App-V – Page 8 – The knack

How I learned to stop worrying and installed the App-V Mgt Server

Posted by nickekallen on July 16, 2012 in App-V 0 Comment

My view on the dedicated and so called “full” infrastructure of the App-V components has been pretty clear – its utterly useless and is always implemented for the wrong reasons. Apart from the fact that its functionality list has been degraded over-time without reason (reporting is in reality not there) – those functions that are there quite often provide a sub-standard implementation (provider policies anyway?). Currently there seem to be two main reasons – where one is mostly used as an excuse for the other – to implement this excuse of a product.

1. It provides a department, group or provider with its own dedicated infrastructure – which it can control and doesn’t have to share with any other department

2. Its fast

Unfortunately the first one can never be solved with any technical measures. Considering that most Microsoft products allow for some type of delegation of permissions (this one doesn’t) and yet there are departments who fight among each other and fail to share resources. App-V provides an easy out to allow these departments to avoid collaborating and go on with their daily operations.

Its fast is usually what keeps people away from Configuration Manager – a policy based client and deployment management tool. Policy-based quite often means waiting time – something that the ConfigMgr team has been addressing very much in the later releases since App-V was acquired by Microsoft.
Fast is good – however, fast doesn’t always mean you can deploy fast. Sometimes it means you break things fast. Quite often the side of things that can turn nasty from an operational perspective.

Lets step away from that and try to implement this. An experience an end-user wouldn’t be able to complete and something admins struggle with – with the downside that at the end of the road. Its not really properly setup.

First of all – we will be implementing this with a Windows Server 2008 R2 SP1 domain controller. The SQL-engine will be SQL Server 2012 Express with TCPIP as an allowed protocol – installed on the same server. I am avoiding Windows Server 2012 – as the road to get the basic functionality done right in the last version of the the Server OS has been to long to start over. And App-V v5 is coming.

Lets get started.

1. Ensure you do not have .NET Framework 4.0 installed. It will break things – and nobody bothered to fix the installer – see this article for yourself.

2. Setup a couple of pre-reqs. Unless you read the documentation in detail – you will not actually know about this. Recommended is to have;

Administrative group (security group – global)
Users Group (security group – global)
A file-share with read-access for users and read-write access for admins.

3. Get the media and kick-off the installation. The App-V Management Server is actually at App-V 4.5 SP2 – and not 4.6 The reason seems to be that no new functionality has been brought in since App-V 4.5 from a server perspective.

3. If you haven’t done so – you will be warned during the installation. The Management Server actually depends on IIS and will require some components;

IIS
ASP.NET
Security
- Windows Authentication
IIS Management Scripts and Tools
IIS 6 Management Compatibility
- IIS 6 Scripting Tools
- IIS 6 Management Console
- IIS 6 Metabase Compatibility
- IIS 6 WMI Compatibility

4. When you get to pick a SQL-server you might actually get to see your SQL-server in the list. If you don’t – its probably because the SQL Server doesn’t have the SQL Server Browser-service running.

5. If you setup a new database – you will be fine. If you decide to reuse an existing database – for any reason – you will get some horrible values in some tables. Once we are finished with the installation – we will verify those.

6. I can’t say why – but the way to select your two previously AD-groups are a bit unique. Nobody decided simply reuse any knowledge?

When you click next – you will see a list of possible options of active directory groups.
Weird way go about this…

Click next, rinse and repeat for the App-V Users group.
The App-V Admins group will be the people who have access to administrate the server. App-V users will have access to connect to the server. Usually – we set a pretty wide-group, such as Domain Users for the App-V Users group. Or a group containing all Domain Users from all domains. Well – you can’t get any applications if you are not part of this group. Not even if you are an admin.

7. Next up is to select where our packages will be stored. This is a bad place to leave the values as default. Its recommended to set a UNC-path – hopefully something placed on a high-capacity fileserver. Maybe using a DFS-path?

If you do not alter this – you will need to change a registry key afterwards. See this KB-article.

So – the default value below is bad. Set a UNC-path.

