. The new configuration will not be applied yet, since the trigger (at logon, at process started…) did not run yet.
To avoid this behavior there are three possible solutions:
- Select “Apply policy settings permanently” on GPO settings and deselect all the “unmap at logoff” options on the drive and printer mappings.
- Do not install configurations while users are logged on.
- Create a regkey (PreventUnapplyOnConfigChange) to make sure that settings stay as they were.
The problem with the first option is that the GPO settings are “tattooed” in the registry. Meaning that if you remove a certain setting, it will not be automatically removed from the computer. This is a big loss of flexibility.
Apply at computer startup
For the second option, AppSense has its agent installation schedule, giving you a choice to apply configurations at certain times:
- Same as Agent – Assigned configurations will use the same settings as the agent.
- Disable – Assigned configurations will not be downloaded or installed.
- Immediately – Assigned configurations are installed once they are downloaded. This is the default setting for deployment groups with the exception of the (Default) group, which has a default setting of Disable.
- At Computer Startup – Assigned configurations are installed when endpoints are started.
- Schedule – Assigned configurations are installed at scheduled times. Select to display the Schedule.
I prefer to update configurations “At Computer Startup”. I know with this option it takes a lot more time to update your configurations, but at least you have a stable environment. The option “Immediately” is what I use when I’m testing new settings in a development, test or acceptance environment. It provides the speed of quick installs and the people that are testing are aware that they have to re-logon to be sure that all the settings apply perfectly.
AppSense Registry tweak
When Appsense EM detects a new configuration was installed, it will loop through the old configuration and unapply some configuration items, such as drive mappings that have the Unapply at logoff setting checked. By setting this registry key, AppSense disables this behavior and will load the new configuration without modifying the environment at that time. As a result, current logged on users keep their configuration for the duration of their session. The new configuration is active, and for example “process started” actions are already loaded from the new configuration.
To use this setting, modify the following registry key:
Key: HKEY_LOCAL_MACHINE\Software\AppSense\Environment Manager
Set to 1 to enable (do not un-apply settings)
This is not a registry key that exists on your endpoints by default. You will have to create it yourself. (I suggest to make it part of your startup trigger in the EM policy configuration)
EDIT 23/7: I wrote a followup article which explanes a new feature in version 8.5 that solves this issue: Updates in AppSense EM 8.5: Mid-Session Config Changes