in this video we hide applications with FSLogix hello everyone my name is
Travis and this is Ciraltos you probably already know that FSLogix is
great for managing profiles in remote desktop or VDI environments but it has
some other tricks up its sleeve it can hide applications from users in this
video I'm going to cover some of the basics of FSLogix application masking
then do a demo of creating and applying a masking rule before that please take a
second to subscribe like and click the bell icon for new content why would one
want to hide an application if you're using RDS Windows virtual desktop or VDI
you probably start with a base image you probably also have applications for
accounting that you don't want the rest of the organization to see and maybe
some developer tools that only the developer should have access to one
option is to create multiple versions of an image for different groups
yuck I'd hate to have to manage that FS logic offers a better option called
application masking application masking is a way to create a policy that hides
applications then assign that policy to user groups
computers are OU's a complete list of assignments are on the screen
assignments are cumulative applying from the top down if the first rule applies
to everyone and then the second one excludes the user the rule would apply
to everyone except that user however if the order was reversed the rule would
apply to everyone applications are masked using different
rule types hiding rules hide items such as files directory registry value
registry key printers or fonts a redirect rule redirects a file directory
registry or value key an app container rule redirects contents into a VHD and a
specified value rule assigns a value for a specific registry setting some
variables are available when creating rules a wild-card is available for
source paths destination paths have specific variables that
preceded and followed by to underscore this includes user said user name and
user profile path the environmental variables on the screen are available
for both source and destination paths application masking rules are created
from a computer with the same configuration as the client that will
apply the rules there is an FSLogix rule editor installed to create the
rules if you're using a managed image for VDI RDS or Windows virtual desktop
that should be the image used to create the rules in the example coming up I
create a new VM with a base Windows virtual desktop image and then apply the
rules to Windows virtual desktop host pools with the same image the client
computers have to have FSLogix installed they don't need a rule editor
once created the rules are copied to the C program files FSLogix app rules
directory the rules are automatically detected by FSLogix and then compiled
and updated on the system copying these rules to the clients is not so automatic
if you have a way to distribute files to computers such as SCCM that would be the
best option I don't have that so I'm using a copy script and a GPO that runs
at startup I'll make that script available on github if you want to see
it link will be below for the demo I'm starting out with a VM created with my
Windows virtual desktop based image this is the computer I'll use to create the
rules on I also have a Windows virtual desktop host pool the rules will be
applied to all of these VMs have FS logic installed we'll go through the
following installing the FSLogix rule editor on the rule creation VM create a
rule to hide an installed program in this case Chrome and apply that rule to
a group of users create a rule to hide specific applications and start menu
options I'm going to hide MS access from the Start menu in this example and apply
that to one user once that's created we'll apply the rule and test let's get
started on the VM we use to edit the rules here we are at the base system
this is a system with the same applications installed on it as the
Windows virtual desktop environment or the same Azure VDI environment you
want to make sure that system your editing rules on has the
same set of applications Azure Windows virtual desktop or VDI environment from
here I'm going to download the FSLogix profile service which is part of the
main FSLogix download and that URL is aka OMS
and here you can see it's downloading once that's done we'll go into the
download folder okay here we are in the downloads folder
I'll just extract the FSLogix app let's go to x64 releases here we have three
options I'm gonna choose the FSLogix apps rule editor setup agree to the
license terms and install ok that's set up successfully we'll close and let's
open up the rule editor next let's create a rule to hide an installed
program I don't have a lot on this machine so I'm going to use Chrome for
this example so I'm going to create a new rule
I need to give the rule a name so we'll call this hide Chrome
and here I can start out with a blank rule set I can enter a program path or I
can choose from an installed program here you can see I have chrome listed so
if I click that it gives the application directory I'm gonna click scan that's
gonna create all the rules for Chrome once it's done click OK and here you can
see it has a bunch of hide roles it has a directory hide rule a registry key
hide rule file hide rule and so on so it's created all these rules for me to
hide Chrome now there's one thing I want to point out right here is a apply rules
to system this is good for testing if I click that watch the Google Chrome icon
it goes away so it's gonna apply the rule to this system and that's why it's
important to have a system that's the same Azure production where these
rules will be applied to so you can run these tests
this won't however apply the rules to users groups or machines next we're
gonna add an assignment so with hide chrome selected I'll click on the person