8. That’s it – kick off the installation and once its done you can restart the computer.

9. Next up is to install a hotfix. KB2007096 is an old article – which still applies to the server. Apply it and get more scalability!

10. Lets continue and check that our database is setup properly. As stated previously – if you install into an existing database – some values will be off. This was first documented by Microsoft as sub-optimal values. If you have more than 100 clients – they are necessary to change.

This is from dbo.Servers

Looks alright – max_conn can be increased to 2000

This is from dbo.SOFTGRID_SERVERS

The important one here is core_timeout should be the recommended value of 120.

There is one more additional thing to correct before we head out of the database. To resolve some errors when it comes to collecting reporting data. Choose the database dbo.REPORTING_PACKAGE_INFORMATION and select the column package_name. This column should allow NULLs – and then reporting data can be uploaded correctly from the client. Might aswell sort that out before you have any clients upload stuff.

11. Lets head into the exciting part of getting some final details into place. Open Active Directory Users and Computers. Locate the computer-account on which your App-V Mgt Server is running on and ensure that its set to be trusted for delegation – it looks like this;

12. Lets verify the service principal names setup. Since all the components are installed on this one server – we should see; softgrid, MSSQL and HTTP.

This is what is done;

Registered ServicePrincipalNames for CN=WIN-Q1IO4I7IPRU,OU=Domain Controllers,DC
=DCLAB,DC=local:
SoftGrid/WIN-Q1IO4I7IPRU
SoftGrid/WIN-Q1IO4I7IPRU.DCLAB.local
Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/WIN-Q1IO4I7IPRU.DCLAB.local
ldap/WIN-Q1IO4I7IPRU.DCLAB.local/ForestDnsZones.DCLAB.local
ldap/WIN-Q1IO4I7IPRU.DCLAB.local/DomainDnsZones.DCLAB.local
DNS/WIN-Q1IO4I7IPRU.DCLAB.local
GC/WIN-Q1IO4I7IPRU.DCLAB.local/DCLAB.local
RestrictedKrbHost/WIN-Q1IO4I7IPRU.DCLAB.local
RestrictedKrbHost/WIN-Q1IO4I7IPRU
HOST/WIN-Q1IO4I7IPRU/DCLAB
HOST/WIN-Q1IO4I7IPRU.DCLAB.local/DCLAB
HOST/WIN-Q1IO4I7IPRU
HOST/WIN-Q1IO4I7IPRU.DCLAB.local
HOST/WIN-Q1IO4I7IPRU.DCLAB.local/DCLAB.local
E3514235-4B06-11D1-AB04-00C04FC2DCD2/381dfaa1-627f-4bb8-93b3-1da0cc84e89
d/DCLAB.local
ldap/WIN-Q1IO4I7IPRU/DCLAB
ldap/381dfaa1-627f-4bb8-93b3-1da0cc84e89d._msdcs.DCLAB.local
ldap/WIN-Q1IO4I7IPRU.DCLAB.local/DCLAB

As you can see – we are missing the SPN for MSSQL and HTTP (especially if providing icons and OSD via HTTP) – which can be set like this (as an example);
setspn -A MSSQLSvc/WIN-Q1IO4I7IPRU:1433 WIN-Q1IO4I7IPRU
setspn –A HTTP/WIN-Q1IO4I7IPRU.dclab.local

13. Lets go into verifying IIS – as per a quite extensive written article there are some additional topics needed to address to get the final pieces together.

Implement this registry key;

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HTTP\Parameters]
“MaxFieldLength”=dword:00065534
“MaxRequestBytes”=dword:16777216

Then restart the WWW-service!

14. According to the same article (as per #13) – we will reverify the IIS-settings. Expand to the default website and lets review the Authentication-settings.

Anonymous is set to disabled and Windows Authentication is set to Enabled. There has been some debate regarding ASP.NET Impersonation – this articlecontradicts what I set. It may be due to the fact that our setup is different – SQL is installed on the same server as the App-V Mgt server. It works if App-V Mgt Server and the SQL server are installed on the same server. If they are not – that might change things. I would suggest to try it with the ability Enabled.

