Symantec Workspace Virtualization

Symantec Workspace
Virtualization 6.1 SP6 User's

Guide
Symantec Workspace Virtualization 6.1 SP6 User's
Guide
The software described inthis book is furnished under a license agreement and may be used
only in accordance with the terms of the agreement.
Documentation version: 6.1 SP6
Legal Notice
Copyright 2010 Symantec Corporation. All rights reserved.
Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec
Corporationor its affiliates inthe U.S. andother countries. Other names may be trademarks
of their respective owners.
This Symantec product may contain third party software for which Symantec is required
to provide attribution to the third party (Third Party Programs). Some of the Third Party
Programs are available under opensource or free software licenses. The License Agreement
accompanying the Software does not alter any rights or obligations you may have under
those opensource or free software licenses. Please see the ThirdParty Legal Notice Appendix
to this Documentation or TPIP ReadMe File accompanying this Symantec product for more
information on the Third Party Programs.
The product described in this document is distributed under licenses restricting its use,
copying, distribution, and decompilation/reverse engineering. No part of this document
may be reproduced in any form by any means without prior written authorization of
Symantec Corporation and its licensors, if any.
THEDOCUMENTATIONISPROVIDED"ASIS" ANDALLEXPRESSORIMPLIEDCONDITIONS,
REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT,
ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO
BELEGALLYINVALID. SYMANTECCORPORATIONSHALLNOTBELIABLEFORINCIDENTAL
OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING,
PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED
IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.
The LicensedSoftware andDocumentationare deemedto be commercial computer software
as defined inFAR12.212 and subject to restricted rights as defined inFARSection52.227-19
"Commercial Computer Software - Restricted Rights" and DFARS 227.7202, "Rights in
Commercial Computer Software or Commercial Computer Software Documentation", as
applicable, and any successor regulations. Any use, modification, reproduction release,
performance, display or disclosure of the Licensed Software and Documentationby the U.S.
Government shall be solely in accordance with the terms of this Agreement.
Symantec Corporation
350 Ellis Street
Mountain View, CA 94043
http://www.symantec.com
Printed in the United States of America.
10 9 8 7 6 5 4 3 2 1
Technical Support
Symantec Technical Support maintains support centers globally. Technical
Supports primary role is to respond to specific queries about product features
andfunctionality. The Technical Support groupalso creates content for our online
Knowledge Base. The Technical Support group works collaboratively with the
other functional areas within Symantec to answer your questions in a timely
fashion. For example, the Technical Support groupworks withProduct Engineering
and Symantec Security Response to provide alerting services and virus definition
updates.
Symantecs support offerings include the following:
A range of support options that give you the flexibility to select the right
amount of service for any size organization
Telephone and/or Web-based support that provides rapid response and
up-to-the-minute information
Upgrade assurance that delivers software upgrades
Global support purchased on a regional business hours or 24 hours a day, 7
days a week basis
Premium service offerings that include Account Management Services
For information about Symantecs support offerings, you can visit our Web site
at the following URL:
www.symantec.com/business/support/
All support services will be delivered in accordance with your support agreement
and the then-current enterprise technical support policy.
Contacting Technical Support
Customers with a current support agreement may access Technical Support
information at the following URL:
Before contacting Technical Support, make sure you have satisfied the system
requirements that are listed in your product documentation. Also, you should be
at the computer onwhichthe problemoccurred, incase it is necessary to replicate
the problem.
When you contact Technical Support, please have the following information
available:
Product release level
Hardware information
Available memory, disk space, and NIC information
Operating system
Version and patch level
Network topology
Router, gateway, and IP address information
Problem description:
Error messages and log files
Troubleshooting that was performed before contacting Symantec
Recent software configuration changes and network changes
Licensing and registration
If your Symantec product requires registrationor alicense key, access our technical
support Web page at the following URL:
Customer service
Customer service information is available at the following URL:
Customer Service is available to assist with non-technical questions, such as the
following types of issues:
Questions regarding product licensing or serialization
Product registration updates, such as address or name changes
General product information (features, language availability, local dealers)
Latest information about product updates and upgrades
Information about upgrade assurance and support contracts
Information about the Symantec Buying Programs
Advice about Symantec's technical support options
Nontechnical presales questions
Issues that are related to CD-ROMs or manuals
Support agreement resources
If you want to contact Symantec regarding an existing support agreement, please
contact the support agreement administration team for your region as follows:
customercare_apac@symantec.com Asia-Pacific and Japan
semea@symantec.com Europe, Middle-East, and Africa
supportsolutions@symantec.com North America and Latin America
Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Chapter 1 Introducing Symantec Workspace
Virtualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
About Workspace Virtualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Solving Problems with Workspace Virtualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Provisioning and deprovisioning applications is disruptive to
the user and time consuming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Recovering a damaged application is time consuming . . . . . . . . . . . . . . . . . . . 12
Conflicting applications are difficult or impossible to
manage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Migratingtonewapplicationversions requires significant testing
and planning; takes a long time to execute and rollback is
difficult . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
How Workspace Virtualization works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
About file and registry redirection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
About Virtual Software Layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
About Extensible Package Format (XPF) files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Virtual Software Layer architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Chapter 2 Planning for the use of Virtual Software
Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
About working with virtual software packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Virtual software package workflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
What you can virtualize using the Workspace Virtualization
Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
How to prevent the loss of application data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Where you can use Virtual Software Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
How the Workspace Virtualization Agent affects security . . . . . . . . . . . . . . . . . . . . 21
Rights to modify a virtual software package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Rights to user-specific data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Rights to start programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
About handling duplicate services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
About multiple concurrent user support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Contents
Chapter 3 Installing the Symantec Workspace Virtualization
Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Supported platforms for the Workspace Virtualization Agent . . . . . . . . . . . . . . 25
Installing the Workspace Virtualization Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Installing the Workspace Virtualization Agent silently . . . . . . . . . . . . . . . . . . . . . . . 27
What the Workspace Virtualization Agent installs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Upgrading the Workspace Virtualization Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Uninstalling the Workspace Virtualization Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Troubleshooting Workspace Virtualization Agent installations . . . . . . . . . . . . 30
Cleaning up a failed Workspace Virtualization Agent
installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Removing the WMI Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Uninstalling the Agent in Runtime Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Chapter 4 Creating virtual software layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
About the creation of virtual software layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Types of virtual software layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Methods for capturing virtual software layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Creating an application layer using single program capture . . . . . . . . . . . . . . . . . 35
Creating an application layer using global capture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Adding an application to an existing layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Creating a data layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Creating an empty layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Chapter 5 Editing virtual software layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Configuring a virtual software layer to start automatically . . . . . . . . . . . . . . . . . . 44
Activating a virtual software layer using a desktop shortcut . . . . . . . . . . . . . . . . 44
Editing the files in a virtual software layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Editing the registry settings of a virtual software layer . . . . . . . . . . . . . . . . . . . . . . . 46
Editing a data layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Adding exclude entries to virtual software layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Adding a layer exclude entry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Adding a global exclude entry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Adding a global user profile exclude entry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Ignoring the global exclude list for a single layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Transferring global excludes to another computer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Adding a delete entry to a virtual software layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
About updating a virtual software layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Updating a virtual software layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Creating a layer patch to update a virtual software layer . . . . . . . . . . . . . . . . . . . . . 54
Renaming a virtual software layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Contents 8
Chapter 6 Managing virtual software layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
About the management of virtual software layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Actions you can perform to manage layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Exporting a virtual software layer to an archive file . . . . . . . . . . . . . . . . . . . . . . 59
Importing a virtual software archive file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Activating and deactivating virtual software layers . . . . . . . . . . . . . . . . . . . . . . 61
Resetting application layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Deleting virtual software layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Testing a virtual software layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Interoperability with antivirus scanners . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Hiding the FSLRDR redirection areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Viewing the properties of a virtual software layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Viewing variables used in a virtual software layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Chapter 7 Layer operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Hide a layer from other layers or from the operating system . . . . . . . . . . . . . . . . 67
Add a layer dependency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Deactivate on last process exit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Clone a layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Keep all data in layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Capture changes made by non-virtualized applications . . . . . . . . . . . . . . . . . . . . . . . 70
Chapter 8 Technical reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
About system variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
SVSCMD command-line parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
SVSCMD parameter flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
SVSCMD command-line examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Virtual software layer attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
How layer prioritization works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
How to set the HKCR priority of a layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Windows Management Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
VirtualSoftwarePackage class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
VirtualSofwareSublayer class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Using WMI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Workspace Virtualization functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
WMI sample scripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
OnEvent actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
9 Contents
Contents 10
Introducing Symantec
Workspace Virtualization
This chapter includes the following topics:
About Workspace Virtualization
Solving Problems with Workspace Virtualization
How Workspace Virtualization works
About file and registry redirection
About Virtual Software Layers
About Extensible Package Format (XPF) files
Virtual Software Layer architecture
About Workspace Virtualization
Symantec Workspace Virtualization(SWV) is a revolutionaryapproachtosoftware
management. By placing applications and data into managed units called Virtual
Software Layers, Workspace Virtualization lets you instantly activate, deactivate
or reset applications and to completely avoid conflicts between applications
without altering the base Windows installation.
Rather than isolating applications to gain control, Symantec's application
virtualization technologies seamlessly integrate virtualized applications to
preserve the user experience. Virtualizedapplications act like normal applications,
ensuring normal behavior and full functionality.
In addition to preserving the user experience, Workspace Virtualization lets you:
Instantly repair damaged applications by resetting them to a known state.
1
Chapter
Run two version of the same program side by side.
Addandremove software withzeroimpact onthe underlyingoperatingsystem.
Turn applications on and off instantly.
The end result is a more managable desktop. Application conflicts are eliminated
along with the problems associated with failed and corrupted software
installations.
Workspace Virtualizationis basedonSymantec's patentedcore technologyknown
as the SWV File System Filter driver.
Workspace Virtualizationsolves the following commonapplicationmanagement
problems:
Provisioning and deprovisioning applications is disruptive to the user
and time consuming
With Software Virtualization Solution, you can easily deploy virtualized
applications without running an application install or uninstall on client
computers. Application availability is instantaneousyou can easily and
immediately activate or deactivate your applications by sending a single command
to the client computer. The user is not required to have system rights to run an
installation, and you dont have to worry about restarting when you activate or
deactivate an application. The solution can also register any services that the
application installed with the Windows Service Control Manager, which then
loads the service so that the application is fully functional.
Recovering a damaged application is time consuming
Rather than repairing or recovering a damaged application, you can simply reset
it to the original deployedcondition. Applicationresets canbe performedinstantly
or on a schedule. An application can be reset whether the client computer is
connected to the network or not. Resetting a virtual application does not damage
other applications installed on the computer.
Conflicting applications are difficult or impossible to manage
Workspace Virtualization ensures applications use the correct files and registry
settings without modifying the operating system and interfering with other
applications. This provides numerous benefits, including improved reliability and
Introducing Symantec Workspace Virtualization
12
flexibility. Example: When installing new software or application updates,
administrators might inadvertently replace newer .DLLs with older .DLLs, which
cancause immediate problems betweenapplications sharing those .DLLs, causing
application failure or reintroducing security holes that previously were patched.
With Workspace Virtualization, you can stop worrying about DLL hell. Other
benefits include allowing different versions of the same application to co-exist
on the same computer.
Migrating to newapplication versions requires significant testing and
planning; takes a long time to execute and rollback is difficult
Rolling out new versions of an application requires significant time to test for
conflicts and reprovisiong lab testing computers. Workspace Virtualization
simplifies predeployment testing, accelerates the deployment cycle, and reduces
post-deployment support costs. With Workspace Virtualization, you can host
multiple versions of anapplicationonthe same systemwithout conflicts between
older andnewer files. Evenphasedrollouts are greatlyacceleratedbecause rollback
can occur immediately at any time. Once the transition froman older application
toa newer applicationis complete, simplydeactivate andremove the older version.
An application or set of data is virtualized by using a capture process that creates
a Virtual Software Package (VSP). AVSPcontains all the files and registry settings
of the application or data. A VSP can be used on a client computer that has the
Workspace VirtualizationAgent. The VSPis installedto a special area onthe hard
drive. After the VSP is activated through the Workspace Virtualization Agent,
the application becomes visible along with its files, folders, and settings. Even
thoughit is a virtual application, it looks and behaves like any other application
to the end user.
Each Virtual Software Package (VSP) is managed by SWV as a distinct entity.
When activated, VSPs are like layers over the base Windows operating system
so the system appears to contain the aggregate contents of the base operating
system plus the active VSPs.
When a VSP is imported onto a computer, the contents of the VSP (both files and
registry settings) are placed in a folder in a special protected SWV area on the
hard dive, referred to as the SWV redirection area.
13 Introducing Symantec Workspace Virtualization
When a VSP is imported on a client computer, the contents of the VSP are placed
in the redirected folder, such as C:\fslrdr\1. When the VSP is activated on a client
computer, the contents of the VSP are made available to the user. The files and
settings appear to the user in the location they would be in if the application had
been installed on the computer.
Example: You have a VSP for Mozilla Firefox. When the Firefox VSP is activated,
all the contents of the VSP are layered over the base file systemand registry to
make it visible to the user. The user thensees its appropriate folders, files, registry
settings, andshortcuts. Whenthe contents are made visible, they are not displayed
in the hidden area, but they are displayed in the locations that the user would see
them had Firefox been installed on the computer. Example: Even though the
Firefox application file may physically be located at
C:\fslrdr\1\PROGRAMFILES\Mozilla Firefox\firefox.exe
To the user, it is visible as
C:\Program Files\Mozilla Firefox\firefox.exe
Workspace Virtualization accomplishes this by using a filter that intercepts
requests to the file system and registry, and when needed, redirects requests to
the active VSPs. Workspace Virtualizationuses the SWVFile SystemFilter Driver
to aggregate the real and virtual file systems into a single view for the end-user.
