Citrix App Layering and FSLogix profile containers

As a Citrix Consulting Enterprise Architect, I work with many customers who want to optimize the way Windows and Windows apps are managed in a Citrix solution. Also, because I’m an expert on Citrix App Layering, many customers I work with assume that I would always prefer to use App Layering technologies to solve problems.

But the key to being a good solution architect is to understand all the tools available and to help customers choose the right tool for the right job. Also, it’s important to understand that FSLogix is often used along with Citrix App Layering because these tools solve different problems. In this blog post, I’ll explain the differences between App Layering and FSLogix, where you might choose to use one over the other, and how you can use them together.

FSLogix and App Layering: What’s the Difference?

Many customers I talk to think that FSLogix and Citrix App Layering technologies compete with each other. That’s because in App Layering we have layer or container-based technology called the user layer that enables users to store changes to a non-persistent VDI machine within a writable VHD file stored on a network share. FSLogix provides similar technology with its container-based solutions to store the Windows User Profile or Office-related files (like those used with Outlook and OneDrive), also within a VHD/VHDX file on a network share.

However, the App Layering user layer is really intended to provide almost full persistence to an otherwise non-persistent VDI platform. The user layer can be used for application settings stored in the user profile and for user-installed apps and user files saved anywhere on the desktop. FSLogix has two container-based technologies — one that encompasses the entire user profile (Profile Containers) and one that covers the parts of the user profile pertaining to Microsoft Office and supporting technologies like OneDrive (Office Containers). So, the products are fairly different in their scope: FSLogix targets the user profile or a subset of the profile and the App Layering user layer is all-encompassing, with all desktop writes going into it.

This architectural difference means that FSLogix and user layers fulfill two very different sets of needs for customers. If you’re looking for something to help with profiles and the problems associated with running Office in a non-persistent VDI or remote desktop services environment, then it might be best to use FSLogix or Citrix Profile Management (post 7.18), which has similar features. If you want to provide a persistent user experience on top of a non-persistent VDI, which may include Outlook, OneDrive, search indexing, and more, then the App Layering user layer might be the right choice for you.

Of course, App Layering does much more than provide the functionality of the User Layer. It offers a framework to manage a complex set of apps and images within a multi-hypervisor/cloud environment, including providing image management and dynamic delivery of apps.

Let’s assume you want to use FSLogix to manage user profiles and Outlook but also want to use Citrix App Layering to manage your images and applications. Keep reading to learn how to integrate the products so they work optimally.

Citrix App Layering and FSLogix Integration

It’s actually easy to install and use FSLogix. There’s a small download and installer for the filter drivers that FSLogix deploys. Then there is a set of Group Policy objects that are deployed using an included ADMX file. To use with App Layering, FSLogix can either be installed in a platform or application layer. I recommend an application layer so you can deploy desktops, with and without FSLogix, without having to manage multiple platform layers.

After spinning up an application layer packaging machine, the first step of the install is to copy the FSLogixAppSetup.exe to a folder and run it “As Administrator.” The next step is very important. Filter drivers use a concept of “altitude,” which defines the order in which filter drivers of the same type will be provided access to a file system call from the operating system. File system filter driver vendors request altitude assignments from Microsoft, which manages and assigns the altitudes. By default, the Citrix App Layering and FSLogix altitudes do not allow the products to work together properly. To use FSLogix with Citrix App Layering, the altitude of the FSLogix “frxdrvvt” driver must be changed via the following registry edit:

• Edit HKLM\System\CurrentControlSet\Services\frxdrvvt\Instances\frxdrvvt\Altitude
• Set the value to 138010

Micah Adamson recommends this altitude his msdn post. After making the registry change, you should reboot the packaging machine, then finalize the layer.

That’s is not the end of the install process, though.

FSLogix creates four local groups that are used to manage which users FSLogix will apply to during the installation process:

• FSLogix Profile Include List
• FSLogix Profile Exclude List
• FSLogix ODFC Include List
• FSLogix ODFC Exclude List

If you’ve been using Citrix App Layering for a while, you should know that the only layer where local groups can be added is the OS layer. That’s because the Windows SAM database is encrypted, and we have never been able to merge it from different layers. This means that even though FSLogix added those groups to the packaging machine when we installed the package into an application layer, those groups will never end up on our provisioned machines. The best way to handle this is to create these groups and the desired group membership using Group Policy Preference in Active Directory. This is exactly the same way that we handle groups with the VDA install into the platform layer.

In the appropriate GPO, add a Group Policy Preference to Computer Configuration > Control Panel Settings > Local Users and Groups and add a group called “FSLogix Profile Include List.” Then add your desired domain group to the members. In my example I just use “Domain Users,” but it would be preferable to create an FSLogix Profile Container Users Group.

For the Exclude Group, add “Administrator” and the local administrator will be added to the group. This ensures that when you logon as the local administrator, FSLogix will not create a container for the profile, which can cause problems when managing the image.

After publishing an image that includes the FSLogix layer and deploying the ADMX files with the correct configuration, my VDAs automatically connect to their FSLogix profile container, and I’m able to set up my Outlook OST.

When I use the FSLogix frx.exe command to see what is redirected, I see that my user profile, Windows search, and more are all redirected:

Lastly, I wanted to get an idea of how much time these technologies add to the logon process. I find that increased logon times is a common complaint from those implementing these layers/containerized solutions, and there is some impact there.

I use the exact same image published three ways.

• With no profile management at all, No FSLogix and no user layer
• With FSLogix and no user layer or elastic layering
• With the user layer (no elastic layers) and No FSLogix

I then logged on five times to each and averaged the logon time. I counted the time from clicking the desktop icon in StoreFront until the file manager icon appeared on the taskbar on the desktop. I found that FSLogix provided a slightly faster logon than the App Layering user layer but they were very similar (and they were close to the same time as a full Windows logon without using profile management).

In Summary

1. Use FSLogix to solve problems associated with roaming profiles on non-persistent VDI.
2. Use user layers when you’re trying to provide a persistent user experience on non-persistent VDI.
3. If you’re using FSLogix and Citrix App Layering together, install FSLogix into an application layer.
4. If you’re using FSLogix and Citrix App Layering together, you must change the altitude of the FSLogix filter driver.
5. If you’re using FSLogix and Citrix App Layering together, use a GPP to create the FSLogix local groups

I hope this helps provide some best practices for using FSLogix with Citrix App Layering. I have only looked at FSLogix containers here, but I have some ideas on interesting ways to also integrate App Masking. Keep an eye out for another “better together” blog post from me in the future.