Select Windows Authentication and click Advanced Settings.

Select Providers and see this;

Remove the two that are there and add the Negotiate:Kerberos instead – now looking like this;

In this setup – “Enable Kernel-mode authentication” was needed to be unchecked.

Select the SoftgridManagement and click Authentication. Lets review there whats set;

These should be very much the same as for the Default Website.

I reviewed the Windows Authentication Advanced Settings and verified that it was set the same as for the Default Website.

Also – we need to modify the application pool that is used – the Classic .NET AppPool. Since we are using IIS 7.5 – as standard Identity is set to use the ApplicationPoolIdentity. If you attempt to start the App-V Mgt Server Console and connect – you can see a failed login attempt (the dreaded 0000c800 error is only shown from the console itself) by the applicationpoolidentity. Alter this to NetworkService, by choosing AdvancedSettings for Classic .NET AppPool under Application Pools

14. Finally – we have arrived within the App-V Mgt Server Console and are connected. We aren’t done entirely yet… Lets do some configuration tasks within the system itself.

Right-click your host and choose System Options – under the first tab you should the UNC-path to your previously shared folder (step 7)

Next is to expand Server Groups and locate your server – right-click it and choose Properties.Go to the Advanced-tab. Now, here we have some options that quite often are left untouched. Lets start at the bottom and work our way up…

Number of Core Processes means how many running processes will be started on this server and therefore streaming applications to users. No idea what the Max Chunk Size value means. So – are those optimal values? With today standards in performance – you can probably increase the number of core processes a lot – lets say 20? However, no performance gain has been seen in doing so. Lets keep them this way.

This is the amount of data that is read by the management server each time a request is made for a package. 512 KB is currently pre-read for each streaming operation. This also seems fairly optimal.

These values are never optimal by todays standards. Justin Zarb wrote an article as to why they aren’t – but essentially the Max Memory Allocation should be set to a number that is the amount of RAM you have – apart from the basic resources the OS needs to operate.

One more additional topic – if you have issues with users not receiving applications because their user accounts are part too many Security Groups. Implement this value;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SoftGrid\4.5\Server

“MAX_RTSP_HEADER_BYTES”=dword:0000ffff

According to Microsoft – that might help you.

If it doesn’t work (despite all these instructions) – see Aaron Parkers great article.

And if you need reporting – look into this Solution Accelerator.

Not so hard, right?

Updated 2012-08-10;

Actually – I missed some stuff;

There are a couple of new SQL-scripts that are required to be implemented incase you migrate or use a new version of Microsoft SQL Server (anything after 2008 I think..) within the App-V Technet Accelerator Gallery.

Sage Fund Accounting and Drivers

Posted by nickekallen on July 9, 2012 in App-V 2 Comments

If you are attempting to sequence Sage Fund Accounting and then attempt to start that virtualized instance – you will receive the below error message.

If you used App-V 4.6 SP1 – you might have wondered why a driver was not shown in the post-packaging report. It says all is well. Also – Driver Magician didn’t detect it as a third-party printer at all.

If you check Printers and Devices – there isn’t anything directly that relates to Sage MIP Internal Driver, however if you look around the following will show itself;

Now – we have located the printer and no way to extract it. Apart from the fact that the installation folder contains this;

The contents of the install.log will reveal that a printer was installed – it is called Amyuni Document Converter. Not the Sage MIP Internal Driver. If simply double-clicking install.exe (or executing it from a command-prompt) – that printer will be installed. The Sage MIP Internal Driver will still be missing….

However, if you run a command-line that looks like this (the entire prog-folder was copied to our target computer);

Suddenly – the error message is gone.

ConfigMgr 2012, App-V and /EXE

Posted by nickekallen on June 18, 2012 in App-V 0 Comment

Really? Still not supported?
When using the ConfigMgr integration – it takes over the App-V Client and replaces the default startup for all virtualized applications to something other than sfttray.exe. No harm in that – apart from the fact that any other switch than /launch is not passed on and will result in – nothing!