This process is displayed in the following figure:
14
The file system display in the lower left represents the base environment
Windows operating system files, data and applications installed conventionally.
The file systemdisplay inthe lower right represents virtualized data that is stored
in the isolated, hidden redirection area.
The file system display at the top represents what the system, applications and
users see.
The SWV filter driver presents an aggregate view of the real file system and the
layered virtual file system and registry. Gold represents data from the real file
system. Blue represents data from a layer in the virtual file system. When an
application or Windows requests a file, the request goes through the filter driver,
which determines whether the request should be passed through to the real file
system or redirected to a layer in the virtual file system.
If the file is in the real file system the request proceeds normally. If the filter
driver determined that the file is in a layer in the virtual file system, the request
is redirected to the layer files. In both cases, however, the application peforms a
normal file open request and has no idea that the filter driver is even there or
what it is doing.
Withredirection, SWVcanmaintaindiscrete settings andfile versions for different
applications on a single system. By working with VSPs, a required version of a
file will never be overwritten. This is particularly important whenyouare working
with Dynamic Link Libraries (DLL). Incompatible .DLL files are known to cause
application instability. By using applications within VSP, you can ensure that
applications use its own set of .DLL files without interfering with the rest of the
operating system or other applications running at the same time.
This extends not onlytofiles that relate toapplications, but alsotoregistrysettings
and data files.
When an application or set of data is captured into a Virtual Software Package,
everything that is captured is contained in a layer. The layer represents all
the files and registry settings that make up the virtualized application or data.
Typically, one layer is createdfor one application. However, one layer cancontain
multiple applications. Each layer is managed as a single entity.
The files and settings captured in a layer are stored in the SWV redirection area
onthe computers hard drive. However, whena layer is active, all files and settings
appear in the system just as they would if the application or data was installed
on the computer. This is accomplished through redirection using the SWV File
System Filter Driver.
15 Introducing Symantec Workspace Virtualization
If you want to make a layer portable so that it can be used on another computer,
the contents of the layer are exported to a single XPF file.
XPFfiles canthenbe copied or deployed to other computers. To make the contents
of the XPF usable on a computer, the XPF must be imported using the Workspace
Virtualization Agent. When an XPF is imported on a computer, the layer (the files
and registry settings in the XPF) are installed to the SWV redirection area on the
client computers hard drive.
Symantec provides a dedicated application, called Wise Virtual Composer, to
create XPF packages. See the Wise Virtual Composer User's Guide for additional
details on XPF files and application packaging.
Virtual Software Layer architecture
There are two components or sublayers in a layer:
Contains all captured files and settings. The XPF packages that
contain applications provide the read-only sublayer.
Read-only sublayer
Contains any files or settings that are added or changed by a
user of a layer.
Writeable sublayer
For example, you create a layer for Firefox. As a person uses Firefox, they may
make some changes to the program. They may select a unique home page, add
bookmarks, or change the original security settings. They may also install a
browser plug-in. Those user changes are stored in the Writeable sublayer. The
original files and settings are maintained in the Read-only sublayer.
Having these distinct sublayers is useful in being able to reset a layer. When a
layer is reset, any data added by a user is deleted, and the layer is returned to its
original configuration. Example: If a users Firefox application ever becomes
damaged, you can simply reset the layer to restore it to the way it was first
deployed. The application does not have to be uninstalled/reinstalled.
Resettinglayers alsomaintains specific versions andconfigurations of applications
across your network. You can control how the applications are installed and
configured on client computers.
16
Planning for the use of
Virtual Software Packages
About working with virtual software packages
Virtual software package workflow
What you can virtualize using the Workspace Virtualization Agent
How to prevent the loss of application data
Where you can use Virtual Software Packages
How the Workspace Virtualization Agent affects security
About handling duplicate services
About multiple concurrent user support
About working with virtual software packages
The Symantec Workspace Virtualization Agent provides different interfaces
for working with Virtual Software Packages (VSPs). The following table explains
the differences between the interfaces:
Table 2-1 Workspace Virtualization interfaces
Description Interface
This tool lets you create, edit, and manage virtual
software packages.
SWV Admin tool
2
Chapter
Table 2-1 Workspace Virtualization interfaces (continued)
Description Interface
The SVSCMD executable file is installed with the
Workspace Virtualization Agent. You can run it with
its command-line parameters to work with VSPs.
See SVSCMD command-line parameters
on page 72.
SVSCMD executable file
When you install the Workspace Virtualization Agent, you have the option to
install the SWV Admin tool. You can also install it later by modifying the
installation.
See Installing the Workspace Virtualization Agent on page 26.
See What you can virtualize using the Workspace Virtualization Agent
on page 19.
See How to prevent the loss of application data on page 19.
See Where you can use Virtual Software Packages on page 21.
See Virtual software package workflow on page 18.
See How the Workspace Virtualization Agent affects security on page 21.
See About handling duplicate services on page 23.
The following steps illustrate a typical workflow:
Capture an application into a virtual software layer.
See About the creation of virtual software layers on page 33.
Export the layer to virtual software archive file.
See Exporting a virtual software layer to an archive file on page 59.
Deploy the archive file to a client computer.
Import the archive file into a layer on the client computer.
Import the archive file into a layer on another computer.
See Importing a virtual software archive file on page 60.
Activate the layer to access the application.
See Activating and deactivating virtual software layers on page 61.
Youcanuse the SWVAdmintool or the SVSCMDexecutable file to capture, export,
import, and activate layers.
Planning for the use of Virtual Software Packages
18
See SVSCMD command-line parameters on page 72.
After you capture a layer and before you export it, you can also edit it. You can
use the SWV Admin tool to edit a layer.
See Editing the files in a virtual software layer on page 45.
What you can virtualize using the Workspace
Virtualization Agent
Use the following guidelines to determine what youcanandshouldnot virtualize:
Most applications can be virtualized. Typical applications
include office suites, databases, Internet browsers, media,
and spyware utilities. Applications functionnormally when
virtualized by the Workspace VirtualizationAgent. Youcan
also create virtualized data layers.
What you can virtualize
Windows operating system components
Windows operating system patches
Most drivers
Applications that have dedicateddrivers (example: Client
firewalls)
All management agents including antivirus software,
security scanners, encryption agents, or any Symantec
Management Platform Agent
Data files that you plan to encrypt
Utilities that are designed to run only in safe mode
(Workspace Virtualization does not run in safe mode)
What you should not
virtualize
See About working with virtual software packages on page 17.
Whenanapplicationlayer creates or modifies files they are stored inthe writeable
sublayer. If the layer is then reset, the files in the writeable sublayer are deleted.
This behavior lets you reset an application to the default state if settings become
corrupted. However, many applications create data files that you do not want to
lose when a layer is reset. These files need to be stored on the base file system
and not in the layer to prevent potential loss.
19 Planning for the use of Virtual Software Packages
What you can virtualize using the Workspace Virtualization Agent
For example, you create and activate a Microsoft Word layer. You do not create
any layer exclude entries, global exclude entries, or data layers to redirect .doc
files from the layers writeable sublayer. You then activate the Microsoft Word
layer and use it to create .doc files that you save on the computers hard drive. If
you then reset the Word layer, all of the .doc files you created are lost.
To prevent the loss of applicationdata whena layer is reset, you must ensure that
the data is not stored in the application layer.
The Workspace Virtualization Agent provides the following methods that you
can use to prevent the loss of application data:
Table 2-2 Methods to prevent data loss
Description Method
You can create a data layer that captures the application
data files that have specified extensions or that are in a
specified directory. A data layer captures the application
data so that it is not redirected to the writeable sublayer of
the application layer.
Data layer
Youcancreate layer exclude entries for anapplicationlayer.
A layer exclude entry can be a file extension or a directory.
Application data that matches the layer exclude entry is
saved in the base file system.
See Adding a layer exclude entry on page 48.
Layer exclude entry
You can create global exclude entries for a computer. A
global exclude entry can be a file extension or a directory.
A global exclude entry applies to all layers on a computer.
Application data that matches the global exclude entry is
saved in the base file system.
See Adding a global exclude entry on page 49.
Global exclude entry
Youcansave the applicationdata of a virtualizedapplication
to a non-local storage device, such as a network share. The
data is then not redirected to the application layer.
Non-local storage
You can copy the data from the writeable sublayer to the
read-only sublayer using a new reset point.
See Resetting application layers on page 61.
New reset point
20
After you create virtual software packages (VSPs) with the Workspace
Virtualization Agent, you can use them in the different environments. The
following table indicates the environments in which VSPs can be used:
Table 2-3 VSP environments
Description Environment
Workspace Streaming provides native support for delivering
Virtual Software Packages. See the Symantec WorkspaceStreaming
Admin Guide.
Symantec Workspace
Streaming
With Notification Server 7.0 and later, the Workspace
Virtualization Agent lets you create tasks and policies to deliver
and manage virtual software layers on client computers. See the
Software Management Solution User's Guide .
WithNotificationServer 6.x, the Workspace VirtualizationAgent
lets you create tasks and policies to deliver and manage virtual
software layers on client computers. See the Software
Virtualization Solution 6.x Help.
Altiris Notification
Server
Deployment Solution lets you create jobs to deploy and manage
virtual software layers. See the Deployment SolutionAdminGuide
(6.x) or the Deployment Solution User's Guide (7.x).
Altiris Deployment
Solution
The Workspace Virtualization Agent works independently of the
Altiris framework. BecauseAPI, WMI, andcommand-lineinterfaces
are supported, you can manage client-side operations with any
desktop management product. See the Altiris Software Developer
Kit (SDK).
Standardmanagement
frameworks
You can use VSPs in a stand-alone environment. To use VSPs,
install the SWV Admin tool on a computer and then create or
import existing VSPs.
Stand alone
How the Workspace Virtualization Agent affects
security
The Workspace Virtualization Agent uses the security systems that are built into
the Windows NT family of operating systems. Access Control Lists (ACLs) in the
registry and the file systemcontrol access to the Workspace VirtualizationAgent.
The ability to protect files and directories through ACLs requires the use of the
NTFS file system. ACLs on virtualized items (registry entries, files, and services)
are persisted normally. The Workspace Virtualization Agent moves the ACLs
when a Virtual Software Package (VSP) is exported and imported.
The following sections contain a description of how security works in several
different areas for Virtual Software Packages (VSPs):
See Rights to modify a virtual software package on page 22.
See Rights to user-specific data on page 22.
See Rights to start programs on page 23.
Rights to modify a virtual software package
To modify a Virtual Software Package (VSP), a user must generally be a member
of the local administrators group. The following are exceptions to the general
rule:
Users that have read access to the HKLM\System\CurrentControlSet\
Services\FSLX\Parameters\FSL\Rights\Activate key can activate VSPs.
Users with read access to the HKLM\System\CurrentControlSet\
Services\FSLX\Parameters\FSL\Rights\Deactivate key can deactivate VSPs.
Auser has the same rights to the files and registry keys inthe redirectionareas
as if the application had been installed normally. This accessibility is not a
problemif anapplicationproperly creates ACLs for its files during installation.
Rights to user-specific data
Data layers and the writeable sublayer of applicationlayers are user-specific. This
means that the layer has a unique area for each user that holds the information
that is unique to each user. These unique areas exist under a SID directory that
is named with a string representation of the user's SID. This directory contains
subdirectories like the user's profile directory and desktop directory. You can see
the SID directories in the Edit Layer dialog box on the Files and Registry tabs.
The read-only sublayer of an application layer does not contain unique entries
for each user. It contains only one copy of user data that is contained in a section
that is named USER_TEMPLATE. During the capture process, any user-specific data
goes into this area. When any user uses the layer outside of capture mode, a SID
directory is created for the current user. The contents of the USER_TEMPLATE area
are copied to this directory. The USER_TEMPLATEarea inthe read-only sublayer
is not used during normal operation.
How the Workspace Virtualization Agent affects security
22
Files, directories, and registry keys are protected withthe same rights that protect
the corresponding objects in the base. For example, when the DESKTOP folder is
created inthe layer, the ACLs are copied fromthe user's base DESKTOP folder. This
process ensures that only the proper users have rights to this folder.
When a layer is exported, the rights that are contained in the file system are
represented in a file that is named ACLS in SDDL format. At import time, after the
files and directories have been extracted, this information is used to re-apply the
proper rights.
Rights to services are handled in a similar fashion. An SDDL string is generated
and used to maintain the proper rights on the service
Rights to start programs
When a layer is activated, the Workspace Virtualization Agent typically starts all
of the items in the layer that are configured to run at startup. These programs
run as the user who activates the layer. For example, when a layer is activated
remotely by Notification Server, it happens in the SYSTEM context by default.
Therefore, the Workspace Virtualization Agent does not start an itemunless the
interactive user who is logged onto the system does the activation.
This control over the starting of programs does not apply to the OnEvent actions.
OnEvent actions are runregardless of howthe layer is activated. Youmust ensure
that OnEvent actions are executed according to your security policies.
The Workspace Virtualization Agent uses reference counts to properly control
the creation, starting, stopping, and deletion of services with the Service Control
Manager. The reference count information is stored under
HKLM\SYSTEM\CurrentControlSet\Services\FSLX\Parameters\FSL\Services.
For example, a service is run from the base and the same service is then started
again through a layer. When you deactivate the layer, the first instance of the
service continues to run.
Workspace Virtualization supports multiple concurrent user environments.
Multiple users can connect to a terminal server and run virtualized applications
and not affect other users. Virtualized applications must natively support use in
aterminal server environment. Support is providedfor roamingprofiles inmultiple
concurrent user environments.
Layers are activated on the server level, rather than the user level. Admin
operations should be restricted to a single user to prevent conflicts. Exporting
layers inmultiple concurrent user environments is not recommendedas the layer
likely contains large amounts of user data.
