In this article, I’ll cover the considerations for deploying FSLogix Containers to provide a one-stop location for getting up and running quickly.
I’ve written previously on deploying Office 365 Containers and securing Profile Container and Office 365 Containers. This is an updated version of those articles in a single location with some additional information to make your deployment successful.
The beauty in FSLogix Profile Containers and Office 365 Containers is the simplicity in approach that FSLogix has taken to solving the challenges of user experience.
I like to refer to FSLogix’s approach as no-architecture or architecture-less. What I mean by this is that there are no components, other than the FSLogix agent, to implement in your environment. This enables the FSLogix solutions to be flexible and deployed into practically any environment, whether on-premises or in the cloud.
The FSLogix architecture then looks like this:
- The FSLogix agent – a single agent that provides all functionality. This is either deployed to physical PCs, virtual desktops or in a master image
- Group Policy – configuration of the agent is achieved via a GPO
- Storage – any SMB storage will do. Ideally the the storage location will present via an SMB version that matches or is greater than the client. This could be a Windows Server VM or natively provided by your existing storage array.
That’s it – no additional management layers, no back-end, no database, no web tier. Deployed using the services you already own.
The most detailed considerations you may have will be in regard to storage. Most partners and customers that I’ve spoken to recently are using tiered storage or all-flash arrays, so storage performance should be great. You may need to give more consideration for storage performance to Profile Containers (rather than Office 365 Containers), given the nature of Windows Profiles; however, FSLogix Profile Containers will assist in optimising storage performance for profiles.
High availability should be provided by your storage layer, so disaster recovery will be something that you will design for based on specific recovery requirements. In most cases, there’s no need to replicate the Office 365 Containers because they contain only a cache of data stored in Office 365. Profile Containers will have a larger impact on the user experience if unavailable, so you might replicate those to a secondary data centre.
Preparing for Deployment
To prepare for deploying Profile Containers and/or Office 365 Containers the basic process will be:
- Create a secure shared folder to host the FSLogix Containers
- Install the FSLogix agent into your master image
- Create domain groups to allow targeting Containers to specific users
- Create a Group Policy Object to configure Profile Containers and Office 365 Containers
Finally, you can deploy your master image and link the GPO to the OU containing your production machines.
Creating Secure Shares
A secure shared folder location for the FSLogix Containers is important to ensure least privilege. It’s likely you’re already doing this for home folders or user profiles. Microsoft has documented this approach in the this article: How to dynamically create security-enhanced redirected folders or home folders
If you want to take a shortcut, or are looking to automate the process, we have a script that you can use as a template, listed below. Use at your own risk, of course.
Install the FSLogix Agent
Install the agent via the simple Setup programme – the only options you’ll have to change are the product key or the installation folder. If you are installing an evaluation, leave the product key blank to enable the agent fully featured for 30 days.
Documentation for installing the agent, including a silent install, see the FSLogix documentation article: FSLogix Apps Agent Installation.
For testing or an evaluation, you could install in a stand-alone VM or your test image. Installing the agent will require a reboot.
With the agent installed, local groups are created to enable the inclusion or exclusion of users for Profile Containers and Office 365 Containers. By default, Everyone is added to the local Include groups. Via Group Policy, we’ll replace these memberships with new domain groups.
We recommend creating two groups to target each of the Container products – one for Profile Containers and the other for Office 365 Containers. Add users to these groups to enable the features on target desktops.
Configure Group Policy
Today, FSLogix provides an administrative template for the configuration of Office 365 Containers; however, to complete the configuration of Profile Containers and Office 365 Containers, you’ll need to add settings via Group Policy Preferences.
Settings for each feature set are documented here:
In this article, I’m going to configure both Profile Containers and Office 365 Containers. At a minimum, I want to enable both features, configure a storage location and add the domain groups to the local machine groups.
The tables here lists the settings I’ve used in this scenario. This first table is for
|FSLogix / Office 365 Container / Enabled||Enabled||Enable Office 365 Containers|
|FSLogix / Office 365 Container / VHD Location||\\server\share||The storage location for the Office 365 Containers|
|FSLogix / Office 365 Container / VHD Settings / Virtual Disk Type||VHDX||VHDX is enabled because the target environment is Windows Server 2012 or above|
This second table details registry settings that I’ve implemented via Group Policy Preferences. Here I’ve enabled Profile Containers and also enabled Windows Search roaming (to be stored in the Office 365 Container).
Local group membership can also be managed through Group Policy Preferences. Here I’m ensuring the groups I created earlier are added to the local groups to enable targeting of the FSLogix features.
|Local Group||Domain Group||Other Settings|
|FSLogix ODFC Include List||domain\group||Delete all member groups: enabled|
|FSLogix Profile Include List||domain\group||Delete all member groups: enabled|
Now that the individual parts have been configured we can deploy the solution. A basic deployment process should look like this:
- Add user accounts to the domain groups
- Link the GPO to the correct target computer OUs
- Deploy the updated master image
When a user logs on for the first time, the Containers should be automatically created. Viewing the user’s folder will then look something like this:
For a successful deployment and operation of FSLogix Containers, here’s a few tips:
- For Windows Server, install the Windows Search feature and enable the Windows Search service, as this is not enabled by default for Remote Desktop Services Session Hosts
- Configure the ‘Mail to keep offline’ feature in Outlook to keep the cache to a minimum. It’s likely that most users can live with this being set to 3 months; however you may have some users who need more
- Today, the OneDrive client will download the entire OneDrive for Business folder. An up coming release of the OneDrive client will support ‘File on Demand’ which will only downloaded files as users access them, thus reducing storage requirements
Finally, I would highly recommend enabling Modern Authentication across your Office 365 tenant to improve the overall user experience.