Why is this important? The App-V team introduced the most wonderful switch /EXE which is explained a lot better by Aaron Parker in his App-V FAQ. (really – he explains it a lot better than I ever could).

How do you work around it?

Command-line that doesn’t work;
C:\Windows\CCM\VAppLauncher.exe /EXE cmd.exe /launch “Microsoft Expression Encoder 4 4.0.4276.0“

Command-line that will work with any App-V Client configuration;
“C:\Program Files\Microsoft Application Virtualization Client\sfttray.exe” /EXE cmd.exe /launch “Microsoft Expression Encoder 4 4.0.4276.0“

In ConfigMgr 2012 – any produced file type association and shortcut will using vapplauncher.exe as the starting point. To get the latter possibility to troubleshoot within the virtual environment – create a shortcut for SFTTRAY.EXE located in the installation folder of the App-V Client and append the /EXE and /launch switches with your application name and version as input (written in italics above).

Adobe Photoshop CS 6 and App-V

Posted by nickekallen on June 11, 2012 in App-V 2 Comments

Adobe still has a problem with beeing virtualized using App-V and when certain versions of the Visual C++ Redistributable components aren’t available on both the sequencer and all possible clients that will run the software. Quite a few instances have been reported of software that has had similiar problems – but newer versions of Adobe consistently seem to run into the problem. There is a thread on appvirtguru.com named Adobe Photoshop CS6 recipe? that explains the errors when you attempt to sequence it.

The errors presented were;

Activation context generation failed for "Q:\PshopCS6.001\VFS\CSIDL_PROGRAM_FILES_COMMON\Adobe\OOBE\PDApp\core\adbeape.dll".Error in manifest or policy file "Q:\PshopCS6.001\VFS\CSIDL_PROGRAM_FILES_COMMON\
 Adobe\OOBE\PDApp\core\Microsoft.VC90.CRT\Microsoft.VC90.CRT.MANIFEST" on line 3. Component identity found in manifest does not match the identity of the component requested. Reference is Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.21022.8". Definition is Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",
 type="win32",version="9.0.30729.4148". Please use sxstrace.exe for detailed diagnosis.

Activation context generation failed for "Q:\PshopCS6.001\VFS\CSIDL_PROGRAM_FILES_COMMON\Adobe\OOBE\PDApp\core\adbeape.dll". Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",type="win32",version="9.0.21022.8" could not be found. Please use sxstrace.exe for detailed diagnosis.

Reading the above information – you can see that a very specific component is missing – often relating to Microsoft VC90 CRT 9.0.21022.8 and Microsoft VC90 CRT 9.0.30729.4148. Those versions seems to be available in Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package ATL Security Update – which you can download and pre-sequencing install on the sequencer and then also deploy to all clients who will be running the virtualized package.

Other notes;

Sequencing Adobe CS6 for App-V – Part 1, the prep

Sequencing Adobe CS6 for App-V – Part 2, the sequencing

Sequencing Adobe CS6 for App-V – Part 3, the testing/how/why

“Gotcha” when sequencing Adobe CS6 (Malformed XML when importing)

Failed to open graphics server

Posted by nickekallen on May 28, 2012 in App-V 0 Comment

Did you get the error message Failed to open graphics server when sequencing a program? Did you implement the solution posted in the App-V Technet forums – and still get the error message?

The below process monitor capture will tell you why- it actually looks in both the current working directory and where it is located. Make a copy to the current working directory – and it will probably be ok!