24
Installing the Symantec
Agent
Supported platforms for the Workspace Virtualization Agent
Installing the Workspace Virtualization Agent
Installing the Workspace Virtualization Agent silently
What the Workspace Virtualization Agent installs
Upgrading the Workspace Virtualization Agent
Uninstalling the Workspace Virtualization Agent
Troubleshooting Workspace Virtualization Agent installations
Cleaning up a failed Workspace Virtualization Agent installation
Removing the WMI Provider
Uninstalling the Agent in Runtime Mode
Supportedplatforms for theWorkspaceVirtualization
Agent
Workspace Virtualization requires the Microsoft Visual C++ 2008 Runtime
Libraries on all endpoints. If this runtime is not present during the installation,
it is installed automatically.
3
Chapter
Workspace Virtualization supports 64-bit editions of the following operating
systems:
Windows 7
Windows Vista SP1 or SP2
Windows Server 2008 and 2008 R2 when used as an endpoint
Workspace Virtualization supports 32-bit editions of the following operating
systems:
Windows 7
Windows Vista SP1 or SP2
Windows XP Professional SP2 or SP3
Windows Server 2008 when used as an endpoint
Windows Server 2003 SP1 or later and 2003 R2 when used as an endpoint
This section provides instructions for installing the Agent using the interactive
installation program. You can download the Workspace Virtualization Agent
installation setup files at the following URL:
Symantec Endpoint Virtualization Suite
Global exclude entries are added for the Desktop and My Documents folders by
default.
See What the Workspace Virtualization Agent installs on page 28.
To install the Agent on a base computer
1 Runthe 32- or 64-bit versionof Symantec_Workspace_Virtualization.exe.
The version you select must match the endpoint architecture. The 32-bit
version cannot be installed on a 64-bit operating system.
2 Enter the product key, and then click Next.
3 On the Select Features page, select any optional components you want to
install:
Symantec Workspace VirtualizationAdminTool
This option installs the SWV Admin tool. You can use this tool to create,
edit, and manage virtual software layers on the endpoint.
Symantec Workspace VirtualizationSDK
Installing the Symantec Workspace Virtualization Agent
26
This option installs documentation and samples for the SDK. This should
be installed if you are writing applications that use the SDK. It does not
need to be installed to run applications that are written with the SDK.
Altiris NotificationServer Support
This option installs support for managing Workspace Virtualization on
endpoints in a Notification Server environment.
4 Complete the setup wizard.
5 Restart the computer after the installation completes.
Installing the Workspace VirtualizationAgent silently
You can run the Workspace Virtualization installation programfroma command
line to perform a silent installation.
For example, the following commands perform a silent install of the Agent:
Symantec_Workspace_Virtualization.exe /s SWV.PRODUCT_KEY=<product-key>
The product key is required. Additional options are listed in the following table.
Options should be separated by a single space.
For example:
Symantec_Workspace_Virtualization.exe /s
SWV.PRODUCT_KEY=<product-key> SWV.ADDLOCAL=SVS_Admin,SDK,Altiris_NS
Table 3-1 Windows Installer command-line properties and descriptions
Description Property
Changes the location of the file redirection area.
The FSLRDR path cannot contain any non-ASCII
characters. Unsupported characters include Hi
ASCII, numeric digits, special characters, or any
other character that cannot be upper or lower case.
The file path must be at least three characters.
SWV.DEFAULT_FILE_REDIR=D:\fslrdr
Changes the default installation location. SWV.INSTALLDIR=C:\SVSAgent
Specifies the product key for the installation. You
obtain this product key from Symantec when you
purchase the product or download a key for free
personal use of the product. This property is
required.
SWV.PRODUCT_KEY=<product key>
27 Installing the Symantec Workspace Virtualization Agent
Installing the Workspace Virtualization Agent silently
Table 3-1 Windows Installer command-line properties and descriptions
(continued)
Description Property
Suppresses the restart prompts. Without this
switch, the installer automatically restarts the
computer. Do not attempt to use Workspace
Virtualization or to import or activate any layers
until the computer is restarted.
SWV.REBOOT=ReallySuppress
Add local adds the specified component to the local
installation. Remove removes the specified
component.
Provide one or more of the following values that
are separated by commas:
SVS_Admin
Changes the installation location of the
command-line utility, WMI provider, and the
SWV Admin tool.
SDK
Installs the Workspace Virtualization SDK.
Altiris_NS
Installs the components to integrate with the
Symantec Management Platform.
SWV.ADDLOCAL=<value1>, <value2>
REMOVE=<value1>, <value2>
The installed components and the corresponding files are listed in the following
table.
Table 3-2 Installed components
Default path Component
Microsoft Visual C++2008 Runtime Libraries (if not installed) Prerequisites
C:\Program Files\Symantec\Workspace
Virtualization\SVSCmd.exe
Virtualization\UIUtils.dll
Command-line executable
file
C:\Windows\system32\drivers\fslx.sys Driver
C:\fslrdr File redirection area
28
Table 3-2 Installed components (continued)
Default path Component
C:\Windows\system32\fsllib32.dll
C:\Windows\system32\aszlib.dll
C:\Windows\system32\xerces-c_3_0.dll
C:\Windows\system32\XpaFormat.dll
C:\Windows\system32\XpfFormat.dll
C:\Windows\system32\XpfInstall.dll
Libraries
Virtualization\svsadmin.exe
C:\ProgramFiles\Symantec\WorkspaceVirtualization\fslui.dll
Virtualization\<LCID>\FslUI_resources.dll
SWV Admin tool
Virtualization\SvsWmi.dll
Virtualization\SvsWmi.mof
WMI provider
The file redirection area is where the files that are in a virtual software layer are
stored.
The installation creates the following registry keys:
Table 3-3 Installed registry keys
Registry path Key
HKEY_LOCAL_MACHINE\SOFTWARE\fslrdr Registryredirectionarea
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\FSLX\Parameters\SVS
Workspace
Virtualization Agent
product settings
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\FSLX\Parameters\FSL
Virtual layer metadata
The registry redirection area is where the registry entries in a virtual software
layer are stored. See the FSLRDR path limitations that are described in the
command-line installation section before you change this value.
See Installing the Workspace Virtualization Agent silently on page 27.
The installation installs the driver similar to how a service is installed. The
installation of the WMI provider uses the programmatic equivalent of
mofcomp.exe.
The installation sets the security permissions on the file redirection area and the
registry redirectionarea. Administrators and the SystemAccount have full access
to these redirection areas.
See Hiding the FSLRDR redirection areas on page 65.
To upgrade the Workspace Virtualization Agent you can typically run the
installation program for the new version without uninstalling. For supported
upgrade paths and notes, see the release notes for the upgrade version.
Uninstalling the Workspace Virtualization Agent
You can uninstall the Workspace Virtualization Agent using the Add/Remove
Programs applet inthe Control Panel. Youcanalso use the applet to add or remove
optional components.
Uninstalling the Workspace Virtualization Agent does not remove any existing
virtual software layers or remove your registry settings.
To remove layers manually after you uninstall the Agent
1 Delete the FSLRDR directory. It is located by default at c:\fslrdr.
2 Delete the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FSLX\Parameters
key.
Troubleshooting Workspace Virtualization Agent
installations
You can complete most failed installations with a restart and a reinstallation. If
that does not work, add the /l*v <logfile> command-line option to create a
Windows Installer log for the installation. Inthe installationlog, searchfor "return
value 3". The lines preceding this value shouldcontainanerror message regarding
the failure. If the error message identifies the problem (for example, an invalid
product key), you should be able to resolve it. For more complex problems, you
may need to contact Symantec support or do a manual cleanup of the installation.
30
See Cleaning upa failedWorkspace VirtualizationAgent installation onpage 31.
Cleaning up a failed Workspace Virtualization Agent
installation
If the installation of the Workspace Virtualization Agent fails and the problem
cannot be resolved, you can manually clean up the failed installation.
See Troubleshooting Workspace Virtualization Agent installations on page 30.
To clean up a failed installation of the Agent
1 Remove all the installed files and registry keys.
See What the Workspace Virtualization Agent installs on page 28.
2 To delete the FSLX driver, type the following command:
sc.exe delete FSLX
3 Remove the local groupthat was createdfor Agent security withthe following
command:
net.exe localgroup "Workspace Virtualization Administrators" /
delete
4 Remove the WMI Provider.
See Removing the WMI Provider on page 31.
5 To cleanupthe informationthat Windows Installer caches about the package,
type the following command:
msizap.exe TW! {7D8DBB7C-1C55-4950-A107-043C164F379A}
The msizap.exe tool comes with the Windows Installer SDK.
Removing the WMI Provider
To clean a failed installation of the Workspace Virtualization Agent, the WMI
Provider must be removed.
See Cleaning upa failedWorkspace VirtualizationAgent installation onpage 31.
To remove the WMI Provider
1 Launch wbemtest.exe.
2 Click Connect.
Cleaning up a failed Workspace Virtualization Agent installation
3 Type root\default as the namespace, and then click Connect.
4 Click Delete Class.
5 Enter the class name AltirisVSProv, VirtualSoftwarePackage, and
VirtualSoftwareSublayer and follow the prompts to delete the class.
6 Remove the following registry keys created by the WMI provider:
HKEY_CLASSES_ROOT\AppID\AltirisVSProvider.DLL
HKEY_CLASSES_ROOT\CLSID\{71D8DF9A-AD2D-44BF-A542-1412F68061D1}
HKEY_CLASSES_ROOT\TypeLib\{888967EF-E75C-4480-992D-93FDA658F21E}
When a vendor distributes a vra file, it is wrapped in a WiseScript EXE that
contains installationlogic. This logic installs the Agent inruntime mode, if needed,
and imports and activates the runtime layer.
If the Agent is installed in runtime mode, uninstall it before you install a licensed
version of the Agent.
To uninstall the Agent in Runtime Mode
Because the Agent inruntime mode does not appear inAdd/Remove Programs,
do one of the following to uninstall it:
Msiexec.exe /x {7D8DBB7C-1C55-4950-A107-043C164F379A}
32
Creating virtual software
layers
About the creation of virtual software layers
Types of virtual software layers
Methods for capturing virtual software layers
Creating an application layer using single program capture
Creating an application layer using global capture
Adding an application to an existing layer
Creating a data layer
Creating an empty layer
About the creation of virtual software layers
Before you create layers, you should be familiar with the following:
What you can and should not virtualize.
See What you can virtualize using the Workspace Virtualization Agent
on page 19.
The types of virtual software layers.
See Types of virtual software layers on page 34.
The methods for creating virtual software layers.
See Methods for capturing virtual software layers on page 34.
How to set up the base computer that you use to create layers.
4
Chapter
See Installing the Workspace Virtualization Agent on page 26.
A best practice is to create application layers on a computer with the same
operating systemthat is usedinproduction. Whenyoucreate anapplicationlayer,
you capture the installation of the application. Some installations contain logic
to install different files depending on the computers operating system. This
process is not requiredwhenaninstallationdoes not performany operations that
are specific to an operating system.
After you create a virtual software layer, you can edit it and then export it to
create a portable virtual software archive file that youcanuse onother computers.
You can create the following types of virtual software layers:
An application layer is created by capturing the installation of an
application. It contains all the installed files and registry settings
of the application. An application layer can contain one or more
applications.
See Creating an application layer using single programcapture
on page 35.
Application layer
A data layer captures and stores data files that an application
creates. A data layer is one way to prevent the loss of application
data when an application layer is reset.
See Creating a data layer on page 40.
Data layer
An empty layer lets you manually add an application or capture
an application. Empty layers let advanced users create custom
layers.
See Creating an empty layer on page 41.
Empty layer
See Virtual software package workflow on page 18.
Methods for capturing virtual software layers
When you create a virtual software layer, you can use either of the following
capture methods:
Creating virtual software layers
34
Wise Virtual Composer provides an advanced interface to create
virtual software packages. See the Wise Virtual Composer User's
Guide for details.
WiseVirtual Composer
When you use this method, only changes that are made during
the installation of a specified application are captured. Any other
activity on the computer is ignored.
This method captures all the files, registry settings, and processes
of an application. The capture includes child processes and
process-inducedchanges. It alsocaptures Microsoft Installer (MSI)
and Service Control Manager changes.
You can use this method to capture both a single installation into
a layer or multiple installations into a layer. You can also use this
method to capture post-installation configurations.
See Creating an application layer using single programcapture
on page 35.
SWV Admin tool
Single program
capture
This method captures all changes that are made to a computer
during the capture process. Because it captures all changes, it also
captures all background activity on the system. Use this method
only when you cant use the single program capture.
See Creating an application layer using global capture
on page 37.
SWV Admin tool
Global capture
Creating an application layer using single program
capture
Youcancreate anapplicationlayer by capturing the installationof anapplication.
The single program capture method is the recommended capture method. You
should use this method unless it does not let youproperly capture the installation
of an application.
With the single program capture method, you can capture an applications
installation directly or from the command-line window. When you capture
installations from the command-line window, you can capture multiple
installations into a single layer and perform post-installation configurations of
an application. When you capture an installation directly, you can only capture
that installation.
You can also create a batch file that contains the command for starting each
installation. You would thenrunthe batchfile instead of aninstallationprogram.
35 Creating virtual software layers
Before you create an application layer you must deactivate all layers on the
computer.
To capture an application layer with single program capture
1 Start the SWV Admin tool.
2 Click Start > All Programs > Symantec > Workspace > Virtualization>
Symantec Workspace VirtualizationAdmin.
3 In the SWV Admin tool, on the File menu, click NewLayer.
4 On the first panel, click Install application, and then click Next.
5 On the second dialog box, type a name for the layer, and then click Next.
Layer names are limited to 50 characters.
6 On the Capture dialog box, do the following tasks:
Click Single programcapture.
Click Browse and select the setup file.
This file can be an EXE or an MSI.
(Optional) Type parameters for running the setup file.
Click Next.
Click Finish.
A rotating icon appears in the system tray.
7 To capture the installation, work through the installation dialog boxes to
complete the capture.
You must exit all processes that the installationstarts (for example, a system
tray application) before the capture process is complete.
8 (Optional) If an installation has an option to launch the application at the
end of the installation, do the following tasks:
Select the option to open the application.
When the application opens, make changes to the default settings of the
application.