here which is manage assignments here you can see everybody's listed and it's
applied to nobody so I'm gonna add somebody I'm gonna add group I'm gonna
search for the group and I have a group called no Chrome
there it is now remember that the way this policy works is every one is not
applied and then next is no chrome is applied if I move that up now every one
would be not applied so I'm going to move that back down and click apply and
ok so now when a user who is a member of that group logs into a machine they
should not be able to use Chrome next I'm going to create another rule to hide
an application if I create a new rule I'm gonna call this hi to access so I
want to stop people from using access I have the option to choose from an
install program but Microsoft Office is listed I can't select one specific item
from Microsoft Office so I'm gonna start with a blank rule now I have no rules in
here but I'm gonna create one so we'll go a new rule so the first thing I'm
gonna do is hide the start menu item so I'm going to go to browse for a file and
I'll put in the path this is the path for the start menu and we can see access
right there so that's a shortcut that displays on the Start menu I'm gonna
click open that's a file or a registry value and I'll click OK so now I have
one rule that will hide the start menu item but I also want to make sure that
nobody can get around that and actually open up the executable so I'm gonna
create another rule this will also be a file object type so I'm gonna browse for
a file this time I'll go to the install directory and we should be able to find
MS access in here there it is and I'll click OK and I'm gonna select that and
click apply now one thing I noticed as I was doing this I still have access
showing up here but if I click it nothing happens the reason for that is
because the start menu has already been built but it will remove the link for a
new user signing in I'm gonna uncheck that and we'll make sure that that Start
menu item is gone for users here in a minute so now that I have these hide
access rules set up I need to apply it to somebody and this time I'm going to
manage assignment and I'm going to add to a user I'll select a user this user
is going to be test 3 user 3 so this user
now assign the ruleset of hide access I'll click apply and ok okay next let's
log into each one of these users and see if it's working without any rules
applied I'll start with test 1 user 1
I'll login to the host pool Here I am logged in with test 1 user 1 and you can
see I have Chrome I can open up Chrome and everything works just as expected
okay let's login with the other user test 3 user 3 I'm using multiple
browsers so I can login with different identities and I'll login to the hosts
pool and just like the other user i have chrome available I also have
access available
so that's the experience without the rules applied now let's apply the rules
I have a GPO set up that runs a PowerShell script that copies the files
from a network location to the C program file FSLogix Apps rules directory on
each on each VM in the host pool I'll make the script available on github if
anybody is interested I'll include the link below the files could be copied
manually to each of the session host but that's not very efficient for larger
organizations better would be to have an automation tool like SCCM to push these
out automatically I don't have that so I'm using the GPO the GPO is okay but
the thing I don't like about it is I have to restart the BMS for the new
files to get updated but for a demo that works so I'm going to go to the file
share and the app mask share is where I'll keep the rules so this is the
source or where I'm going to put the rules where the GPO will pick it up from
I'm going to open up another file explorer and from here if we go to
documents FSLogix rule set here are the rules that we created earlier each rule
has an FX a and an FX our file so I'm going to copy these and I'll put them
the file share next I'm gonna restart the VMS so it can pick up those files
here are the two VMS I've only got two hosts in this host pool and I'm gonna
select restart I'm just gonna pause here and come back once it's finished the VMS
ever started and here what I'm doing is I'm going to the first VM in the host
pool I'm just getting to the see dollar signs here I'm gonna go into Program
Files FSLogixs Apps rules here's where you would need to manually copy those
files if you're doing it that way that GPL copied the files from the network
share to this location if I come back up we can see that once FSLogix sees those
files in the rules folder it's going to compile them and copy them up to the
compiled rules folder so that's all set so let's go and change this to one and
see if everything's there as well yep there's a rules and there's the compiled
rules so all I'm doing here is just validating that the rules were copied
over successfully and they were compiled now let's go back to those machines so
this is test one user one and this one was part of the no Chrome group so let's
login here I'm logged in as test 1 user 1 and you can see right away I'm missing
Chrome I can't even find it by searching for it
so that rule worked let's go over to test three user three this one was part
of the no Chrome group as well as having the no access rule applied here we are
logged in as test three user three and we can notice that the icon for Chrome
is missing and if we come in here we also don't have access and if we search
for access
shows up these two users are logged into the same host pool set up with the same
base image with FSLogix app masking we selectively hid applications from
specific users and groups based on the rules we set up
now you can selectively control who has access to what in a Windows virtual
desktop host pool if you found this helpful please like subscribe and click
the bell icon for new content thanks for watching