App-V–Sequence Quickbooks 2012

Posted by nickekallen on May 21, 2012 in App-V 0 Comment

Video available here;

App-V Sequencing Quickbooks 2012 Pro

Setup a VM for packaging

Posted by nickekallen on May 14, 2012 in App-V, Deployment 8 Comments

1. Install Windows 7 that corresponds to your environment (Pro N x86 is my edition)

2. Disable User Account Control

3. Disable System Protection

4. Run Quest vWorkspace Desktop Optimizer

5. Install .NET Framework 4.0

6. Install prerequisites;

Visual C++ 2005

VC++ 2005 SP1

VC++ 2005 SP1 ATL security update

VC++ 2005 SP1 MFC security update

VC++ 2008

VC++ 2008 SP1

VC++ 2008 SP1 with ATL security update

VC++ 2008 SP1 MFC security update

7. Set keyboard layout

8. Ensure VMware Tools are updated

9. Disable all power-settings

10. Run MSCONFIG and disable GUI of boot

11. Remove any excess hardware (floppy-drive, usb-devices)

12. Create shortcuts to any mapped drives / source-folders on the desktop

13. Show all icons in the system tray

14. Run Windows Update (might need to re-enable the service)

15. Activiate Windows

App-V and .appv

Posted by nickekallen on May 7, 2012 in App-V 0 Comment

So, you created a package and wanted to discover what was in it. One way to peak inside of a package – is to simply rename the binary-file from .appv to .zip.

Is it supported? Probably not

What happens if you do it?

You can see the contents;

If you copy the registry.dat file outside and open regedit and choose the following menu;

Select the file and name the hive (something that makes sense) – you will then see the following;

The hive in question is HKEY_LOCAL_MACHINE and APPV (which is what was chosen as name).

What does this mean? Well… You can see the files and the registry parts of a package. But is this supported? Lets divide it into a few different parts;

1. Make a copy of the package – rename it to .zip and mount the .DAT-file into the registry. Seems OK

2. Rename the original file to .zip and then rename it back to .appv.
Seems unlikely to be ok

3. Rename the original file to .zip, make changes to the registry and / or file-structure and then rename it back to .appv
Seems likely to be your-way-out-of-support-scenario

4. Does it seem like a lot more work then Application Virtualization Explorer?
YES!

App-V 5 and OS integration

Posted by nickekallen on April 30, 2012 in App-V 3 Comments

One of the new features that App-V 5 brings to the table is the possibility to more seamlessly integrate to the operating system. But, what does that mean in practice?

Well, if you sequence Mozilla Thunderbird – the following things show up…

Protocol Handlers;

Default Program Handlers;

This means that if you click a link like this;

A new mail will be presented;

(guessing that the empty subject / to-field relates to beta-code Smile )

If you sequence InstEd – more things will be available on the right-click of MSI-files that previously wasn’t there see the Instead It! menu-option)

Of course there are many more features to come – but Application Virtualization just took a major step forward in bringing a native application experience.

Config Mgr 2012 and App-V

Posted by nickekallen on April 23, 2012 in App-V 2 Comments

Previously when using App-V and leveraging the infrastructure of SCCM 2007 and the integration of the App-V you were “limited” to using anything from Configuration Manager. In itself – this wasn’t all that bad, but any type of migration scenario were very much dreaded and the enabling or disabling of the integration was a big on-off switch – that dropped anything previously distributed to App-V Client and took over the control of the client. Configuration Manager 2012 has come a long ways and especially when migrating between different scenarios – it isn’t as controlling in some scenarios.

First – a few notes; There isn’t any configuration on the Configuration Manager 2012 infrastructure or client that enables or disables any functionality. By default – its capable of integration with App-V and will do so without any particular tasks required to be performed by the administrator. Reviewing a previously installed App-V Client that has one single application distributed gives us the following views;

(registry configuration to start an application)

(one application distributed using stand-alone method)

Even though this wasn’t part of the experiments conducted today – any Publishing Servers should be removed once the client controlled by Configuration Manager 2012. Not only once – but it should continuously be removed in the future.

After installing Configuration Manager client, adding applications and creating new deployment (that didn’t require the install – so we could control the time of installation) for our device – the above registry keys didn’t change. Once we initiated the deployment and installed the App-V package – the registry keys switched to the below;

Interesting part is that the old application is still there and will still start (as opposed to using the integration with Configuration Manager 2007 – where it would not start). What was rather surprising though – is that even though all three applications are started, the one not distributed via Configuration Manager 2012 will never say that it is In Use.