Because the installer opens the application, you are still in capture mode
and the changes are captured.
Close the application to complete the capture.
The layer now appears in the SWV Admin tool.
36
To capture an application installation from the command-line window
4 On the first dialog box, click Install application, and then click Next.
Click Browse, and then locate and click cmd.exe.
For example, C:\Windows\system32\cmd.exe.
Click Next.
Click Finish.
7 In the command-line window, do the following tasks:
Start and run the installations you want to capture.
(Optional) Start anapplicationyoucapturedandperformpost-installation
configuration.
8 Close the command-line window and any process the installation started.
You must exit all processes that the installation starts (example: a system
The layer appears in the SWV Admin tool.
See Creating an application layer using global capture on page 37.
See Adding an application to an existing layer on page 38.
For most applications, we recommend that you use the single program capture
method. Only use the global capture method if the single programcapture method
does not properly capture the installation of an application.
To create an application layer, all layers on the computer must be deactivated.
To create an application layer with global capture
3 In the SWV Admin tool, on the File menu, click Create NewLayer.
4 On the first dialog box, click Install application, and then click Next.
6 On the Capture dialog box, click Global capture, and then click Next.
7 Click Finish.
8 Run the installation program of the application.
9 (Optional) After the installation is complete, open the application, configure
its default settings, and then exit it.
For example, you might set a default home page or customsecurity settings.
10 (Optional) Run the installation program of one or more programs and open
each application to set default settings.
11 Right-click the rotating icon in the system tray and click Stop Capture.
See Creating an application layer using single program capture on page 35.
After you create a layer, you can add an application to the layer. You can add an
application to an empty layer or a layer that contains one or more applications.
You can repeat the following procedure to add any number of applications to a
layer.
You can only add an application to an existing layer with the SWV Admin tool.
To add an application to an existing layer, all layers on the computer must be
deactivated.
38
To add an application to an existing layer
3 In the SWV Admin tool, right-click the layer to which you want to add an
application, and then click Add to Layer.
Use global capture only if you cannot properly capture the update with
single programcapture. With global capture, you must manually run the
installation of the application.
Click Browse, and then select the setup file.
This file can be an EXE or an MSI.
Click Next.
Click Finish.
You must exit all processes that the installation starts (example: a system
6 (Optional) If an installation has an option to launch the application at the
end of the installation, do the following tasks:
Select the option to open the application.
When the application opens, make changes to the default settings of the
application.
Because the installer opens the application, you are still in capture mode
and the changes are captured.
Close the application to complete the capture.
See Creating an application layer using global capture on page 37.
You create data layers to capture data files into a dedicated layer. Data layers can
store the data that would otherwise be written to an application layer or the base
file system.
You can create a data layer that captures all files with specified extensions (for
example, all files witha .doc extension). Files withspecifiedextensions are captured
even if they are generated outside of the layer.
You can also create a data layer for a specific directory (for example, the My
Documents folder). When you specify a directory, you can include its
subdirectories. Any files that are saved into this directory are saved in the data
layer.
When a data layer is activated on a computer, files that already exist on the
computer are not automatically captured into the layer. However, any files that
match the specifications of the data layer are redirected to the layer when they
are modified.
To create a data layer
4 On the Create newlayer dialog box, click Data layer, and then click Next.
5 On the second dialog box, type a name for the layer. In the Datalayer details
section, click either the File extension(s) separated by semi-colon or
Directory option, and then specify the extensions or directory. Layer names
are limited to 50 characters.
To create a data layer that uses bothfile extensions and a directory, youmust
edit the layer after it is created.
See Editing a data layer on page 46.
6 Click Next, and then click Finish.
40
If a programdoes not have an installer, you could create an empty layer and then
edit it to add files and registry settings. After you create an empty layer, you can
also capture the installation of an application to add it to the layer.
To create an empty layer
4 On the Create newlayer dialog box, click Empty layer, and then click Next.
5 Onthe second dialog box, type a name for the layer, click Next, and thenclick
Finish. Layer names are limited to 50 characters.
42
Editing virtual software
layers
Configuring a virtual software layer to start automatically
Activating a virtual software layer using a desktop shortcut
Editing the files in a virtual software layer
Editing the registry settings of a virtual software layer
Editing a data layer
Adding exclude entries to virtual software layers
Adding a layer exclude entry
Adding a global exclude entry
Adding a global user profile exclude entry
Ignoring the global exclude list for a single layer
Transferring global excludes to another computer
Adding a delete entry to a virtual software layer
About updating a virtual software layer
Updating a virtual software layer
Creating a layer patch to update a virtual software layer
Renaming a virtual software layer
5
Chapter
Configuring a virtual software layer to start
automatically
You can configure a virtual software layer to start (activate) automatically when
a client computer starts. You can also activate a layer from a desktop shortcut.
See Activating a virtual software layer using a desktop shortcut on page 44.
Note: If you dont configure a layer to start automatically and if the user cannot
manually activate it, the user cannot access it.
Youcanalso use the SVSCMDexecutable file withthe AUTOACTIVATEparameter
to set a layer to start automatically.
To configure a layer to start automatically
3 Inthe SWVAdmintool, right-click a layer, andthenclick ActivateOnSystem
Startup.
If a check mark appears next to the option, it is enabled.
Activating a virtual software layer using a desktop
shortcut
Layer activation using a shortcut is enabled by setting the layer to be partially
activated. After a layer is partially activated shortcut icons and file associations
are displayed as if the layer is activated. When a shortcut or a file association
starts the application, the layer is fully activated. This feature is useful in
environments where you want a large number of applications active when the
computer starts.
Partially activating a layer can be done using SVSCMD. Deactivating and
reactivating a partially activated layer fully activates it.
Partial activation does not work with virtualized applications that contain
advertised shortcuts.
Editing virtual software layers
Configuring a virtual software layer to start automatically
44
To activate a virtual software layer using a desktop shortcut
1 At the command line, enter svscmd <layerGUID/layerName>
partialactivate -y.
2 At thecommandline, enter svscmd <layerGUID/LayerName> Auto[Activate]
-y to enable Activate on system startup.
3 When the computer restarts the layer is partially activated and can be
activated using a desktop shortcut.
To disable partial activation for a layer
At the command line, enter svscmd <layerGUID/layerName>
partialactivate -n.
See Actions you can perform to manage layers on page 58.
You can make the following changes to the files in a layer:
Create new folders.
Rename and delete folders and files.
Copy or move files and folders within a layer, into a layer, or outside a layer.
You cannot overwrite files in a layer. To replace a file, delete or move the original
and replace it with the updated file. To edit a file, move the original, update the
file and then replace the original with the updated file.
To edit the files in a virtual software layer
3 In the SWV Admin tool, double-click the layer.
4 In the Layer Properties dialog box, click the Files tab.
The Files tab has two nodes to separate the files inthe read-only andwriteable
sublayers. When you edit the files in a layer, make sure that you make the
changes in the correct node.
Most folders on the Files tab use a name that is a variable.
See Viewing variables used in a virtual software layer on page 66.
5 To create a new folder, right-click a folder, and then click New > Folder.
45 Editing virtual software layers
6 To edit a folder, right-click a folder, and then select an option.
7 To edit a file do the following:
Select the folder that contains the file.
The file appears in the right pane.
In the right pane, right-click the file, and then select an option.
After you create a virtual software layer, you can edit its registry settings. If you
create an empty layer, you can add registry settings to the layer.
Note: The Workspace Virtualization Agent does not store data in the virtual
HKEY_CLASSES_ROOT key. Instead it stores it in its real location under either
HKEY_USERS\USER_TEMPLATE\Software\Classes or HKEY_LOCAL_MACHINE\
Software\Classes. At runtime, Windows reads the Workspace Virtualization data
for activated layers from these locations and properly renders
HKEY_CLASSES_ROOT.
To edit registry settings of a virtual software layer
4 In the Layer Properties dialog box, click the Registry tab.
The Registry tab has two nodes to separate registry settings in the read-only
and writeable sublayers. When you edit a layer, make sure that you make the
changes in the correct node.
5 To edit registry settings, use the same process as you would with regedit.
Editing a data layer
After you create a data layer, you can edit which files the data layer captures. For
example, after you create a data layer that captures .doc files. You can edit it to
also capture the files that are added to a specified directory.
To edit a data layer, the layer must be deactivated.
46
To edit a data layer
4 In the Layer Properties dialog box, click the Data Capture tab.
5 On the right-click menu, click NewData Capture Item.
6 On the Data Layer Capture Entry dialog box, click either the File extension
or the Directory option, and then specify the extension or directory.
It doesnt matter if you include the period before the extension. Enter only
one extension per entry. To include subdirectories, check Include
Subdirectories.
7 Click OK.
The data capture entry appears in the list box.
See Creating a data layer on page 40.
Exclude entries let you prevent files from being saved in the redirect area of the
layer. By default, when an application layer generates files,those files are saved
to the applications writeable sublayer. If the layer is reset, the files inthe writeable
sublayer are lost. An exclude entry lets you specify file types or locations on the
base system and not in the application's writeable sublayer.
Layer excludes affect a single layer. Global excludes affect all layers on the
computer.
Note: Data layer includes take precedence over data layer excludes.
You can add the following types of exclude entries:
A layer exclude entry redirects files froma specific layer to the
base file system. Youaddlayer excludes ona layer by layer basis.
For example, you can add excludes to a Microsoft Word layer
for .doc, .rtf, and .txt file types. When Word saves any of these
file types, they are saved in the base file system and not in the
layer.
See Adding a layer exclude entry on page 48.
Layer exclude entry
A global exclude entry redirects files for every layer on a
computer to the base file system. For example, you can add a
global exclude for PDF files. If any layer creates PDF files, the
files are excluded from the layer and saved in the base file
system.
Whenyouinstall the Workspace VirtualizationAgent, youhave
the optionto add global excludes for the My Documents and the
Desktopdirectories. Youcanedit these predefinedglobal exclude
entries and add your own.
Global excludes are not associated with a specific layer and are
not exportedwhenyouexport a layer. To export a global exclude
list to another computer, create and export a registry file that
contains the settings for the list.
Global exclude entry
Auser profile exclude entry redirects files that are stored inthe
user profile to the base file system. This exclude entry should
be enabled in environments that use roaming profiles.
See Adding a global user profile exclude entry on page 50.
User profile exclude
entry
You add a layer exclude entry to exclude files from a specific layer. A layer can
have any number of exclude entries.
See Adding exclude entries to virtual software layers on page 47.
To add a layer exclude entry
3 In the SWV Admin tool, deactivate and then double-click the layer.
4 In the Layer Properties dialog box, click the Exclude Entries tab.
5 In the top list box, on the right-click menu, click NewExclude Entry.
48
6 On the Layer exclude entry dialog box, click either the File extension or the
Directory option, and then specify the extension or directory.
one extension per entry. To exclude subdirectories, check Exclude
Subdirectories.
7 Click OK.
The exclude entry appears in the list box.
8 To edit or delete an exclude entry, on the entries right-click menu, click
Modify Exclude Entry or Delete Exclude Entry.
You add a global exclude entry to exclude files from all layers on the computer.
A computer can have any number of global exclude entries.
Global excludes are set on each computer and are not exported when a virtual
software layer is exported. To transfer global excludes you can export the global
excludes from the registry and then import them on another computer.
See Transferring global excludes to another computer on page 50.
You can configure a layer to ignore the global excludes.
See Ignoring the global exclude list for a single layer on page 50.
To add a global exclude entry
3 In the SWV Admin tool, on the File menu, click Global Excludes.
4 In the global excludes pane, on the right-click menu, click NewExclude
Entry.
5 Inthe Global Excludes dialog box, onthe right-click menu, click NewExclude
Entry. Onthe Global excludeentrydialog box, click either the Fileextension
or Directory option, and then specify the extension or directory.
one extension per entry. To exclude subdirectories, check Exclude
Subdirectories.
6 Click OK.
The exclude entry appears in the list box.
7 To edit or delete a global exclude entry, right-click entries, and then click
Modify Exclude Entry or Delete Exclude Entry.
You add a profile exclude entry to exclude all files that are stored in the user
profile. This exclusion stores user profile data in the base and not in a layer. This
exclusion allows profile data to roam in environments with roaming profiles.
To add a global profiles exclude
1 Use the SVSCMD command line EXCLUDEALLPROFILES -y. This command
creates a DWORD value that is named ExcludeProfileData under
HKLM\System\CurrentControlSet\Services\FSLX\Parameters\FSL
2 Restart the computer.
Ignoring the global exclude list for a single layer
Ignoring the global exclude list lets you specify that global excludes should not
be used for a layer.
To ignore the global exclude list
4 In the LayerProperties dialog box, on the ExcludeEntries tab, check Ignore
Global Exclude List.
Transferring global excludes to another computer
Global excludes are set on each computer and are not exported when a virtual
software layer is exported. To transfer global excludes you can export the global
excludes from the registry and then import them on another computer.
50
To transfer global excludes to another computer
1 Onthe computer withthe global excludes that youwant to export, runregedit
and browse to
HKLM\SYSTEM\CurrentControlSet\Services\FSLX\Parameters\FSL\ExcludePath.
2 Right-click the ExcludePath folder and then click Export.
3 Copy the registry file to another computer and and then import the settings.
Warning: When you run this file, if the registry key already exists on a
computer it is overwritten with the contents of the new registry key.
4 To reload the global exclude list without restarting the computer, run the
SVSCMD executable file with the REL[LOAD] parameter.
A delete entry hides a file on a computer when a virtual software layer is active.
The hidden file functions as if it were deleted. When the layer is deactivated or
deleted, the file reappears.
Youcanuse delete entries to hide any file ona computer whena layer is activated.
For example, you can create a layer for Mozilla Firefox with delete the entries
that hide the Internet Explorer shortcuts. Whenthe Firefox layer is activated, the
Internet Explorer shortcuts are hidden. If the Firefox layer is deactivated or
deleted, the shortcuts are visible.
With the global capture method, you can add a delete entry when you create a
layer. Any file or registry setting that you delete when in capture mode becomes
a delete entry in the read-only sublayer.
You can also manually add one or more delete entries to a layer. You normally
add a delete entry to the read-only sublayer. To add a delete entry for a layer, the
layer must be deactivated.
Warning: Avoid adding delete entries to a layer unless you are sure that no other
applications need the file.
Adelete entry is also added whenever a user deletes a file or a registry entry from
the read-only sublayer. The files are not deleted, but they become delete entries
in the writeable sublayer. If the layer is reset, the file is restored to the read-only
sublayer. You can view a layers delete entries to see if files from the read-only
layer have been deleted.
To add a delete entry to a virtual software layer
4 In the Layer Properties dialog box, click the Delete Entries tab.
5 In the left pane, select the folder for the delete entry.
The Delete Entries tab has a read-only and a writeable node for both files and
registry entries. When you add a delete entry, make sure that you select the
appropriate node. The writeable nodes have a System Delete List and a
user-specific delete list. If you add a delete entry to the System Delete List,
the delete entry is deleted for all users. If you add a delete entry to a specific
user delete list, it is only deleted for that user. For example, if you specify a
user delete entry for a desktop shortcut, it is only deleted for that user.
6 In the right pane, on the right-click menu, click NewDelete Entry.
7 Edit the default entry, [SYSTEMDRIVE]\Filename.ext, to define the delete
entry.
After you create a virtual software layer, you can update the layer with an update
or patch. Before you update an existing layer, you should first decide whether the
update warrants creating a newlayer. If you create a newlayer, you must reapply
any edits that you applied to the existing layer.
Before you update an existing layer, you must also decide whether to update its
writeable or read-only sublayers. An applications writeable sublayer is updated
whenthe update runs ona computer where the applicationlayer is activated. The
major disadvantage of updating the writeable sublayer is that the update is lost
if the layer is reset. The major advantage of updating the writeable sublayer is
that it preserves user-specific settings in the writeable sublayer.
To update a layers read-only, you must use the SWV Admin tool. You use this
tool to capture the update into the existing layer. The major disadvantage of
updating the read-only sublayer is that any user-specific settings in the writable
sublayer are lost. The major advantage of updating the read-only sublayer is that
you can ensure that all users have an identical version of the application.
52
See Updating a virtual software layer on page 53.
Before you update the read-only sublayer of an application, you should change
the layers name and GUID. You can then import the updated layer on a computer
without deleting the original layer. If the updated layer causes problems, you can
then quickly deactivate it and activate the original layer. To change the GUID of
a layer, use the SETGUID SVSCMD command-line parameter.
After you create a virtual software layer, you can update the layer with an update
or patch. For example, if you have a layer for Microsoft Office, you can update it
when an update or patch is released for Office.
See About updating a virtual software layer on page 52.
You can also use this option to update a layer to add an application to an existing
layer.
After you update a layer, export the layer to create a new layer archive file.
To update a virtual software layer
2 In the SWV Admin tool, on the File menu, click Update Existing Layer.
3 On the first dialog box, select the layer and click Next.
4 On the second dialog box, do the following:
Use global capture only if you cannot properly capture the update with
single programcapture. With global capture, you must manually run the
update.
Click Browse and select the update file.
Click Next.
5 Click Finish.
You must exit all processes that the installationstarts (for example, a system
Creating a layer patch to update a virtual software
layer
Layer patches provide a mechanism to make small, incremental updates to an
existing application layer. Layer patches reduce the need to create a newlayer to
provide an application update. A layer patch file contains the changes between
two versions of an application. Layer patches let you update layers without
distributing a completely new layer.
For example, an existing Firefox 3.01 virtual software layer can be updated to
version 3.02 by applying a small patch file.
When applying a patch, you can select to keep the previous layer and create new
layer with the updated versions. This feature can simplify application migration
by providing access to both versions. You can also copy all of the data and the
settings that are stored in the writeable sublayer to the new version.
Patch files must be applied incrementally. If you create multiple patches, they
must be applied in the order they were created.
To create a layer patch file you need a layer that contains the existing version of
an application. This layer must have the same GUID as the layer distributed in
your environment. Youalso need a second layer that contains the updated version
of the same application. For example, Firefox 3.01 in the first layer and Firefox
3.02 in the second.
For a detailed explanation of the patch creation process, see the following article
on Symantec Connect:
Exploring the layer patch feature
Note: Due to significant path and other systemchanges in 64-bit, patches created
for 64-bit operating systems should be created on the specific operating system
where they will be deployed. For example, we recommend creating a separate
patch file for 64-bit Windows 7 using a 64-bit Windows 7 operating system.
Creating a layer patch to update a virtual software layer
54
To create a layer patch file
1 Import the layer that contains the existing version.
2 Import the layer that contains the updated version of the application.
3 In the SWV Admin tool, click File > Create patch.
4 On the Create Layer PatchArchive File dialog box, do the following:
Select the original layer from the Original layer drop-down menu.
Select the updated layer from the Updated layer drop-down menu.
Click Browse , select the name and path for the layer patch file, and then
click Open.
Click OK.
To apply a layer patch file
1 In the SWV Admin tool, click File > Apply Patch.
2 Click Browse, select the name and pathfor the layer patchfile, and thenclick
Open.
Click Patchexisting layer to apply the patch to an existing layer. This
option updates the existing layer.
Select Export before patching to create a backup of the layer before the
patch is applied.
Select Create newlayer to apply the patch to a new layer. This option
leaves the original layer intact.
Select Copywriteable sublayer fromexistinglayer to copy the data that
is stored in the writeable sublayer. This option moves the changes that
are stored in the existing layer to the new layer.
3 Click OK.
After a patch is applied, Windows Shortcut files (.LNK) that are contained in the
writeable sublayer of the previous version are removed. Any newshortcuts in the
new version are available. This process helps prevent unusable shortcuts from
being left after an upgrade.
Youcanrename a virtual software layer. Before youupdate a layer, we recommend
that you rename the layer and change its GUIDto avoid confusion. To change the
GUIDof a layer, use the SETGUID SVSCMDcommand-line parameter. Youcanalso
use the SVSCMD executable file to rename a layer.
To rename a layer, you must first deactivate the layer.
To rename a virtual software layer
3 In the SWV Admin tool, on a layers right-click menu, click Rename.
4 Type the new name for the layer.
56
Managing virtual software
layers
About the management of virtual software layers
Actions you can perform to manage layers
Testing a virtual software layer
Interoperability with antivirus scanners
Hiding the FSLRDR redirection areas
Viewing the properties of a virtual software layer
Viewing variables used in a virtual software layer
About the management of virtual software layers
After youcreate andedit virtual software layers, youcanmanage themthroughout
their life cycle. You can manage layers locally and remotely. To manage layers
locally, you use the SWV Admin tool.
To manage layers remotely, you can use the following methods:
Symantec Workspace Streaming provides a
platform to stream virtual software directly to
virtual software layers. You can deliver
virtualizedapplications on-the-fly andleverage
advanced license tracking and reporting
capabilities.
Symantec Workspace Streaming
6
Chapter
The SVSCMD executable file has a set of
command-line parameters that let you manage
virtual software layers.
See SVSCMD command-line parameters
on page 72.
SVSCMD
Symantec Client Management Suite lets you
create tasks and policies to deliver and manage
virtual software layers onclient computers. See
the SoftwareManagement SolutionUser's Guide.
Altiris NotificationServer 6.x has a plug-inthat
lets you create tasks and policies to deliver and
manage virtual software layers on client
computers. See the Symantec Workspace
Virtualization Agent 6.x Help.
Altiris Notification Server
Symantec Deployment Solution lets you create
jobs to deploy and manage virtual software
layers. See the Deployment Solution Admin
Guide (6.x) or the Deployment Solution User's
Guide (7.x).
Altiris Deployment Solution
WiseScript Package Editor has a set of
Workspace Virtualization-specific actions that
let youcreate scripts tomanage virtual software
layers. See the WiseScript Package Editor Help.
WiseScript Package Editor
Workspace Virtualization provides
command-line, WMI, and API interfaces to
manage Workspace Virtualization client-side
operations with any desktop management
product.
Standard management framework
Table 6-1 indicates the actions that you can perform on a layer.
Table 6-1 Actions to manage layers
Description Action
Activates a layer that was imported on a computer. When a layer is
activated, its contents become visible. An activated layer is fully
functional. Activation is almost instantaneous.
Activate
Managing virtual software layers
58
Table 6-1 Actions to manage layers (continued)
Description Action
Deactivates a layer that was imported on a computer. When a layer
is deactivated, it is hidden from the user but is still on the computer.
Deactivationis almost instantaneous. If a process is running ina layer,
this action can only deactivate the layer if it includes the Force
parameter. A layer cannot be deactivated if it contains a process
running for another user, even by using the Force parameter. An
administrator must end the process and then deactivate the layer.
Deactivate
Deletes a layer from a computer.
See Deleting virtual software layers on page 62.
Delete
Exports a virtual software layer to create a portable archive file in
Extensible Package Format (XPF).
Export
Imports a virtual software layer in XPF or VSA format into the
Workspace Virtualization redirection areas on a computer. The
imported layer appears in the SWV Admin tool, if it is installed.
Import
Resets an application layer to its original imported state. Any data in
the writeable sublayer is deleted, including user profiles that were
added or changed. Data layers cannot be reset. You can use the new
reset point operation to create a new reset point.
See Resetting application layers on page 61.
Reset
Exporting a virtual software layer to an archive file
After youcreate a virtual software layer, youcanexport it to anExtensible Package
Format (XPF) archive file. XPF replaced VSA as the export file format.
Layer archive files can be stored on a network share, e-mailed, or deployed to
client computers on your network. After the archive file is copied to a client
computer, you import it to create a new layer.
You can export a layer locally or remotely. To export a layer remotely, you can
use the SVSCMD executable file.
59 Managing virtual software layers
To export a layer, you must deactivate the layer.
Do not select the Export user information option if you plan to distribute this
layer to other computers. If this option is selected, layer data that is stored in the
user SID is also exported. Select this option only when you create a backup.
To export a virtual software layer to an archive file
3 In the SWV Admin tool, on the layers right-click menu, click Export.
4 Specify a name and location.
5 Click OK.
See About the management of virtual software layers on page 57.
Importing a virtual software archive file
Virtual software is imported from Extensible Package Format (XPF) files. XPF
replaced VSA as the import file format, though support for importing VSA files
is still provided.
Youcanimport anarchive file ona computer tocreate a newlayer if the Workspace
Virtualization Agent is installed. After you import an archive file, you activate
the layer to complete the installation of the application.
To import an archive file
3 In the SWV Admin tool, on the File menu, click Import Layer.
4 In the Open dialog box, select the archive file to import and click Open.
5 After the import completes, click OK.
60
Activating and deactivating virtual software layers
Whena virtual software layer is activated, all the contents of the layer are visible.
Whena layer is deactivated, the contents of the layer are hidden. Whenyoucreate
an application layer, it is activated by default. When a layer is activated, its name
is displayed in bold type.
Youcanactivate anddeactivate layers locallyor remotely. Toactivate or deactivate
a layer remotely, you can use any of the interfaces that manage virtual software
layers.
To activate or deactivate a layer
3 In the SWV Admin tool, on a layers right-click menu, click Activate or
Deactivate.
You can select and activate or deactivate multiple layers by holding the Ctrl
key.
4 If youtry to deactivate a layer that has a process running, a message prompts
youto stopthe process. Click Yes to stopthe process anddeactivate the layer.
The message also displays a process ID(PID). You can use this PIDto look up
the process in Windows Task Manager. For information about PIDs, see the
Windows Task Manager Help.
Resetting application layers
You can reset a damaged application layer to restore it to its original imported
state.
The ability to reset an application layer provides the following benefits:
It does not require an uninstallation and reinstallation of an application.
It cannot damage the other applications that are installed on the computer.
It lets you maintain standard versions and configurations of applications
across your network.
Whenanapplicationlayer is created, the applications data is storedina read-only
sublayer. When a user runs the application, all of the data that is created by the
applicationis saved ina writeable sublayer. Whenyou reset the applicationlayer,
the data in the writeable sublayer is deleted and the read-only sublayer is
maintained.
Creating a newreset point merges the existing contents fromthe writable sublayer
with the read-only sublayer. This option can help preserve customizations and
prevent data loss when a reset occurs.
Caution: To prevent the loss of any data that is created by an application, redirect
the data out of the writeable sublayer.
Before you reset a layer, you can access the Edit Layer dialog box to viewthe files
and registry settings in the layers writeable sublayer.
You can reset an application layer locally or remotely. To reset an application
layer remotely, you can use any of the interfaces that manage virtual software
layers.
To reset an application layer
3 In the SWV Admin tool, on a layers right-click menu, click Reset.
4 Click Yes.
To create a new reset point
1 In the SWV Admin tool, right-click the deactivated layer for which you want
to create a new reset point. Click NewReset Point.
2 The Export layer before creating newreset point option creates a backup
version of the layer with its original reset point. The Copy current user's
settings to default user's settings area option merges the contents of the
writeable sublayer. This optionrestores these settings whenthe layer is reset.
Deleting virtual software layers
To remove a virtual software layer from a computer, you delete it. When you
delete a layer, all the data in the layer is deleted. We recomend creating a new
reset point and thenexporting a backup copy of layer before deletion. This backup
62
copy lets you quickly reimport the application to the current state if you decide
to install it again.
You can delete an application layer locally or remotely. To delete an application
layer remotely, you can use any of the interfaces that manage virtual software
layers.
To delete a virtual software layer
3 In the SWV Admin tool, on a layers right-click menu, click Delete.
4 Click Yes.
After you create a virtual software layer, you should test it to verify that it
functions properly. Because virtual software layers cannot conflict with other
applications, you do not have to test for conflicts. If you create both application
layers and data layers, you need to perform different tests on each.
To test an application layer
1 Activate the layer and run the captured application.
2 Verify that the applications files appear in the file system when the layer is
activated and the files are hidden when the layer is deactivated.
3 To test the layers portability, do the following:
Export the layer to an archive file.
Import the layer archive file on another computer.
Activate and run the application.
To test a data layer
1 Activate the layer.
2 Create one or more files that meet the specifications of the data layer.
You can create these files by using an application or by copying files to a
directory that is specified in the data layer.
3 Verify that the data files appear in the file system when the data layer is
active and are hidden when the data layer is deactivated.
4 If you create data files with a virtualized application, reset the application
layer and verify that the data files remain intact.
Workspace Virtualization contains functionality to guarantee that antivirus
scanners and other file utility applications can scan the native file system. These
applications are added to an ignore list so they do not see virtualized data when
they run. This guarantees that all files are properly scanned. You might also want
to add other programs to the ignore list so that they view the file system data
without any Virtualization. For example, if an inventory programsees a file twice
(virtualized and unvirtualized), it might count the file twice.
We recommend that you use this feature for your antivirus scanner. The
Workspace Virtualization Agent does not affect the run-time protection feature
of antivirus software. Antivirus products properly scan virtualized files when
they are opened. Any measures that the antivirus product takes against a file
occur on the native file system. However, there is an issue with manual antivirus
scanning. If a file exists in the base and in a virtual software layer, these files
overlay each other. A manual scan only sees and scans one of the files. The scan
does not see the version in the native file system and the version in the virtual
layer.
To add applications to the ignore list
1 In the Windows registry editor , in the
HKLM\System\CurrentControlSet\Services\FSLX\Parameters\FSLkey, create
a Multi-String Value called ProgramIgnoreList.
2 Double-click ProgramIgnoreList.
64
3 Enter the complete path for the executable file that you want to ignore and
click OK.
The path can be hard-coded (c:\windows\scan.exe) or can contain a variable
([_B_]WINDIR[_E_]\scan.exe).
The Workspace Virtualization Agent has a redirection area for files and registry
entries. The redirection area for the registry is
HKEY_LOCAL_MACHINE\Software\fslrdr. The redirectionarea for the file system
is typically c:\fslrdr. By default, these redirection areas are displayed. They are
also protected with ACLs so limited rights users cannot enter these areas.
If youare anadministrator, youmight want to hide the redirectionareas to protect
layers from malicious or accidental tampering. For example, a user with rights
might see the FLSRDR directory and, not knowing what it is, delete it. Then, all
layers would be lost.
If youhide the redirectionareas, theyare hiddenevenif the computer is configured
to show hidden files. Hiding the redirection areas can cause problems for the
programs that traverse the entire file system looking for data. For example, the
data is hidden from antivirus scanners and inventory programs. However, if you
hide the redirection areas, it does not affect run-time virus checking.
The following procedures hide the redirection areas only on that computer.
To hide the FSLRDR redirection areas manually
1 In the Windows registry editor , in the
HKLM\SYSTEM\CurrentControlSet\Services\FSLX\Parameters\FSL key,
create a DWORD value called HideRedirectAreas.
2 Set the value to "1".
Viewing the properties of a virtual software layer
You can view the properties of a virtual software layer. The properties include
information about the layer such as the layer GUID, layer type, and consumed
disk space.
To view the properties of a virtual software layer
3 In the SWV Admin tool, on a layers right-click menu, click Properties.
Many applications have specific environment settings for file paths, paths in
registry values, and other values. To make virtual software layers portable across
computers, these paths can be represented by variables. Two types of variables
are available: user and system.
To view variables used in a virtual software layer
3 In the SWV Admin tool, on a layers right-click menu, click Properties.
4 In the Layer Properties dialog box, click the Variables tab.
66
Layer operations
Hide a layer from other layers or from the operating system
Add a layer dependency
Deactivate on last process exit
Clone a layer
Keep all data in layer
Capture changes made by non-virtualized applications
Hide a layer from other layers or from the operating
system
Layer isolation lets you control layers by turning off visibility between layers and
the base. Isolating layers makes it easier to use different versions of the same
program to open associated files.
A layer is isolated when all three visibility restrictions are active. Isolated layers
are visible only to layers to which the isolated layer is dependent. By using both
layer isolation and dependencies, you can control layer priority.
Change these settings to determine if a layer gets files fromthe operating system
or from another layer.
7
Chapter
To change layer visibility
1 Select a layer.
2 Right-click and select one of the following visibility options:
This option hides the selected
layer from all other layers. The
layer is still visible to the
operating system.
Hide FromOther Layers
This option makes the selected
layer invisible to the operating
system. The layer is still visible
to other layers.
Hide FromOperating System
This option makes all other
layers invisible to the selected
layer. The layer is still visible to
the base.
Hide Other Layers FromThis Layer
Dependent layers let youspecify anassociationbetweenlayers. Dependent layers
are checked for files and services before the base layer or other layers are checked.
For example, if you have a Java application, you can install a JRE into a dependent
layer. The Java application in your layer uses the JRE from this dependent layer,
rather than the JRE installed in the base or in another layer.
A layer can always see any dependent layers. Layer dependencies override any
layer visibility settings.
Dependent layers are activated automatically when any layers that contain the
dependency are activated. If a dependent layer does not activate, the main layer
is still activated. When a layer is deactivated its dependent layers are not
automatically deactivated.
Adding a layer dependency
1 In the SWV Admin tool, select the layer to which you want to add a layer
dependency.
2 Click Layer > Properties, and then click the Dependent layers tab.
3 Right-click and select NewDependent Layer.
4 Select the layer you want to add as a dependent layer and click OK.
Layer operations
68
Removing a layer dependency
1 In the Symantec Workspace Virtualization Admin tool, select the layer from
which you want to remove a layer dependency.
2 Click Layer > Properties, and then click the Dependent layers tab.
3 Right-click a layer and then select Remove Dependent Layer.
Deactivate on last process exit causes a layer to deactivate when all processes are
finished. This option is generally used with the Autorun from layer option to
deactivate layers when an application is closed.
See Capture changes made by non-virtualized applications on page 70.
Enabling Deactive When Last Process Exits
In the SWV Admin tool, right-click on a layer. Select Deactivate WhenLast
Process Exits from the layer context menu.
Clone a layer
Clone layer creates an identical copy of an existing layer with a new GUID.
Cloning a layer
1 In the SWV Admin tool, right-click a layer, and then select Clone.
2 In the Clone Layer dialog box, enter a name for the new layer.
3 Click OK.
Keep all data in layer
Keep in layer lets you save changes made to the files in a layer. If the layer is
active, changes to any file inthe layer are stored inthe layer. This optionincludes
any changes that are made by any application.
Layers save only the changes fromthe processes that exist within the layer. If an
external process (such as Notepad) changes a file, the file is copied to the base
and changes are not stored in the layer.
With keep changes in layer enabled, when a process modifies any file in the layer,
the change is saved in the layer. When the layer is deactivated, if this file exists
in the base, the file is in the same state as before the layer was activated.
69 Layer operations
Keep file changes in layer works with global and layer excludes, as well as data
layers.
Enabling Keep File Changes in Layer
Inthe SWVAdmintool, right-click a layer. Select KeepFileChangesinLayer
from the layer context menu.
Capturechanges madeby non-virtualizedapplications
This option lets you select non-virtualized applications to run as if they were in
a layer. Any processes that the selectedapplications launchare runfromthe layer.
Any changes that are made by these processes are saved in the layer and not in
the base.
Autorun entries specify the path to applications you want to run from a layer.
When the layer that contains the autorun entry is active, changes made by
applications in the autorun entries list are always stored in the layer.
Run fromlayer is similar to setting an autorun entry but is for capturing changes
from a single use.
To capture application changes each time an application is used
1 In the SWV Admin tool, right-click a deactivated layer, and then click
Properties.
2 On the Layer Properties window, click the AutorunApplications tab.
3 Right-click inside the tab, and then click NewAutorunEntry.
4 Type in or browse to the application path, and then click OK.
The applicationmust be specifiedusing a full path. Ashortcut cannot be used
to specify an application.
To capture application changes for a single use
1 In the SWV Admin tool, right-click on the layer, and then click Run
ApplicationFromLayer.
2 Browse to the application that you want to run fromthe layer, and then click
OK.
Layer operations
Capture changes made by non-virtualized applications
70
Technical reference
About system variables
SVSCMD command-line parameters
Virtual software layer attributes
How layer prioritization works
How to set the HKCR priority of a layer
Windows Management Interface
OnEvent actions
About system variables
Many applications have specific environment settings for file paths, paths in
registry values, MSI paths, andso forth. To make Virtual Software Packages (VSPs)
portable across computers, Workspace Virtualizationprovides variables for many
application settings and data layer properties. Workspace Virtualization uses
common system variables to substitute for well-known locations on a Microsoft
Windows basedinstallation, suchas WINDIRfor the Windows folder. That provides
seamless compatibility with any computers that do not use the standard folder
structure. For example, a computer where the My Documents folder is moved
standard folders are renamed. You can viewthe variables on the Variables tab of
the Edit Layer dialog box.
See Viewing variables used in a virtual software layer on page 66.
Workspace Virtualization uses the following types of variables that are set as
environment variables when a layer is active:
8
Chapter
Static and loaded at boot time. Examples:
WINDIR = C:\Windows
SYSTEMDRIVE = C:
System variables
Per user and loaded when the user logs on. Examples:
DESKTOP = C:\Documents and
Settings\User\Desktop
USERPROFILE = C:\Documents and Settings\User
User variables
Workspace Virtualization uses the following tags to denote variables:
[_B_] = Begin tag
[_E_] = End tag
[_CS_] = Convert to short path
[_MSI_] = Convert to MSI path
The SVSCMDexecutable file is installedwiththe Workspace VirtualizationAgent.
You can use this executable file with its command-line parameters to work with
Virtual Software Packages. Many of the command-line parameters also have
associated flags.
See SVSCMD parameter flags on page 77.
To display the parameters and flags for SVSCMD, use the Help parameter. This
parameter also displays SVSCMD examples.
See SVSCMD command-line examples on page 79.
The syntax for using SVSCMD is:
SVSCMD [LayerGUID|LayerName] { [flags]} [...n]
The following table is a list of the available command-line parameters:
Table 8-1 SVSCMD command-line parameters
Description Associated Flags Parameter
Activates the layer. A[CTIVATE]
Technical reference
72
Table 8-1 SVSCMD command-line parameters (continued)
Sets a layer to activate at the
start of the computer. If this
parameter is enteredwithout
a flag, the default behavior is
to automatically activate on
start.
[-Y|-N] AUTO[ACTIVATE]
Add or delete process to
automatically run in the
layer. Providing no options
lists the processes that are
set to automatically run in
the layer.
[-A|-D] AUTORUN
Creates a new layer by
capturing changes. You
cannot perform a capture if
any other layer is activated
on the computer. Layer
names are limited to 50
characters.
[-P|-S|-E] C[APTURE]
Checks for a valid product
serial number. This
parameter tells you if your
key is good and provides
information about it. If this
parameter is enteredwithout
a flag, the default behavior is
to check for a valid product
serial number.
-K CHECKKEY
Clones a layer. -NAME [-RW] CLO[NE]
Creates an empty layer.
Layer names are limited to
50 characters
CREATE
Deactivates the layer. [-F] D[EACTIVATE]
Add, delete, or view
independent layers.
[-A|-D] DEP[ENDS]
Deletes the layer. [-F] DEL[ETE]
73 Technical reference
Create a patch file. -P [-F] DIFF[ERENCE]
Lists all layers on the
computer.
[-V] ENUM[ERATELAYERS]
Excludes all files that are
stored in the user profile.
This option creates a global
exclude that affects all
layers.
[-Y|-N] EXCLUDEALLPROFILES
Executes a process as a part
of a layer so that it appears
to run from the layer. This
command can be used as
follows:
If you want an audit tool
to see the computer from
the perspective of the
layer, you can run
SVSCMD "LayerName"
EXEC [path to the
executable file]. Then,
anyprocess that runs has
the same priority as if it
were run from the layer.
If you run a process that
makes changes to the file
system or registry, those
changes are saved in the
layer and not in the base.
For example, you can run
an EXE patch with this
parameter to save
changes that are made by
the patch in the layer.
[-PID|-PATH][-NOWAIT] EXEC[FROMLAYER]
Technical reference
74
Exports the layer to a virtual
software archive file or
virtual runtime archive file.
The provided file extension
specifies the layer archive
type. Provide an XPF
extension to use the
Extensible Package Format.
Provide a VSA extension to
use the legacy virtual
software archive format.
[-P] E[XPORT]
Set a layer to deactivate on
last process exit.
[-Y|-N] EXIT
Displays the SVSCMD
command-line parameters,
flag options, and
command-line examples.
H[ELP]
Tells Workspace
Virtualization to ignore this
process.
[-W] -P Ignore
Imports a virtual software
archive file. Archive files can
be in XPF, VSA, or VRA
format.
[-P|-F] I[MPORT]
File/registry items to keepin
a layer. Providing no options
lists the registry items
currently set to keep in the
layer.
-FILE|-REG [-A|-D] KEEP
Create newreset point. Copy
read-write sublayer to
read-only sublayer. The SID
optioncopies the givenSID's
read-write to the read-only's
user template area. Without
-SID no SID information is
copied
[-SID] NEWRESET[POINT]
Enables partial activation.
See Activating a virtual
software layer using a
desktop shortcut
on page 44.
[-Y|-N] |
[-LAYERCHANGED]
[-BACKGROUND]
PARTIALACTIVATE
Applies a patch file. The
-INPLACE option overlays
the patch over the existing
layer. The -RWoptioncopies
the existing ReadWrite layer
to the new layer that the
patch creates.
-P [-INPLACE|-RW] PAT[CH]
Sets the priority of a layer.
See Howlayer prioritization
works on page 84.
[-T|-L|-R] PRIORITY
Displays the following
properties of a layer: name,
state, type, priority, version,
GUID, last activated time,
create time, last reset time,
redirect locations, layer
subtype, depot GUID, andthe
layers depot path.
[-V] P[ROPERTIES]
This parameter has been
deprecated.
REF[RESHDESKTOP]
Renames the layer. Layer
names are limited to 50
characters.
-NAME REN[AME]
Technical reference
76
Reloads the Global Exclude
list fromthe registry into the
Agent. Use this command
after the global exclude
properties have been
manually changed in the
registry. This list is reloaded
automatically when the
computer is restarted, or if
the changes were made
locallyusingthe SWVAdmin
tool.
REL[OAD]
Resets the layer. [-F] R[ESET]
Sends updated inventory
data to Notification Server.
SEND[INVENTORY]
Sets the layer ID to the new
GUID.
SETGUID
Updates the product serial
number. You can use this
parameter to manually set a
key.
-K SETKEY
Displays Workspace
Virtualization version
information.
VER[SION]
Set, unset, or view a layer's
visibility.
[-SET|-UNSET] VIS[IBILITY]
SVSCMD parameter flags
Some of the SVSCMDparameters have associated flags. The list of command-line
parameters has a column that lists any flags you can use with a command-line
parameter.
The following table is a list of the available SVSCMD parameter flags:
Table 8-2 SVSCMD parameter flags
Description Flag
Add a value (command specific). -A[DD] <value>
Makes a partially activatedlayer beginto fully activate itself
in the background approximately one minute after startup.
-BACKGROUND
Delete a value (command specific). -D[EL] <value>
Ends capture. -E[ND]
File pattern of files to keep in the layer. -FILE -ADD <pattern>
Forces the command when it might otherwise fail. For
example, youcanforce a layer to overwrite anexisting layer
during import. You can also force an application that is
running from a layer to close.
-F[ORCE]
Specifies the product serial number. -K[EY] <serial>
Used to indicate that a partially activated layer has been
changed or altered. This flag allows partial activation of
that layer to function correctly.
-LAYERCHANGED
Specifies the priority of the layer. -L[EVEL] <level>
Specifies the new name for the layer. -NAME <name>
Turns off the option. -N[O]
This flag has been deprecated. -N[O]D[ESKTOP]R[EFRESH]
Do not export user-specific information. -NOUSER
Do not wait for executed process to complete. -NOWAIT
Specifies a directory path. If the path contains a space, put
it in quotes.
-P[ATH] <path>
Specifies the PID of the process that needs to be executed
as a part of layer.
-PID <PID>
Resets the priority of the layer to the default priority. -R[ESET]
Copy the writable sublayer. -RW
Technical reference
78
Table 8-2 SVSCMD parameter flags (continued)
Description Flag
Set a layer's visibility where <value> can be:
1- Other layers cannot see this layer
2- This layer cannot see other layers
3- Base layer cannot see this layer
-SET <value>
User SID. An empty string specifies the current user's SID. -SID
Starts the capture. -S[TART]
Specifies the priority type (HKCR). -T[YPE] <type>
Set a layer's visibility where <value> can be:
1- Other layers cannot see this layer
2- This layer cannot see other layers
3- Base layer cannot see this layer
-UNSET <value>
Displays verbose command output. -V[ERBOSE]
Makes SVSCMD wait for the application to close before it
continues.
-W[AIT]
Enables an option. -Y[ES]
SVSCMD command-line examples
The following is a list of SVSCMD command-line examples with an explanation
of what each example does. The examples are listed in alphabetical order by the
command-line parameter that is used.
Table 8-3
Result Command-line examples
Activates the specified layer. SVSCMD.EXE "Layer name" A
Activates all layers. SVSCMD.EXE * A -NDR REF
Sets the layer with the specified GUID to
start automatically.
SVSCMD.EXE
4db31efa-9163-45de-b33f-bb4737aa022c
AUTO -Y
Table 8-3 (continued)
Ends the capture of changes to the layer.
This commandis usedafter the CAPTURE
-START command.
SVSCMD.EXE "Layer name" CAPTURE -E
Creates a layer for Notepad.exe. SVSCMD.EXE "Notepad" CAPTURE -P
C:\WINDOWS\system32\notepad.exe
Creates a new layer with the specified
name. The capture starts and is active.
SVSCMD.EXE "Layer name" CAPTURE
-START
Lets youknowif the specifiedproduct key
is a valid key.
SVSCMD.EXE CHECKKEY -KEY
xxxxx-xxxxx-xxxxx-xxxxx
Creates anemptylayer withthe specified
name.
SVSCMD.EXE "Layer name" CREATE
Forces a deactivation of the specified
layer.
SVSCMD.EXE "Layer name" D -F
Forces a deletion of the specified layer. SVSCMD.EXE "Layer name" DEL -F
Lists all existing layers. SVSCMD.EXE ENUM
Exports the specified layer to the
specified layer archive file.
SVSCMD.EXE "Layer name" EXPORT -PATH
"C:\My Packages\Layer.vsa"
Displays the help for SVSCMD. SVSCMD.EXE HELP
Forces the import of the specified layer
archive file.
SVSCMD.EXE I -P C:\VSP\Layer.vsa -F
Ignores the requested process. This
command is generally used during
capture.
SVSCMD.EXE ignore -WAIT -PATH
"C:\Program Files\Microsoft
Office\Office 11\WINWORD.EXE
MyWord.doc"
Displays the properties for the specified
layer.
SVSCMD.EXE "Layer name" P
Sets the priority for the specified layer
with a priority value of 65.4.
SVSCMD.EXE "Layer name" PRIORITY -L
65.4
See How layer prioritization works
on page 84.
Resets the priority of the specified layer. SVSCMD.EXE "Layer name" PRIORITY -R
Technical reference
80
Sets the priority for the specified layer to
type HKCR with a priority value of 65.4
SVSCMD.EXE "Layer name" PRIORITY -T
HKCR -L 65.4
Resets the priority of the specified layer
and sets the type to HKCR.
HKCR -R
Sets the priority of the specified layer
with a priority value of 65.4 and sets the
type to Normal.
NORMAL -L 65.4
Resets the priority of the specified layer
and sets the type to Normal.
NORMAL -R
Reloads the Global Exclude list from the
registry into the Workspace
Virtualization Agent.
SVSCMD.EXE RELOAD
Forces a reset of the layer with the
specified GUID.
SVSCMD.EXE
4db31efa-9163-45de-b33f-bb4737aa022c
reset -F
Sends inventory information to
Notification Server.
SVSCMD.EXE SEND
Changes the GUID of the specified layer
to the specified GUID.
SVSCMD.EXE "Layer name" SETGUID
0C4936F6-4943-4D0F-9647-29FE71216c89
Sets the product key for the Workspace
Virtualization Agent.
SVSCMD.EXE SETKEY -KEY
xxxxx-xxxxx-xxxxx-xxxxx
Displays the current version of the
Workspace Virtualization Agent files.
SVSCMD.EXE VER
Unsets the specifiedlayer's visibilityfrom
"Other layers cannot see this layer."
SVSCMD.EXE
0C4936F6-4943-4D0F-9647-29FE71216C89
VISIBILITY -UNSET 1
Sets the specified layer's visibility to
"Base layer cannot see this layer."
SVSCMD.EXE "Layer name" VISIBILITY
-SET 3
Sets a dependency between the specified
layers.
SVSCMD.EXE "Layer name" DEPEND -A
0C4936F6-4943-4D0F-9647-29FE71216C89
Creates a patch archive file from the
specified layers and saves it in the
specified folder path.
SVSCMD.EXE "Sample App" DIFFERENCE
"Sample App V2" -PATH c:\app.vpa
Applies the specified patch archive file. SVSCMD.EXE PATCH -PATH
c:\temp\app.vpa
Applies the specified patch archive file
over the existing layer.
SVSCMD.EXE PATCH -PATH
c:\temp\app.vpa -INPLACE
Applies the specified patch archive file
and copies the writeable sublayer to the
newly patched layer.
SVSCMD.EXE PATCH -PATH
c:\temp\app.vpa -RW
Clones the specified layer. SVSCMD.EXE "Layer Name" CLONE -NAME
"Layer Name Clone"
Sets the layer to deactivate on the exit of
the last process.
SVSCMD.EXE "Sample App" EXIT -Y
The attributes section contains the layer attributes for the registry redirection
area. You can view these attributes at
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FSLX\Parameters\FSL.
In this directory each layer has a numbered folder. The following table lists and
describes the different attributes:
Warning: Do not modify these attributes in the registry.
Table 8-4 Layer attributes
Description Attribute
The date andtime whenthe sublayer was last activated(value
= binary_date_time). This attribute is updated when Activate
is called or when the computer starts if the layer is
ActiveOnStart.
ActivateTime
The sublayer is currently inactive (value = 0) or the sublayer
is active (value = 1). Activate sets this value to 1. Deactivate
sets this value to 0.
Active
Technical reference
82
Table 8-4 Layer attributes (continued)
The sublayer is active on systemstart (value = 1). You change
this value by setting a layer to start automatically.
See Configuring a virtual software layer to start
automatically on page 44.
ActiveOnStart
The date and time at which the layer was created (value =
binary_date_time).
CreateTime
Deprecated entry, not used. Enabled
The path to the sublayer's file redirection area (value =
Root:\Fslrdr\sublayer_folder_number). The files for the layer
are stored here.
FileRedirect
A value that represents the layer type. The value is a decimal
value of a five bit hex value. The value of each bit represents
a different type. For example, if the layer is a data layer, the
value of the first bit is 1.
Flags
The sublayer's GUID(value =GUID). Youcanuse the SVSCMD
executable file with the SETGUID parameter to change this
value.
ID
Combines withMinorVersiontoindicate the sublayer's format:
either (value = 0), (value = 1), or (value = 2). Different major
versions are usually not compatible.
MajorVersion
Combines withMajorVersiontoindicate the sublayer's format:
either (value = 0), (value = 1), or (value = 2). Different minor
versions are usually compatible. Internal layer upgrades are
applied to move a minor version to the current version. This
process is not reversible.
MinorVersion
The layer's name (value = layer_name). The visual name of
the layer. You can change a layers name in the SWV Admin
tool or with the SVSCMD executable file.
Name
The GUID for the sublayer's companion sublayer (value =
companion_sublayer's_guid). This attribute is used to link the
read-only sublayer to the writeable sublayer and vice versa.
Youindirectly change this value withthe SVSCMDexecutable
file and the SETGUID parameter.
PeerID
The sublayer's writeable status; either read-only (value = 1)
or writeable (value = 0).
ReadOnly
Table 8-4 Layer attributes (continued)
The date and time at which the layer was last reset (value =
binary_date_time). This value is indirectly changed when a
layer is reset.
RefreshTime
The location of the layer's registry data (value =
SOFTWARE\fslrdr\sublayer_folder_number). The registry
entries for a layer are stored here.
RegRedirect
(Optional) Set value =1to delete this layer. The layer is deleted
after this value is checked.
ShouldDelete
The layer's type: application (value=0), peer (value=1), data
(value=2).
Type
The Workspace Virtualization Agent assigns an HKCR priority to each layer. If a
systemrequest applies to more thanone activated layer, the systemuses the layer
with the highest HKCR priority. If two activated layers have the same HKCR
priority, you cannot predict which layer the system request accesses. To resolve
this problem, you can set a layers HKCR priority.
See How to set the HKCR priority of a layer on page 86.
Prioritization works as follows:
If two virtualized applications are registered to open a file type, it determines
which layer opens that file type.
For example, you have activated layers for two different Web browser
applications. Both applications are registered to open HTML files. You can
assign a higher priority to one of the layers so that it is used to open the HTML
files.
If two virtualized applications use different versions of the same DLL file, it
determines which layers DLL file appears in the Windows directory.
For each systemrequest, the Workspace Virtualization Agent does the following
in order:
Builds a list of activated layers.
Assigns each layer a priority value.
Technical reference
84
Orders a list of activated layers based on these priorities.
HKCR (HKEY_CLASSES_ROOT) requests are based on file type. For example, the
system would make an HKEY_CLASSES_ROOT request if a user clicked on a text
file. If the request involves a process, the Workspace Virtualization Agent also
takes into considerationthe owner layer of a process. The owner layer of a process
is the layer that houses the executable file that starts the process. The owner layer
of a child process is the same as the owner layer of its parent process. The owner
is the same even if the executable file that starts the child process is in a different
layer.
The following table lists the default priority values assigned by Workspace
Virtualization (the lowest numerical value representing the highest priority):
Table 8-5 Layer priority values
Default Priority Description Type of Request
55.5 highest Priority of the layers registry entries from
the perspective of an application running
from that layer.
Normal owner
65.5 Priority of the layers registry entries from
outside the layer.
Normal
75.5 Priority of the bases registry entries from
from the base.
Base owner
85.5 lowest Priority of the bases registry entries from
from a layer.
Base
For example, you have an activated layer for Firefox with Internet Explorer
installed on the base layer. When you open an HTML file, the Workspace
Virtualization Agent does the following in order:
Builds a list of all activated layers and the base.
Assigns the following priorities:
65.5 to the Firefox layer
85.5 to the Internet Explorer
Launches Firefox because it has the highest priority.
If a system request applies to two activated layers that are assigned the same
priority, you cannot predict which layer the system request accesses. To resolve
this issue, you can assign one layer a higher priority. To assign a priority to a
layer, use the SVSCMDexecutable file withthe PRIORITYcommand-line parameter
and its flags.
See SVSCMD parameter flags on page 77.
For example, youhave activatedlayers for twodifferent Webbrowser applications.
Both applications are registered to open HTML files. You can assign a higher
priority to one of the layers so that it is used to open the HTML files.
Use caution when you change the priorities of layers. You can use any numeric
value for a priority, but we recommend that you change only the values to the
right of the decimal. For example, if two layers have a default priority of 65.5, you
can change one to 65.4. This change assigns one layer a higher priority without
changing the priority in relationship to other layers. If you change the values to
the left of the decimal, it could cause problems when newlayer types are created
in the future.
See How layer prioritization works on page 84.
This sectiondescribes WorkspaceVirtualizationsupport for Windows Management
Interface.
See the following article on Connect for more information and examples:
WMI
VirtualSoftwarePackage class
All the standard SVScmd and SVSadmin functions are located in the
VirtualSoftwarePackage class.
Table 8-6 indicates the properties for this layer class.
Technical reference
86
Table 8-6 VirtualSoftwarePackage Properties
Description Datatype Name
Layer ID.
This value is a GUID.
string ID
Layer name. Writeable. string Name
Current active or inactive state of the layer Boolean Active
The layer is activated automatically when the
system is started. Writeable.
Type of the virtual software package.
Boolean AutoActivate
0 = Application
1 = Data
uint32 Type
When the layer was created. datetime CreatedTime
When the layer was last activated. May be null if
the layer has never been activated.
datetime ActivatedTime
When the layer was last reset. May be null if the
layer has never been reset.
datetime ResetTime
If there is a switch for an action in SVScmd, it can also be performed with WMI.
Table 8-7 indicates the methods for WMI actions:
Table 8-7 VirtualSoftwarePackage Methods
Explanation Example Action Name
Imports a new layer. Once the
import is complete, the layer can
be enumerated, and the other
(non-static) methods can be called.
static uint32 Import(
[in] string Filename,
[in] bool Overwrite,
[out] string PackageId
)
Import
Table 8-7 VirtualSoftwarePackage Methods (continued)
Activates a layer.
Activating a layer through
SVSAdmin or SVSCmd results in
the current user's desktop being
refreshed. Due to security
limitations, activating through
WMI does not refresh the desktop
or the Admin utility if it is open.
uint32 Activate(
)
Activate
Deactivates a layer. You can force
the deactivation if there is a
process still running fromthe layer
The same security limitations that
apply to activation also apply to
deactivation.
uint32 Deactivate(
[in] Boolean Force,
[out] uint32 ProcessId
)
Deactivate
Resets a layer. Similar to
SVSAdmin, this call deactivates the
layer if necessary, and thus
supports the same parameters as
deactivate. The layer returns to the
previous state before reset: e.g., if
the layer was active before the
reset, it is restored to the active
state.
uint32 Reset(
[in] Boolean Force,
[out] uint32 ProcessId
)
Reset
Sets the value of the AutoActivate
property.
uint32 SetAutoActivate(
[in] Boolean AutoActivate
)
SetAutoActivate
Exports the layer to an archive file
on the disk.
uint32 Export(
[in] string Filename,
[in] bool Overwrite
)
Export
Deletes the layer. The layer must
be deactivated.
uint32 Delete(
)
Delete
Technical reference
88
Table 8-7 VirtualSoftwarePackage Methods (continued)
Renames the layer. uint32 Rename(
[in] string Name
)
Rename
VirtualSofwareSublayer class
The VirtualSofwareSublayer class is for pulling informationabout eachsublayer:
the read-only and the writeable sublayers. No methods are included in this class.
Table 8-8 indicates the properties for this layer class
Table 8-8 VirtualSofwareSublayer Properties
Description Datatype Name
Layer ID.
This value typically takes the
form of a GUID.
string ID
Package ID. This value is a foreign
key to a VirtualSoftwarePackage
class instance. [In the current
implementation this value is also
the same as the IDof the primary
(non-peer/read-only) sublayer.]
string PackageId
File system path where the
redirection area of the layer is
located.
string FileRedirectPath
Registry path where the
redirection area of the layer is
string RegistryRedirectPath
Type of the layer.
0 = Normal
1 = Peer
2 = Data
uint32 Type
Using WMI
To use all the methods in Symantec Workspace Virtualization, it is necessary to
bind to different objects. The following sections describe each object and sample
subroutines.
VirtualSoftwarePackage
To access several (but not all) methods, you need to bind to
\root\default:VirtualSoftwarePackage. This method provides access to Import
and Export. The Restore and Backup impersonation are set because Import and
Export require them to function.
Copy and paste the following code into the script and then call setWMIForSVS:
SUB setWMIForSVS
SET objWMIService = GetObject( _
"winmgmts:{impersonationLevel=impersonate,(Restore, Backup)}!\\" & _
strComputer & "\root\default:VirtualSoftwarePackage" )
WScript.Echo "WMI Set to SWV mode"
END SUB
Default
For all other methods, you need to bind to \root\default. This method uses Debug
impersonation. you might need to set this impersonate level to deactivate a layer.
For example, Apache has a process that is not owned by the user who launched
it. If you are unsure if this is required you can try to run the script without this
debug level. This level removes many security features and should not be used
unless required. To use the cimv2 object to kill a process ina layer you need Debug
impersonation.
Copy and paste the following code into the script and then call setWMIToDefault:
SUB setWMIToDefault
"winmgmts:{impersonationLevel=impersonate,(Debug)}!\\" & _
strComputer & "\root\default" )
WScript.Echo "WMI Set to default mode"
Technical reference
90
END SUB
Cimv2
While there are no methods attached to this object, you might need to use it in a
VBscript. You need Debug impersonation level to kill any process you do not own
using Deactivate.
Copy and paste the following code into the script and then call setWMIToDefault:
SUB setWMIToCimv2
Set objWMIService = GetObject( _
"winmgmts:{impersonationLevel=impersonate,(Debug, Restore,Backup)}!\\" & _
strComputer & "\root\cimv2" )
WScript.Echo "WMI Set to cimv2 mode"
END SUB
Workspace Virtualization functions
This section contains sample functions to show how common methods are used.
These are all intended to be used with ON ERROR RESUME NEXT error handling.
Activate
'function activate(guid) - Activates a Layer by GUID
' guid: String --guid of VSA to be activated
' Returns Success: Boolean
FUNCTION activateSVS(guid)
SET objItem = objWMIService.Get( "VirtualSoftwarePackage.Id=" & _
""""& guid &"""" )
IF Err.Number <> 0 THEN
activateSVS=false
ELSE
WScript.Echo "Activating layer: " & objItem.Name
x = objItem.Activate()
activateSVS=false
ELSE
activateSVS=true
END IF
END IF
END FUNCTION
Deactivate
'function deactivate(guid) - deactivates a Layer by GUID
' guid: String --guid of VSA to be deactivated
' Returns Success: Boolean
FUNCTION deactivateSVS(guid)
SET objItem = objWMIService.Get( "VirtualSoftwarePackage.Id=" & _
""""& guid &"""" )
deactivateSVS=false
ELSE
WScript.Echo "Deactivating layer: " & objItem.Name
x = objItem.Deactivate()
IF x <> 0 THEN
WScript.Echo "Error Code: " & x
deactivateSVS=false
ELSE
deactivateSVS=true
END IF
Technical reference
92
END IF
END FUNCTION
Import
'function import (vsa,path) - imports the VSA into SWV
' vsa: String --Name of VSA to be imported
' path: String -- path to VSA
' Returns Success: GUID or False
FUNCTION importSVS(myVSA,myPath)
WScript.Echo "Importing layer: " & myPath & myVSA
result = objWMIService.Import( myPath & myVSA , True, packageId )
WScript.Echo "Importing Finished"
importSVS=false
ELSE
importSVS=packageId
END IF
END FUNCTION
WMI sample scripts
This section contains sample scripts that demonstrate WMI functionality.
Enumerating activated layers
strComputer = "."
"winmgmts:{impersonationLevel=impersonate}!\\" & _
SET colItems = objWMIService.ExecQuery( _
"Select * from VirtualSoftwarePackage Where Active = True" )
FOR EACH objItem IN colItems
WScript.Echo "Id: " & objItem.Id
NEXT
Finding Sublayers for a Layer
strComputer = "."
"winmgmts:{impersonationLevel=impersonate}!\\" & _
SET colItems = objWMIService.ExecQuery( _
"Select * from VirtualSoftwareSublayer " & _
"Where PackageId = ""guidguid-guid-guid-guid-guidguidguid""" )
FOR EACH objItem IN colItems
WScript.Echo "Id: " & objItem.Id
NEXT
OnEvent actions
OnEvent entries let youtrigger actions automatically whena layer's state changes.
For example, you can play a sound when a layer is activated or run a program
when a layer is deactivated. The following table explains all possible registry
values, all of which are REG_MULTI_SZ types:
Table 8-9 OnEvent actions
Function Registry value
Triggers an action before layer activation OnPreActivate
Triggers an action after layer activation OnPostActivate
Triggers an action before layer deactivation OnPreDeactivate
Triggers an action after layer deactivation OnPostDeactivate
Technical reference
OnEvent actions
94
Table 8-9 OnEvent actions (continued)
Function Registry value
Triggers an action before layer import OnPreImport
Triggers an action after layer import OnPostImport
Triggers an action before layer export OnPreExport
Triggers an action after layer export OnPostExport
Triggers an action before layer reset OnPreReset
Triggers an action after layer reset OnPostReset
Triggers an action before layer deletion OnPreDelete
Triggers an action after layer deletion OnPostDelete
Triggers an action before new layer creation OnPreCreate
Triggers an action after new layer creation OnPostCreate
Triggers an action before an application is captured to
a layer
OnPreCapture
Triggers an action after an application is captured to a
layer
OnPostCapture
For a global setting, place the value in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FSLX\Parameters\FSL.
For a local setting, create the value in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FSLX\Parameters\FSL\1,
where '1' is the read-only (RO) layer number.
Layer numbers canbe found by selecting Details fromthe Viewdrop-downinthe
SWVAdmintool. The Sublayerinfocolumnlists boththe read-onlysublayer (RO)
and the writable sublayer (RW) numbers.
For example, a user edits an HTML document and wants Notepad++ to always
open when a layer containing Firefox is activated. The user can create a registry
value named OnPreActivate with the value data 'C:\Program Files\Mozilla
Firefox\Firefox.exe'. This value runs Firefox.exe before the layer is activated.
If Notepad++ is also captured to the layer containing Firefox.exe, the registry
value needs to be named OnPostActivate. Notepad++ is not available until the
layer is successfully activated.
OnEvent actions
OnEvent actions canalso be usedwithany layer operations that canbe performed
with SVSCMD command-line actions. For example, you want to reset a layer
containing Firefox every time the layer is deactivated. Youcanaddanentry named
OnPostDeactivate with the value'svscmd.exe [layer GUID] reset'. This
triggers a reset after deactivation.
If creating anonEvent action, the w tag canalso be used to cause the actionto wait
until the indicated process is finished. For example, the registry value
'OnPreActivate' withthe value data '"C:\WINDOWS\system32\notepad.exe"' runs
Notepad.exe before it activates a layer. However, changing the value date to
'w,"C:\WINDOWS\system32\notepad.exe"' indicates that thelayer does not activate
until the Notepad.exe process exits.
Post events are triggered regardless whether the main action is successful or not.
Post events occur for activate, delete, deactivate, create, and other main actions
regardless of the result of the main action.
Technical reference
OnEvent actions
96
A
Access Control Lists 21
ACLs. See Access Control Lists
activating
layers on start-up 44
layers using desktop shortcuts 44
Agent. See Workspace Virtualization Agent
application layers
global captures 37
single program captures 35
testing 63
applications
adding to existing layers 38
adding to ignore lists 64
virtualization guidelines 19
C
cloning a layer 69
command-line properties 27
D
data layers
creating 40
editing 46
testing 64
data loss, preventing 19
data, keeping in layer 69
delete entries 51
dependent layers
creating 68
removing 69
duplicate services 23
E
empty layers, creating 41
exclude entries
about 47
global excludes 49
ignoring global excludes 50
layer excludes 48
exclude entries (continued)
transferring global excludes 50
user profile excludes 50
Extensible Package Format. See XPF files
F
failed installation, cleaning up 31
fslrdr redirection areas, hiding 65
G
global captures 37
global exclude entries 47, 49
H
HKCR priorities 86
I
installing, Workspace Virtualization Agent 26
L
layer patch files 54
layer prioritization 84
layer properties, viewing 65
layer types 34
layer visibility 68
layers. See virtual software layers
M
managing layers. See virtual software layers
multiple concurrent users 23
N
non-virtualized applications, capturing changes 70
O
OnEvent actions 94
Index
P
program ignore list 64
R
redirection areas, hiding 65
registry settings, editing 46
renaming, virtual software layers 55
S
security 21
silent installation 27
single program captures 35
supported platforms 25
SVSCMD executables
command-line examples 79
command-line parameters 72
parameter flags 77
system variables 71
T
testing, virtual software layers 63
troubleshooting, installation 30
U
uninstalling, Workspace Virtualization Agent 30
updating virtual software layers 53
upgrading, Workspace Virtualization Agent 30
user profile exclude entries 47, 50
V
variables 66, 71
virtual software archive files. See vsa files
virtual software layers
about 15
actions 58
activating 61
activating on startup 44
adding an application 38
adding delete entries 51
attributes 82
capturing 34
capturing changes 70
cloning a layer 69
creating 33
deactivate on last process exit 69
deactivating 61
deleting 62
virtual software layers (continued)
editing files 45
editing registry settings 46
exclude entries 4748
exporting 59
importing 60
isolating 67
keeping data in layer 69
layer prioritization 84
managing 57
multiple concurrent users 23
OnEvent actions 94
renaming 55
resetting 61
setting HKCR priorities 86
testing 63
types 34
updating 5253
variables 66
viewing properties 65
Virtual Software Packages
about 13
environments for usage 21
rights to modify 22
what to virtualize 19
workflow 18
VirtualSoftwarePackages
methods 89
properties 86
VirtualSoftwareSublayers 89
vsa files, importing 60
VSP. See Virtual Software Packages
W
WMI Provider, removing 31
Workspace Virtualization Agent
components 28
failed installation 31
installation troubleshooting 30
installing 26
installing with command-line 27
requirements 25
runtime mode 32
uninstalling 30
upgrading 30
Index 98
X
XPF files
about 16
exporting 59
importing 60
99 Index

Symantec Workspace Virtualization

Caricato da

Informazioni sul documento

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

Symantec Workspace Virtualization

Caricato da

Copyright:

Formati disponibili

Symantec Workspace

Virtualization 6.1 SP6 User's

Potrebbero piacerti anche